codeql.yml

name: CodeQL

# Static analysis (SAST) for TrustScope's own TypeScript/JavaScript source.
# Public-repo supply-chain hardening — #270 estate standard, §3 control 1.
#
# Language: javascript-typescript ONLY. The repo is pure JS/TS (Next.js 16);
# the sole non-TS script (scripts/fetch-scorecard.mjs) is a Node build-time
# tooling module, already covered by the js/ts analysis — no other CodeQL
# language applies.
#
# `languages:` is PLURAL on codeql-action/init — the singular `language:` is
# silently ignored and analyzes nothing (#270 §1.3, pilot-caught).
#
# build-mode: none — js/ts is interpreted, no compilation step to trace.

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly Monday 03:17 UTC — off the top-of-hour free-tier congestion.
    - cron: "17 3 * * 1"

# Least-privilege default; the analyze job re-declares what it needs.
permissions:
  contents: read

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 20

    # Job-scoped write — the SARIF upload needs security-events:write; nothing
    # else does. Job-level permissions REPLACE the workflow default, so
    # contents:read is restated here (#270 §1.3).
    permissions:
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [javascript-typescript]

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Initialize CodeQL
        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          languages: ${{ matrix.language }}
          build-mode: none

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          category: "/language:${{ matrix.language }}"