chore(deps): update indirect go modules #2518
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Weekly on Monday 03:27 UTC — off-peak and offset from the other | |
| # scheduled jobs (scorecard 06:00 Mon, labels 04:17 Mon, stale 04:37 | |
| # daily). | |
| - cron: '27 3 * * 1' | |
| # Default to read-only; the analyze job opts into security-events: write. | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 120 | |
| permissions: | |
| # Upload CodeQL results to the code-scanning dashboard. On pull_request | |
| # this is also what lets CodeQL post new-alert annotations on the diff. | |
| security-events: write | |
| # Check out the repository. | |
| contents: read | |
| # Read workflow run metadata (required by codeql-action on private | |
| # repos; harmless on a public repo). | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # Go uses build-mode: manual. The alternative, autobuild, runs `make` | |
| # from the repo root, whose included hack/common-envs.mk does a | |
| # `$(shell git fetch upstream --tags)` at parse time — a network call | |
| # to a non-origin remote that has no bearing on the analysis and is a | |
| # flake vector. Instead the "Build Go modules" step below compiles | |
| # each first-party module explicitly. This keeps the same coverage | |
| # autobuild aimed for — the root module, api/apps/v1alpha1, and the | |
| # three nested image modules — while the _repos/* upstream clones are | |
| # gitignored and absent on a clean checkout, so they are excluded for | |
| # free. setup-go pins the toolchain to the root go.mod version. | |
| - language: go | |
| build-mode: manual | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: false | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| # CodeQL traces these compiler invocations to build its database. Each | |
| # first-party module is a separate go.mod, so `go build ./...` from the | |
| # root never reaches the nested ones — build each explicitly. No `make`, | |
| # so no upstream fetch. | |
| - name: Build Go modules | |
| if: matrix.build-mode == 'manual' | |
| shell: bash | |
| run: | | |
| set -euxo pipefail | |
| for mod in \ | |
| . \ | |
| api/apps/v1alpha1 \ | |
| packages/apps/kubernetes/images/kubevirt-csi-driver \ | |
| packages/system/dashboard/images/token-proxy \ | |
| packages/system/kubeovn-webhook/images/kubeovn-webhook; do | |
| echo "::group::go build ${mod}" | |
| ( cd "${mod}" && go build ./... ) | |
| echo "::endgroup::" | |
| done | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | |
| with: | |
| category: "/language:${{ matrix.language }}" |