Consolidate CodeQL scanning for Go and Actions

[Jared Holgate (jaredfholgate)]

Summary

• move CodeQL out of the Ubuntu/Windows build matrix into one dedicated Linux workflow
• scan Go and GitHub Actions on pushes, pull requests, and a weekly schedule
• pin Actions by SHA and use the Action-linked CodeQL bundle so database format changes follow reviewed Action updates
• reduce the build workflow token to contents: read

Why

S360 reports that github:azure/mapotf needs a Go snapshot. GitHub CodeQL itself is configured and passing, but CAP Central job 5d1a40d6-9006-473e-9e77-14ae2cabd570 failed because its CodeQL 2.26.0 analyzer and Microsoft Go query pack 0.1.565 could not analyze a newer GitHub-generated database. The dedicated workflow uses the bundle linked to the reviewed Action version while removing duplicate per-OS scans.

GitHub default setup is also active today. After this pull request merges, a repository administrator should disable default setup so this advanced workflow is the only CodeQL producer.

Validation

• go build ./...
• go test ./...

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

Adds a dedicated GitHub Actions workflow intended to run CodeQL “Advanced” scanning for this repository.

Changes:

• Introduces a new .github/workflows/codeql.yml workflow for CodeQL analysis.
• Configures a language matrix (actions + go) with per-language build modes.
• Triggers analysis on pushes/PRs to main and on a weekly schedule.

Suppressed comments (2)

.github/workflows/codeql.yml:90

• The manual build step block is mis-indented under steps: (and the run: | block contents need to be indented relative to run). As written, this YAML will not parse correctly.

    - name: Run manual build steps
      if: matrix.build-mode == 'manual'
      shell: bash
      run: |

.github/workflows/codeql.yml:101

• The CodeQL analyze step is mis-indented under steps:. It also should be pinned to a SHA for consistency with the rest of the repo’s workflows.

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4
      with:
        category: "/language:${{matrix.language}}"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.