chore(deploy): Cloudflare Tunnel on-ramp for the Marketplace webhook #146

	name: codeql

	# Static analysis for the Go code (cmd/, internal/) via GitHub CodeQL.
	# build-mode: none analyzes the source directly, so this does not need the
	# C/libbpf validator toolchain. Results surface under Security > Code scanning.
	#
	# Security note: no untrusted ${{ github.event.* }} value is interpolated into
	# any run: shell here, so workflow-injection via PR titles/branches does not
	# apply to this file.

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: "27 4 * * 1"
	workflow_dispatch:

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	analyze:
	name: Analyze (Go)
	runs-on: ubuntu-latest
	timeout-minutes: 20
	permissions:
	contents: read
	security-events: write
	steps:
	- name: Checkout
	uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

	- name: Set up Go
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
	with:
	go-version: "1.25.11"
	cache: true

	- name: Initialize CodeQL
	uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
	with:
	languages: go
	# Go does not support build-mode: none; autobuild runs `go build`,
	# which needs no C/libbpf toolchain (the validator is a separate
	# non-Go component).
	build-mode: autobuild
	queries: security-and-quality

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
	with:
	category: "/language:go"

Provide feedback