Merge pull request #30 from adab-tech/security/persistent-rate-limits… #48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CodeQL" | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| schedule: | |
| # Weekly scan catches new CodeQL query coverage even on weeks with no | |
| # code changes — Monday 04:23 UTC (off-peak, arbitrary minute to avoid | |
| # the exact-hour stampede other repos schedule against). | |
| - cron: "23 4 * * 1" | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # backend/ is Python; frontend/ is vanilla JS (no build step, no | |
| # TypeScript) — CodeQL's javascript analyzer covers both JS and | |
| # the frontend's plain HTML/CSS-adjacent script tags. | |
| language: ["python", "javascript"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" |