ci: Automate version bump to v2.0.0 (#75) #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: CodeQL | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # No scheduled scans by design: every code change reaches main via push or PR, | |
| # both of which trigger this workflow. Security advisories for Rust dependencies | |
| # are independently caught by `cargo audit` in ci.yml. | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # `actions` covers GitHub Actions workflow hygiene (e.g. the | |
| # `actions/missing-workflow-permissions` rule). | |
| - language: actions | |
| build-mode: none | |
| # `rust` is GA since Oct 2025 and supports build-mode `none`, | |
| # so we get source-level analysis without compiling the workspace. | |
| # Note: `cargo audit` in ci.yml stays as the authoritative source | |
| # for known CVEs in dependencies; CodeQL adds taint/quality checks | |
| # on our own source. | |
| - language: rust | |
| build-mode: none | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| queries: security-and-quality | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{ matrix.language }}" |