fix(core): stop normalising issuer and resource identifiers #24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Static analysis (SAST) for the Go modules in this repo. Results are | |
| # uploaded to the GitHub Security tab. | |
| # | |
| # Gated to public repositories only: CodeQL scanning requires GitHub | |
| # Advanced Security, which is free on public repos but not enabled on the | |
| # private fork — running it there would fail every PR. The `if:` guard | |
| # keys off the repo's actual visibility, so this works for any public | |
| # clone and stays a no-op on private ones. Checking visibility == 'public' | |
| # (rather than != 'private') also fails safe: if the field is ever absent | |
| # the job is skipped rather than run. | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| schedule: | |
| # Wednesdays 06:00 UTC. | |
| - cron: "0 6 * * 3" | |
| workflow_dispatch: | |
| # Least-privilege default; the job below grants only the writes CodeQL needs. | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze (Go) | |
| # Public repos only — see the header comment. Skips cleanly on the fork. | |
| if: github.event.repository.visibility == 'public' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Required for CodeQL to upload results to the Security tab. | |
| security-events: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: "1.25.x" | |
| check-latest: true | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 | |
| with: | |
| languages: go | |
| # This repo is a Go workspace of four independent modules; the | |
| # default autobuild can't span them, so we build each module | |
| # manually below. | |
| build-mode: manual | |
| queries: security-extended | |
| - name: Build modules | |
| # Compile every module so the extractor sees all packages. go.work | |
| # ties the modules together for local dev; here we build each one | |
| # in its own directory to keep the extractor's view complete. | |
| run: | | |
| for module in core http mcp mark3labs; do | |
| echo "::group::build $module" | |
| (cd "$module" && go build ./...) | |
| echo "::endgroup::" | |
| done | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 | |
| with: | |
| category: "/language:go" |