* Run CodeQL when the CodeQL workflow is changed
This is useful for double checking changes to the workflow don't
introduce regressions the we wouldn't notice until the next cron.
* Refactor to use paths: instead of dorny/changed-files
* Remove CodeQL Scanning for release branches
In RFD 114 (PR #32233) we setup mirroring for the Teleport release branches to the `teleport-sec-scan` repos. There are several advantages to moving the CodeQL scanning to these repos:
* It removes the manual process described in `preflight` to update the codeql scanning branch
* It solves the issue of alerts being repeatedly opened and closed as they are found on release branches and only fixed in master, for example: https://github.com/gravitational/teleport/security/code-scanning/560
As such CodeQL has already been configured on these repos and the initial findings triaged: https://github.com/gravitational/teleport-sec-scan-1/blob/master/.github/workflows/codeql-mirror.yml
* codeql: Comment relaese branch scanning
* Build change for when go caching should be used
This commit does the following:
* Updates all `setup-go` actions to use v4 (which has caching enabled by default)
* For `shared-workflow` jobs caching is left enabled due to the presumed small size
* For `teleport` jobs caching is now disabled due to the size exceeding the cache limit
This should make all of the mentioned jobs a little faster.
* Update build-api.yaml to re-enable caching
* Update CodeQL Schedule to scan release branches
This allows us to switch our release branches to also use the scheduled CodeQL check so we can remove CodeQL from the PR flow for our release branches too.
* Use go dependency caching with auto build
This change speeds up the build by about ~2 minutes (10%)
This makes two changes:
* Reduces action instance type to 16 cores. This will half the cost without a significant speed difference
* Switch from `make full` to CodeQL Auto Build. This speeds up the build by about 10 minutes. I confirmed there is not a reduction in the scan coverage
We still plan to address this root issue, and are tracking making CodeQl faster so it can be a required PR check: https://github.com/gravitational/SecOps/issues/269
However, until then we need to switch this job to be a scheduled task rather than on every PR and push. This is partly cost motivated, but also we are already hitting our timeouts. This PR also increases the analysis timeout so that the daily job can be sure to complete.
