codeql.yml

name: "CodeQL"

on:
    push:
        branches: master
        paths:
            - ".github/workflows/codeql.yml"
            - "**/*.go"
    pull_request:
        branches: master

jobs:
    codeql:
        name: CodeQL
        if: |
            github.actor != 'dependabot[bot]' &&
            github.actor != 'github-actions[bot]' &&
            github.actor != 'protected-auto-commits[bot]'
        runs-on: ubuntu-latest
        permissions:
            security-events: write
            packages: read
            actions: read
            contents: read
        steps:
          - name: Checkout Repo
            uses: actions/checkout@v4

          - name: Initialize CodeQL
            uses: github/codeql-action/init@v3
            with:
                languages: go
                build-mode: autobuild

          - name: Perform CodeQL Analysis
            uses: github/codeql-action/analyze@v3
            with:
                category: "/language:go"

    lint:
        name: Lint
        runs-on: ubuntu-latest
        needs: codeql
        steps:
          - name: Checkout Repo
            uses: actions/checkout@v4

          - name: Setup Go
            uses: actions/setup-go@v5
            with:
                go-version: 1.23

          - name: Go Mod Tidy
            run: go mod tidy

          - name: GolangCI Lint
            uses: golangci/golangci-lint-action@v6
            with:
                version: v1.61.0