feat(k8s): expose UDP ports on cloud-compose via mixed-protocol LB #488
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # CodeQL static analysis for Go. Runs on every PR, every push to main, | |
| # and weekly to catch new query packs landing upstream. Findings appear | |
| # in the Security tab; default-severity ERROR also fails the PR check. | |
| # | |
| # Why this AND Semgrep? Different rule packs catch different classes of | |
| # bugs — Semgrep is great at custom org-policy patterns, CodeQL is better | |
| # at dataflow-heavy queries (taint sinks, SSRF, SQLi-style). They overlap | |
| # but the union finds more. | |
| on: | |
| push: | |
| # Direct pushes to main only (post-merge). PR commits are covered | |
| # by the pull_request event below. | |
| # | |
| # Scorecard's SAST check counts merged PRs on the default branch | |
| # and asks whether a SAST tool ran successfully on each PR's HEAD | |
| # commit. Every commit landing in main arrives via a merged PR | |
| # (pull_request scan) or a direct push (push scan), so coverage is | |
| # complete without the `['**']` net that triggered duplicate runs | |
| # for every PR commit — push and pull_request fired on the same | |
| # SHA, one was cancelled by the concurrency group, leaving noisy | |
| # "cancelled" entries on every PR's checks page. | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Sunday 04:23 UTC — off-peak, off-Monday-morning. | |
| - cron: '23 4 * * 0' | |
| workflow_dispatch: | |
| # SHA-keyed dedup so a manual rerun on the same commit supersedes the | |
| # in-flight one. With push restricted to main + pull_request on PRs, | |
| # a single commit no longer fires two events; no PR-side cancellation | |
| # noise. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.head.sha || github.sha }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze Go | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| security-events: write # upload SARIF to the Security tab | |
| actions: read # CodeQL templates fetch workflow metadata | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [go] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| # Pin Go to the version declared in go.mod. Without this, CodeQL | |
| # Autobuild uses the runner's bundled Go (older than our 1.25.x | |
| # directive), which fails the compile and surfaces as a CI red | |
| # rather than a real finding (gemini round-1 P2). | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version-file: go.mod | |
| cache: false | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # security-extended adds queries beyond the default "security | |
| # and quality" pack — taint tracking, less-common sink types, | |
| # crypto misuses. Worth the extra ~2 min run-time for an OSS | |
| # supply-chain tool. | |
| queries: security-extended | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| - name: Perform analysis | |
| uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| with: | |
| category: /language:${{ matrix.language }} |