codeql.yml

name: CodeQL

# Static analysis (SAST) over the Go sources. Runs on every PR and on pushes to
# the default branch, plus a weekly scheduled scan so newly published query
# packs catch existing code. Results land in the code-scanning dashboard.
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '24 6 * * 1'

# Read-only by default; the analyze job opts into security-events:write.
permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze (Go)
    runs-on: ubuntu-latest
    permissions:
      # Required to upload CodeQL results to the code-scanning dashboard.
      security-events: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      # cache: false is deliberate. CodeQL's Go extractor only sees code that is
      # actually compiled while it traces the build; a warm build cache (shared
      # with the other CI jobs) would make `go build` a no-op and yield "no source
      # code seen during build". Starting cold guarantees real compilation.
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: "1.26.4"
          cache: false

      # Go does not support build-mode: none, so extraction is traced through a
      # real build. There is no root module to build and the SDK-backed sink
      # destinations live outside the workspace, so the manual build walks the
      # in-workspace modules (the same set ci.yml lints and tests) and compiles
      # each under the CodeQL tracer.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          languages: go
          build-mode: manual

      - name: Build (CodeQL tracing)
        shell: bash
        env:
          MODULES: "state state/expr durable cluster transport wasm e2e examples/fooddelivery examples/dispatch telemetry telemetry/slog telemetry/otel telemetry/datadog sink sink/bridge sink/file sink/http sink/prometheus sink/slog"
        run: |
          # Force a cold build cache so every package is recompiled under the
          # CodeQL tracer (otherwise nothing is extracted; see cache: false above).
          go clean -cache
          # Build from inside each module dir (cd, not `go build -C`): the
          # extractor traces the in-process compiles, and `-C` re-execs the go
          # command in a way the tracer does not follow, which yields an empty
          # database ("no source code seen during build").
          for module in $MODULES; do
            echo "::group::build ($module)"
            ( cd "$module" && go build ./... )
            echo "::endgroup::"
          done

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          category: "/language:go"