codeql-analysis-cron-schedule.yml

# This is an alternative to the codeql-analysis.yml that only contains a scheduled evaluation of CodeQL
# The action runs for all branches defined in jobs.analyze.strategy.matrix.branches.
# Every new production branch (minor release branches) should be added to this list.

name: "Scheduled CodeQL"

# run twice a week at a random time on Sunday and Wednesday evening so its available the next morning
on:
  schedule:
    - cron: '42 21 * * 0,3'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        # CodeQL runs on these branches
        branches:
          - 'master'
          - 'V5.4'
          - 'V6.0'

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ matrix.branches }}

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          # use go version from go.mod.
          go-version-file: 'go.mod'

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: 'go'
          # If you wish to specify custom queries, you can do so here or in a config file.
          # By default, queries listed here will override any specified in a config file.
          # Prefix the list here with "+" to use these queries and those in the config file.
          # queries: ./path/to/local/query, your-org/your-repo/queries@main

      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
      # If this step fails, then you should remove it and run the build manually (see below)
      - name: Autobuild
        uses: github/codeql-action/autobuild@v3

      # ℹ️ Command-line programs to run using the OS shell.
      # 📚 https://git.io/JvXDl

      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
      #    and modify them (or add more) to build your code if your project
      #    uses a compiled language

      #- run: |
      #   make bootstrap
      #   make release

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3