Merge pull request #2796 from tonistiigi/fs-entitlements #1762

	name: codeql

	# Default to 'contents: read', which grants actions to read commits.
	#
	# If any permission is set, any permission not included in the list is
	# implicitly set to "none".
	#
	# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
	permissions:
	contents: read

	on:
	push:
	branches:
	- 'master'
	- 'v[0-9]*'
	pull_request:

	env:
	GO_VERSION: "1.23"

	jobs:
	codeql:
	runs-on: ubuntu-24.04
	permissions:
	contents: read
	actions: read
	security-events: write
	steps:
	-
	name: Checkout
	uses: actions/checkout@v4
	-
	name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version: ${{ env.GO_VERSION }}
	-
	name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: go
	-
	name: Autobuild
	uses: github/codeql-action/autobuild@v3
	-
	name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v3
	with:
	category: "/language:go"

Provide feedback