mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-26 13:07:04 +09:00
Aleksei Sviridkin
5eee22fe28
The unit and controller test job has no module cache and runs on an ephemeral runner, so every run fetches every module from proxy.golang.org, and one transient stream reset fails the job. It now restores the module cache keyed on every go.sum in the tree and prefetches the modules of every tracked go.mod through a bounded retry, hack/go-mod-download.sh. The cache is written from main by the build cache warmer under the same key, because a cache saved by a PR run is visible to that PR only, while one saved on the default branch is readable from every PR. Every job that runs Go on the runner sets GOPROXY=https://proxy.golang.org|direct so any proxy error falls back to the origin. The release jobs get only that, not a cache. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
99 lines
3.5 KiB
YAML
99 lines
3.5 KiB
YAML
name: CodeQL
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
schedule:
|
|
# Weekly on Monday 03:27 UTC — off-peak and offset from the other
|
|
# scheduled jobs (scorecard 06:00 Mon, labels 04:17 Mon, stale 04:37
|
|
# daily).
|
|
- cron: '27 3 * * 1'
|
|
|
|
# Default to read-only; the analyze job opts into security-events: write.
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 120
|
|
env:
|
|
# The pipe falls back to direct on any proxy error (hack/common-envs.mk).
|
|
GOPROXY: "https://proxy.golang.org|direct"
|
|
permissions:
|
|
# Upload CodeQL results to the code-scanning dashboard. On pull_request
|
|
# this is also what lets CodeQL post new-alert annotations on the diff.
|
|
security-events: write
|
|
# Check out the repository.
|
|
contents: read
|
|
# Read workflow run metadata (required by codeql-action on private
|
|
# repos; harmless on a public repo).
|
|
actions: read
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
# Go uses build-mode: manual. The alternative, autobuild, runs `make`
|
|
# from the repo root, whose included hack/common-envs.mk does a
|
|
# `$(shell git fetch upstream --tags)` at parse time — a network call
|
|
# to a non-origin remote that has no bearing on the analysis and is a
|
|
# flake vector. Instead the "Build Go modules" step below compiles
|
|
# each first-party module explicitly. This keeps the same coverage
|
|
# autobuild aimed for — the root module, api/apps/v1alpha1, and the
|
|
# three nested image modules — while the _repos/* upstream clones are
|
|
# gitignored and absent on a clean checkout, so they are excluded for
|
|
# free. setup-go pins the toolchain to the root go.mod version.
|
|
- language: go
|
|
build-mode: manual
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: false
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: ${{ matrix.build-mode }}
|
|
|
|
# CodeQL traces these compiler invocations to build its database. Each
|
|
# first-party module is a separate go.mod, so `go build ./...` from the
|
|
# root never reaches the nested ones — build each explicitly. No `make`,
|
|
# so no upstream fetch.
|
|
- name: Build Go modules
|
|
if: matrix.build-mode == 'manual'
|
|
shell: bash
|
|
run: |
|
|
set -euxo pipefail
|
|
for mod in \
|
|
. \
|
|
api/apps/v1alpha1 \
|
|
packages/apps/kubernetes/images/kubevirt-csi-driver \
|
|
packages/system/dashboard/images/token-proxy \
|
|
packages/system/kubeovn-webhook/images/kubeovn-webhook; do
|
|
echo "::group::go build ${mod}"
|
|
( cd "${mod}" && go build ./... )
|
|
echo "::endgroup::"
|
|
done
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
|
|
with:
|
|
category: "/language:${{ matrix.language }}"
|