security.yml

name: Security

# CodeQL over the application code and over the workflows themselves. The second matters here:
# a workflow that interpolates untrusted text into a shell line is a supply-chain problem that
# no amount of application testing would find.

on:
  pull_request:
  push:
    branches: [master]
  schedule:
    # Weekly, so a newly published query finds an old file. Monday morning UTC.
    - cron: '17 6 * * 1'

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  codeql:
    name: CodeQL (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 20

    permissions:
      # Only this job writes, and only to the code-scanning API.
      security-events: write
      contents: read
      actions: read

    strategy:
      fail-fast: false
      matrix:
        language: [javascript-typescript, actions]

    steps:
      - uses: actions/checkout@v7

      - uses: github/codeql-action/init@v4
        with:
          language: ${{ matrix.language }}
          # The default suite, not security-extended. Extended roughly doubles the run and, on a
          # codebase this size, mostly produces findings that are triaged away — which trains
          # everyone to skim the alerts. The decision is recorded in SECURITY.md so it can be
          # revisited rather than rediscovered.
          queries: security-and-quality

      # The site builds with Turbopack and the Worker with tsc; CodeQL's own extractor reads the
      # sources directly and needs neither, so there is no build step to keep in sync here.
      - uses: github/codeql-action/analyze@v4
        with:
          category: /language:${{ matrix.language }}