chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.45.0 #505
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # PCMI — CodeQL SAST (PR #3, "Security" tech-debt row). | |
| # Second static-analysis layer on top of govulncheck (dependency-focused). | |
| # Scans Go, Python, and TypeScript with the security-and-quality query pack. | |
| # Findings (when SARIF upload is on): Security → Code scanning alerts. | |
| # Triggers: push/PR to main and release/**, weekly cron, workflow_dispatch. | |
| # paths-ignore on docs/badges keeps cron runs from re-analysing unchanged prose. | |
| # | |
| # SARIF upload: GitHub rejects uploads until Code scanning is enabled under | |
| # Settings → Security → Code scanning (and GHAS where required). Without that, | |
| # upload: always fails the whole job with HTTP 403. We default to analysing | |
| # locally only (upload never) and opt into uploads via repo variable: | |
| # Settings → Secrets and variables → Actions → Variables → CODEQL_UPLOAD_SARIF = true | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - release/** | |
| paths-ignore: | |
| - 'badges/**' | |
| - '**/*.md' | |
| - 'docs/**' | |
| pull_request: | |
| branches: | |
| - main | |
| - release/** | |
| paths-ignore: | |
| - 'badges/**' | |
| - '**/*.md' | |
| - 'docs/**' | |
| schedule: | |
| # Monday 04:23 UTC — off-peak vs typical EU/US-east release flows | |
| - cron: '23 4 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| # Required by github/codeql-action/* to upload SARIF to the Security tab. | |
| actions: read | |
| contents: read | |
| security-events: write | |
| concurrency: | |
| group: codeql-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # javascript-typescript covers sdk/typescript .ts and compiled .js in one pass | |
| language: | |
| - go | |
| - python | |
| - javascript-typescript | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Set up Go | |
| if: matrix.language == 'go' | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Set up Python | |
| if: matrix.language == 'python' | |
| uses: actions/setup-python@v7 | |
| with: | |
| python-version: '3.11' | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-and-quality | |
| config-file: ./.github/codeql/codeql-config.yml | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v4 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: /language:${{ matrix.language }} | |
| # Upload only when explicitly enabled — avoids PR failures on repos | |
| # where Code scanning / Advanced Security is not turned on yet. | |
| upload: ${{ vars.CODEQL_UPLOAD_SARIF == 'true' && 'always' || 'never' }} |