name: CodeQL
on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  schedule:
    - cron: '35 6 * * 3'

# Declare default permissions as read only.
permissions: read-all

jobs:
  analyze:
    name: Analyze (go)
    # Skip on forks; code scanning results are only meaningful for the canonical repo.
    if: github.repository == 'velero-io/velero'
    runs-on: ubuntu-latest
    permissions:
      # Needed to upload the results to the code-scanning dashboard.
      security-events: write
      # Needed to read workflow run information for CodeQL.
      actions: read
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod

      - name: Initialize CodeQL
        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
        with:
          languages: go
          build-mode: autobuild

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
        with:
          category: "/language:go"