test+fix: cover discord + mongodb; fix latent panic in intelligentTru… #201
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # CodeQL static analysis for Go. Runs on every PR, every push to main, | |
| # and weekly to catch new query packs landing upstream. Findings appear | |
| # in the Security tab; default-severity ERROR also fails the PR check. | |
| # | |
| # Why this AND Semgrep? Different rule packs catch different classes of | |
| # bugs — Semgrep is great at custom org-policy patterns, CodeQL is better | |
| # at dataflow-heavy queries (taint sinks, SSRF, SQLi-style). They overlap | |
| # but the union finds more. | |
| on: | |
| push: | |
| # Run on every branch push so Scorecard's "% of commits scanned by SAST" | |
| # check sees coverage on intermediate / feature commits, not just main. | |
| # The concurrency group below cancels superseded runs on the same ref. | |
| branches: ['**'] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Sunday 04:23 UTC — off-peak, off-Monday-morning. | |
| - cron: '23 4 * * 0' | |
| workflow_dispatch: | |
| # Cancel in-progress runs for the same commit when a new event lands. | |
| # Key on commit SHA (PR head when triggered by pull_request, pushed SHA | |
| # otherwise) instead of github.ref. With `push: branches: ['**']` and | |
| # `pull_request: branches: [main]` both active, a single PR commit | |
| # triggers two runs — one for the push event (refs/heads/<branch>) and | |
| # one for the PR event (refs/pull/N/merge). Keying on ref leaves both | |
| # in distinct groups, so neither cancels the other. SHA-keyed grouping | |
| # dedups them. Codex round-2 P2 catch on PR #264. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.head.sha || github.sha }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze Go | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| security-events: write # upload SARIF to the Security tab | |
| actions: read # CodeQL templates fetch workflow metadata | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [go] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| # Pin Go to the version declared in go.mod. Without this, CodeQL | |
| # Autobuild uses the runner's bundled Go (older than our 1.25.x | |
| # directive), which fails the compile and surfaces as a CI red | |
| # rather than a real finding (gemini round-1 P2). | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version-file: go.mod | |
| cache: false | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # security-extended adds queries beyond the default "security | |
| # and quality" pack — taint tracking, less-common sink types, | |
| # crypto misuses. Worth the extra ~2 min run-time for an OSS | |
| # supply-chain tool. | |
| queries: security-extended | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 | |
| - name: Perform analysis | |
| uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 | |
| with: | |
| category: /language:${{ matrix.language }} |