deps(deps): bump mkdocs-mermaid2-plugin from 1.1.1 to 1.2.3 in /docs #110
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # CodeQL static analysis for Go. Runs on every PR, every push to main, | |
| # and weekly to catch new query packs landing upstream. Findings appear | |
| # in the Security tab; default-severity ERROR also fails the PR check. | |
| # | |
| # Why this AND Semgrep? Different rule packs catch different classes of | |
| # bugs — Semgrep is great at custom org-policy patterns, CodeQL is better | |
| # at dataflow-heavy queries (taint sinks, SSRF, SQLi-style). They overlap | |
| # but the union finds more. | |
| on: | |
| push: | |
| # Run on every branch push so Scorecard's "% of commits scanned by SAST" | |
| # check sees coverage on intermediate / feature commits, not just main. | |
| # The concurrency group below cancels superseded runs on the same ref. | |
| branches: ['**'] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Sunday 04:23 UTC — off-peak, off-Monday-morning. | |
| - cron: '23 4 * * 0' | |
| workflow_dispatch: | |
| # Cancel in-progress runs for the same PR when a new commit lands. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze Go | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| security-events: write # upload SARIF to the Security tab | |
| actions: read # CodeQL templates fetch workflow metadata | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [go] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| # Pin Go to the version declared in go.mod. Without this, CodeQL | |
| # Autobuild uses the runner's bundled Go (older than our 1.25.x | |
| # directive), which fails the compile and surfaces as a CI red | |
| # rather than a real finding (gemini round-1 P2). | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version-file: go.mod | |
| cache: false | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # security-extended adds queries beyond the default "security | |
| # and quality" pack — taint tracking, less-common sink types, | |
| # crypto misuses. Worth the extra ~2 min run-time for an OSS | |
| # supply-chain tool. | |
| queries: security-extended | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 | |
| - name: Perform analysis | |
| uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 | |
| with: | |
| category: /language:${{ matrix.language }} |