From 728388e236c76aca2e42b7c4fadc3dc88ff05eb8 Mon Sep 17 00:00:00 2001
From: Tiankai Ma <tiankaima.dev@gmail.com>
Date: Sat, 8 Aug 2026 19:05:04 +0800
Subject: [PATCH] ci: race tests, CodeQL, Dependabot, and PR OpenAPI warnings

Run go test with -race locally/CI parity, analyze with CodeQL, and warn when the matching server OpenAPI branch is missing.
---
 .github/dependabot.yml       | 11 ++++++++++
 .github/workflows/ci.yml     |  3 ++-
 .github/workflows/codeql.yml | 41 ++++++++++++++++++++++++++++++++++++
 Makefile                     |  2 +-
 4 files changed, 55 insertions(+), 2 deletions(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..d163711
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ae21754..dca58bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,7 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    branches: ["**"]
 
 permissions:
   contents: read
@@ -22,6 +22,7 @@ jobs:
           if git ls-remote --exit-code --heads https://github.com/Life-USTC/server.git "$candidate" >/dev/null 2>&1; then
             echo "ref=$candidate" >> "$GITHUB_OUTPUT"
           else
+            echo "::warning::Server OpenAPI branch '$candidate' not found; falling back to main"
             echo "ref=main" >> "$GITHUB_OUTPUT"
           fi
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..2c5ad12
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,41 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ["**"]
+  schedule:
+    - cron: "17 5 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (go)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: go
+            build-mode: autobuild
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          category: "/language:${{ matrix.language }}"
diff --git a/Makefile b/Makefile
index 7738c00..ecddc8c 100644
--- a/Makefile
+++ b/Makefile
@@ -12,7 +12,7 @@ clean:
 	rm -rf dist/
 
 test:
-	go test ./...
+	go test -race ./...
 
 lint:
 	golangci-lint run ./...