codeql.yml

name: CodeQL

# G16: static application security testing (SAST). CodeQL scans the TypeScript
# sources for injection, path-traversal, and similar code-level vulnerabilities
# on every push/PR to main. Findings surface as code-scanning alerts; they do
# not fail the build.
#
# NOTE: code scanning needs a public repo (or GitHub Advanced Security on a
# private one). The analyze job is therefore guarded to run only when the repo
# is public — it is skipped (green) while the repo stays private, and activates
# automatically once the owner flips it public. Re-add a `schedule:` trigger
# then if periodic re-scans are wanted.
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# gap-analysis #24: cancel a superseded scan when commits land in quick
# succession (own group so it never contends with the CI workflow).
concurrency:
  group: codeql-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Least-privilege default; the analyze job widens to what CodeQL needs.
permissions:
  contents: read

jobs:
  analyze:
    name: Analyze (javascript-typescript)
    runs-on: ubuntu-latest
    if: ${{ github.event.repository.private == false }}
    permissions:
      security-events: write
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Initialize CodeQL
        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
        with:
          languages: javascript-typescript

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
        with:
          category: "/language:javascript-typescript"