ci: update workflows

.github/workflows/codeql.yml

@@ -3,21 +3,30 @@ name: Code Scanning
 
 on:
   push:
+    branches: [ "main" ]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
   schedule:
-    - cron: "17 0 * * 0"
+    - cron: '32 13 * * 4'
 
 jobs:
   CodeQL-Build:
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v2
         with:
           languages: go
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@v2

.github/workflows/go.yml

@@ -2,15 +2,11 @@ name: Tests
 
 on:
   push:
-    paths:
-      - "**.go"
-      - go.mod
-      - go.sum
+    branches: [ "main" ]
   pull_request:
-    paths:
-      - "**.go"
-      - go.mod
-      - go.sum
+    types: [opened, synchronize, reopened, ready_for_review]
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
 
 jobs:
   test:
@@ -22,16 +18,13 @@ jobs:
     name: Test
     steps:
 
-    - name: Set up Go ${{ matrix.node }}
-      uses: actions/setup-go@v2
+    - name: Set up Go ${{ matrix.go }}
+      uses: actions/setup-go@v4
       with:
         go-version: ${{ matrix.go }}
 
     - name: Check out code
-      uses: actions/checkout@v2
-
-    - name: Download dependencies
-      run: go mod download
+      uses: actions/checkout@v4
 
     - name: Test
       # TODO(henvic): Skip generating code coverage when not sending it to Coveralls to speed up testing.

.github/workflows/lint.yml

@@ -2,15 +2,11 @@ name: Lint
 
 on:
   push:
-    paths:
-      - "**.go"
-      - go.mod
-      - go.sum
+    branches: [ "main" ]
   pull_request:
-    paths:
-      - "**.go"
-      - go.mod
-      - go.sum
+    types: [opened, synchronize, reopened, ready_for_review]
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
 
 jobs:
 
@@ -20,18 +16,18 @@ jobs:
     steps:
 
     - name: Set up Go 1.x
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@v4
       with:
         go-version: "1.21.x"
 
     - name: Check out code
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
 
     - name: Verify dependencies
       run: |
         go mod verify
         go mod download
-    
+
     - name: Installing static code analysis tools
       run: ./scripts/ci-lint-install.sh