mirrors/velero
1
0 Fork 0
mirror of https://github.com/vmware-tanzu/velero.git synced 2026-11-08 04:18:06 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
7,045 Commits 103 Branches 191 Tags
dependabot/github_actions/github-actions-271845e79b
Commit Graph
2 Commits
Author SHA1 Message Date
dependabot[bot] a3d52faa85 build(deps): bump the github-actions group with 2 updates 
Bumps the github-actions group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.38.3 to 4.39.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...9b3254085494b55a0f7c4c2b3d2d52cc712ce370)

Updates `github/codeql-action/analyze` from 4.38.3 to 4.39.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...9b3254085494b55a0f7c4c2b3d2d52cc712ce370)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-30 10:56:29 +00:00
Tiger KaovilaiandClaude Code 4681af6e75 ci: add CodeQL analysis for Go (#10695) 
* ci: add CodeQL analysis for Go

The Scorecard SAST check scores 0 because the repository only uses
github/codeql-action to upload SARIF from Scorecard and Trivy, and does
not run any static analysis. Add a CodeQL workflow for Go that runs on
pushes and pull requests to main and weekly, with actions pinned by
commit SHA. Skipped on forks.

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Co-Authored-By: Claude Code (model: Claude Sonnet 5.5) <noreply@anthropic.com>

* ci: use autobuild for CodeQL Go analysis

The Go extractor does not support build-mode none. Set up Go from go.mod
and use autobuild.

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Co-Authored-By: Claude Code (model: Claude Sonnet 5.5) <noreply@anthropic.com>

---------

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Co-authored-by: Claude Code (model: Claude Sonnet 5.5) <noreply@anthropic.com>
 2026-10-30 18:43:31 +08:00