feat: Vercel Marketplace images — 5 gallery + 3 icon sizes #915
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CodeQL — GitHub's static analysis (SAST) for JavaScript/TypeScript. | |
| # Surfaces code-level security issues (taint flows, injection, crypto misuse, | |
| # unsafe data handling) as "Code scanning alerts" under the Security tab and as | |
| # PR annotations. Complements Dependabot (which handles dependency-level vulns). | |
| name: CodeQL | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Weekly scan on Monday — catches new queries / regressions between releases. | |
| - cron: "23 6 * * 1" | |
| permissions: | |
| contents: read | |
| # Required to upload CodeQL results to the Security tab. | |
| security-events: write | |
| # Required to upload SARIF results (actions/upload-sarif). | |
| actions: read | |
| jobs: | |
| analyze: | |
| name: Analyze (js/ts) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: github/codeql-action/init@fddeee1a7ece751b577e409a89057319e3172939 # v4 | |
| with: | |
| languages: javascript-typescript | |
| # Build mode "none" — CodeQL analyzes JS/TS source directly without | |
| # needing a production build, which keeps this job independent of | |
| # Next.js build env vars and faster than autobuild. | |
| build-mode: none | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@fddeee1a7ece751b577e409a89057319e3172939 # v4 | |
| with: | |
| category: "/language:javascript-typescript" |