codeql.yml

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: 'CodeQL Advanced'

on:
  push:
    branches: ['main']
  pull_request:
    branches: ['main']
  schedule:
    # Once a week
    - cron: '41 12 * * 4'

permissions:
  # required for all workflows
  security-events: write
  # required to fetch internal or private CodeQL packs
  packages: read
  # only required for workflows in private repositories
  actions: read
  contents: read

jobs:
  analyze:
    name: Analyze (javascript-typescript)
    runs-on: 'ubuntu-latest'

    strategy:
      fail-fast: false

    steps:
      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            *.github.com:443
            objects.githubusercontent.com:443
            release-assets.githubusercontent.com:443

      - name: Git Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          languages: javascript-typescript
          build-mode: none

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          category: '/language:javascript-typescript'