CodeQL #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # OWNER ACTION REQUIRED before enabling auto-triggers: advanced CodeQL conflicts with | |
| # GitHub "default setup" — the analyze step fails with "CodeQL analyses from advanced | |
| # configurations cannot be processed when the default setup is enabled". Switch repo | |
| # Settings → Code security → CodeQL from Default to Advanced, THEN restore the | |
| # push/pull_request/schedule triggers below. Until then this only runs on manual dispatch | |
| # so it never produces a red check on PRs. (The codeqlAlerts ratchet keeps working via the | |
| # default setup's alerts in the meantime.) | |
| on: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze (javascript-typescript) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| actions: read | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 | |
| with: | |
| languages: javascript-typescript | |
| queries: security-extended | |
| - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 | |
| with: | |
| category: "/language:javascript-typescript" |