This page documents the automated security and quality assurance workflows implemented in the go-dota2 repository. These workflows leverage GitHub Actions to perform static analysis, monitor dependency health, and enforce supply-chain security standards through SHA-pinned actions and automated review processes.
The repository maintains security-oriented workflow files to ensure that code contributions meet quality standards and do not introduce known vulnerabilities. These tools provide a defense-in-depth approach to maintaining a library that interacts with Steam's Game Coordinator.
| Workflow / Tool | Purpose | Trigger |
|---|---|---|
codeql-analysis.yml | Static Analysis Security Testing (SAST) for Go source code. | Push/PR to master, Weekly Schedule |
dependency-review.yml | Scans PR diffs for known-vulnerable package versions. | Every Pull Request |
release.yml | Automates the creation of GitHub Releases based on tags. | Tag Push (*) |
Workflow file: .github/workflows/codeql-analysis.yml1-65
CodeQL is used to discover security vulnerabilities and coding errors by treating code as data that can be queried. It builds a database of the project's structure to identify complex data-flow issues.
The workflow is configured to run on pushes and pull requests targeting the master branch .github/workflows/codeql-analysis.yml3-8 Additionally, a scheduled run occurs every Saturday at 13:41 UTC .github/workflows/codeql-analysis.yml9-10 to catch new vulnerability patterns identified by the GitHub security community.
The workflow operates under strict permission scopes:
contents: read .github/workflows/codeql-analysis.yml12-13analyze): Adds actions: read and security-events: write .github/workflows/codeql-analysis.yml19-22 The security-events: write permission is required to upload the resulting SARIF (Static Analysis Results Interchange Format) files to the GitHub Security tab.The analysis is restricted to the Go language .github/workflows/codeql-analysis.yml24-27 The pipeline utilizes autobuild .github/workflows/codeql-analysis.yml50-52 which attempts to compile the Go project automatically to provide the CodeQL engine with a complete semantic model of the codebase.
Diagram: CodeQL Analysis Flow
Sources: .github/workflows/codeql-analysis.yml31-64
The project employs a multi-layered approach to supply-chain security, combining proactive updates with reactive vulnerability scanning.
Workflow file: .github/workflows/dependency-review.yml1-21
This workflow specifically targets Pull Requests .github/workflows/dependency-review.yml8 It analyzes changes to manifest files (e.g., go.mod and go.sum) to detect if a contributor is introducing a dependency with a known vulnerability (CVE) .github/workflows/dependency-review.yml3-6 It uses the actions/dependency-review-action .github/workflows/dependency-review.yml19-20
Diagram: PR Dependency Gating
Sources: .github/workflows/dependency-review.yml7-21
Workflow file: .github/workflows/release.yml1-27
The release workflow automates the creation of GitHub Releases when a new tag is pushed .github/workflows/release.yml3-6 It ensures that the release notes correctly reflect the corresponding Dota 2 version by stripping revision suffixes (e.g., -r1) from the tag name .github/workflows/release.yml21-26
contents: write to create the release entity .github/workflows/release.yml8-9sed to transform the tag into a display version by removing the revision suffix .github/workflows/release.yml23A critical security feature of the go-dota2 CI/CD pipeline is the use of immutable commit SHAs for GitHub Actions instead of mutable tags. This prevents "tag-shifting" attacks where a compromised action version is pushed to an existing tag (e.g., v4).
| Action | Pinned SHA | Version Reference |
|---|---|---|
actions/checkout | de0fac2e4500dabe0009e67214ff5f5447ce83dd | v6.0.2 |
github/codeql-action/init | 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 | v4.35.2 |
github/codeql-action/autobuild | 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 | v4.35.2 |
github/codeql-action/analyze | 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 | v4.35.2 |
actions/dependency-review-action | 2031cfc080254a8a887f58cffee85186f0e49e48 | v4.9.0 |
Sources: .github/workflows/codeql-analysis.yml33-64 .github/workflows/dependency-review.yml18-20
| Feature | CodeQL | Dependency Review |
|---|---|---|
| Analysis Type | Static Analysis (SAST) | Supply Chain (SCA) |
| Primary Target | Internal Logic / Bugs | External Dependencies |
| Data Source | Local Source Code | GitHub Advisory DB |
| Action SHA | 95e58e9a... | 2031cfc0... |
Diagram: Security Verification Mapping
Sources: .github/workflows/codeql-analysis.yml1-65 .github/workflows/dependency-review.yml1-21