ghl-toolset/.github/workflows/codeql.yml at main · legioncodeinc/ghl-toolset · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
name: CodeQL

# Advanced-setup CodeQL scan, portable as a committed workflow file.
# GitHub's own recommendation is native "default setup" (Settings > Advanced
# Security > CodeQL analysis > Set up > Default), which needs no workflow file
# at all. Use this workflow when the project wants scanning defined as code,
# or when default setup isn't available for the plan/visibility in use.
# Grounded in: raw/get-started--codeql--configuring-default-setup-official-docs.md

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly scan of the default branch, catches newly disclosed query rules
    # against unchanged code. Adjust the cron to your own quiet hours.
    - cron: "0 6 * * 1"

permissions:
  contents: read

jobs:
  analyze:
    # Code scanning uploads require Code Security (GHAS) enabled on private
    # repositories — this repo has it off, and turning it on is a paid org
    # decision. This job therefore skips (neutral on PRs) until a repository
    # variable CODEQL_ENABLED=true is set:
    #   Settings > Secrets and variables > Actions > Variables > CODEQL_ENABLED=true
    if: vars.CODEQL_ENABLED == 'true'
    # Static name: a skipped job renders a matrix-templated name literally.
    name: Analyze (CodeQL)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read

    strategy:
      fail-fast: false
      matrix:
        # List every CodeQL-supported language actually present in the repo.
        language: [javascript-typescript]

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Initialize CodeQL
        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          languages: ${{ matrix.language }}
          # default is precision-tuned; security-extended adds queries at
          # some precision cost. See the distilled research for the tradeoff.
          queries: security-extended

      # No build step: this repo ships plain ES modules loaded directly by
      # Chrome, so autobuild has nothing to do and JS/TS needs no config.
      - name: Autobuild
        uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          category: "/language:${{ matrix.language }}"