chore: migrate nvsnap and nvcf-unbound golangci-lint configs to v2 #54
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: Apache-2.0 | |
| name: codeql | |
| on: | |
| push: | |
| branches: [main] | |
| # Only run when compiled source or this workflow changes. Docs, charts, | |
| # migrations, and other non-code PRs skip the scan (the Go autobuild is | |
| # expensive). The weekly schedule still does a full unconditional scan. | |
| paths: | |
| - "src/**" | |
| - "**/*.go" | |
| - "**/*.rs" | |
| - "**/go.mod" | |
| - "**/go.sum" | |
| - "**/Cargo.toml" | |
| - "**/Cargo.lock" | |
| - ".github/workflows/codeql.yml" | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "src/**" | |
| - "**/*.go" | |
| - "**/*.rs" | |
| - "**/go.mod" | |
| - "**/go.sum" | |
| - "**/Cargo.toml" | |
| - "**/Cargo.lock" | |
| - ".github/workflows/codeql.yml" | |
| schedule: | |
| # Weekly full scan, Monday 03:27 UTC. | |
| - cron: "27 3 * * 1" | |
| concurrency: | |
| group: codeql-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| security-events: write | |
| pull-requests: write | |
| jobs: | |
| analyze: | |
| name: CodeQL (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| # Keep one language's failure from cancelling the others. | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # Go is a traced language and does not support build-mode none, so it | |
| # autobuilds. Rust has no autobuilder and uses buildless extraction. | |
| - language: go | |
| build-mode: autobuild | |
| - language: rust | |
| build-mode: none | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| # CodeQL does not need the repo token after checkout. | |
| persist-credentials: false | |
| - name: CodeQL Analysis | |
| uses: NVIDIA/dsx-github-actions/.github/actions/codeql-scan@9a9ce3a7770a8b53d2726afa920be3276bc3ddd7 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| upload-sarif: true | |
| post-pr-comment: true | |
| # Non-blocking during rollout: findings surface in the Security tab and | |
| # as a PR comment, but do not gate merges yet. Tighten once triaged. | |
| fail-on-findings: false |