# CodeQL configuration
# https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning

name: "Go Security Analysis"

disable-default-queries: false

queries:
  - uses: security-extended
  - uses: security-and-quality

# Paths to include
paths:
  - "cmd/**/*.go"
  - "pkg/**/*.go"
  - "*.go"

# Paths to exclude from analysis
paths-ignore:
  - "**/*.pb.go"       # Generated protobuf files
  - "**/*_gen.go"      # Generated code
  - "**/vendor/**"     # Vendor dependencies
  - "**/build/**"      # Build artifacts
  - "**/scripts/**"    # Build scripts
  - "**/*_test.go"     # Test files

query-filters:
  - exclude:
      id: go/hardcoded-credentials