From 3e79951c52c4f98f2da5b4e69c213019d560f4e2 Mon Sep 17 00:00:00 2001
From: "Enot (ded) Skelly" <enot@mailbox.org>
Date: Mon, 8 Jun 2026 16:27:55 -0700
Subject: [PATCH 1/5] chore: add go vuln check

---
 .github/workflows/ci.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8a0f079..d7d985f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,6 +35,12 @@ jobs:
       - name: Test
         run: go test ./...
 
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Vulnerability check
+        run: govulncheck ./...
+
       - name: Install swag
         run: go install github.com/swaggo/swag/cmd/swag@latest
 

From 29665e1a024c6e69db8c046829383da57532ec32 Mon Sep 17 00:00:00 2001
From: "Enot (ded) Skelly" <enot@mailbox.org>
Date: Mon, 8 Jun 2026 16:28:05 -0700
Subject: [PATCH 2/5] chore: add codeql

---
 .github/workflows/codeql.yml | 38 ++++++++++++++++++++++++++++++++++++
 README.md                    |  1 +
 2 files changed, 39 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..c3d68e8
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,38 @@
+# Copyright 2026 Beacon Contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: CodeQL
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+  schedule:
+    - cron: '0 8 * * 1'  # every Monday at 08:00 UTC
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: go
+
+      - name: Build
+        run: go build ./...
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
diff --git a/README.md b/README.md
index c09d469..2d17f2e 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,7 @@ MeshCore Beacon is a MeshCore network observation backend. It connects to one or
 more MeshCore MQTT brokers, ingests LoRa packet traffic in real time, stores it
 in PostgreSQL, and streams live events to WebSocket clients.
 
+[![CodeQL](https://github.com/MeshCore-Beacon/beacon-server/actions/workflows/codeql.yml/badge.svg)](https://github.com/MeshCore-Beacon/beacon-server/actions/workflows/codeql.yml)
 [![CI](https://github.com/MeshCore-Beacon/beacon-server/actions/workflows/ci.yml/badge.svg)](https://github.com/MeshCore-Beacon/beacon-server/actions/workflows/ci.yml)
 [![Docker](https://github.com/MeshCore-Beacon/beacon-server/actions/workflows/docker-publish.yml/badge.svg)](https://github.com/MeshCore-Beacon/beacon-server/actions/workflows/docker-publish.yml)
 

From da90cc0a9da1cd486afeba36226e08c663e4132d Mon Sep 17 00:00:00 2001
From: "Enot (ded) Skelly" <enot@mailbox.org>
Date: Mon, 8 Jun 2026 16:39:43 -0700
Subject: [PATCH 3/5] chore: update to go 1.26.4

---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 5659a03..5fbfc0c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/MeshCore-Beacon/beacon-server
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/coder/websocket v1.8.14

From 4bf7ac2de2e9cd21bbea8acacb24d493e839e2b7 Mon Sep 17 00:00:00 2001
From: "Enot (ded) Skelly" <enot@mailbox.org>
Date: Mon, 8 Jun 2026 16:47:24 -0700
Subject: [PATCH 4/5] fix: broken swagger check

---
 .github/workflows/ci.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d7d985f..cdb2a3b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,10 +46,12 @@ jobs:
 
       - name: Swagger docs up to date
         run: |
+          cp docs/swagger.json docs/swagger.json.bak
           swag init -g cmd/beacon/main.go -o docs --parseInternal --parseDependency
-          if [ -n "$(git diff --name-only docs/)" ]; then
+          if ! diff -q docs/swagger.json docs/swagger.json.bak > /dev/null; then
             echo "Swagger docs are out of date. Run swag init and commit the result."
-            git diff --name-only docs/
+            rm docs/swagger.json.bak
             exit 1
           fi
+          rm docs/swagger.json.bak
 

From db975fe201b6589643917be8643e97132f002077 Mon Sep 17 00:00:00 2001
From: "Enot (ded) Skelly" <enot@mailbox.org>
Date: Mon, 8 Jun 2026 16:48:56 -0700
Subject: [PATCH 5/5] fix: temp disable codeql

not available on free private repos
---
 .github/workflows/codeql.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c3d68e8..a45259d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -11,6 +11,7 @@ on:
 
 jobs:
   analyze:
+    if: false # remove after public release and enabled on repo
     name: Analyze
     runs-on: ubuntu-latest
     permissions: