chore(deps-dev): bump rollup from 4.54.0 to 4.59.0 (#29) #70
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CodeQL workflow: performs static security analysis using GitHub's CodeQL | |
| # engine. It runs on pushes and pull requests to `main`, and weekly on Sunday | |
| # at 03:00 UTC by the scheduled cron job below. The workflow checks JavaScript | |
| # and TypeScript code and will create security findings in the repository's | |
| # Security tab when issues are detected. | |
| # Note: CodeQL runs in a dedicated workflow to isolate heavy analysis, | |
| # maintain separate scheduling/permissions, and reduce impact on regular CI. | |
| name: CodeQL | |
| on: | |
| # Keep a manual dispatch so maintainers can run CodeQL on demand. | |
| workflow_dispatch: | |
| inputs: | |
| run_codeql: | |
| description: 'Set to true to run CodeQL on this dispatch' | |
| required: false | |
| default: 'true' | |
| # Note: push / PR / scheduled runs are retained as triggers but the job | |
| # is gated so CodeQL is opt-out by default. To enable automatic runs set | |
| # the repository variable/secret `ENABLE_CODEQL=true` (or dispatch manually). | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| # schedule is intentionally left commented out to avoid automatic runs | |
| # unless the controlling variable is enabled | |
| # schedule: | |
| # - cron: '0 3 * * 0' | |
| # Permissions required for CodeQL to read code and upload results. | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| jobs: | |
| codeql-analyze: | |
| # Analyze (CodeQL): initializes the CodeQL DB, attempts an autobuild to | |
| # discover compilation steps, then runs the analysis to produce results. | |
| name: Analyze (CodeQL) | |
| # Gate the job so CodeQL is opt-out by default. The job runs if: | |
| # - the workflow was manually dispatched; OR | |
| # - a repo-level variable named ENABLE_CODEQL is set to 'true'. | |
| if: ${{ github.event_name == 'workflow_dispatch' || vars.ENABLE_CODEQL == 'true' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| # Debug info - can be removed if not required | |
| - name: Debug Info | |
| uses: ./.github/actions/debug-info | |
| with: | |
| show-env: 'false' | |
| - name: Initialize CodeQL | |
| # Initializes the CodeQL action and configures the languages to analyze. | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| # Languages covered by this project. Add languages here if needed. | |
| languages: javascript,typescript | |
| - name: Autobuild | |
| # Attempts to automatically build the project so CodeQL can analyze | |
| # compiled artifacts and dependency graphs. If your project requires a | |
| # custom build step (monorepos, special toolchains), replace or | |
| # augment this step with explicit build commands (for example | |
| # `npm ci && npm run build`). | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Run CodeQL analysis | |
| # Runs the analysis and uploads sarif results to GitHub. The `category` | |
| # here is informational and groups the analysis in the UI. | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: 'javascript' |