code-analysis.yml

name: "CodeQL Analysis"
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
  schedule:
    - cron: '0 0 * * *'
jobs:
  analyze-code:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
      pull-requests: write
    
    env:
      GOPRIVATE: "github.com/onflow, github.com/axiomzen"
     # ORG_READER_PAT: ${{ secrets.ORG_READER_PAT }}
     # ORG_READER_USERNAME: ${{ secrets.ORG_READER_USERNAME }}

    strategy:
      fail-fast: false
      matrix:
        languages: ['go']
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
            go-version-file: ./go.mod

      - name: Install third-party vendor
        run: go install github.com/nomad-software/vend@v1.0.3

     # - name: set credentials for private repos
     #   run: rm -f ~/.gitconfig && git config --global url.https://$ORG_READER_USERNAME:$ORG_READER_PAT@github.com/.insteadOf https://github.com/ && cat ~/.gitconfig

      # use a third-party vendoring tool instead of "go mod vend" because of the issue
      # reported here https://github.com/golang/go/issues/26366. onflow/crypto has
      # non-go files that are not copied by the Go standard tooling.
      - name: Tidy Go and mod vendor
        run: go mod tidy && vend


      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.languages}}
          queries: security-extended

      - name: Build
        run: go build -mod=vendor ./...

      - name: CodeQL Analyze 
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.languages}}"
          # need org username and pat to access private libraries