codeql.yml

name: CodeQL

# CodeQL is not deprecated. Uploading results to GitHub's Security tab requires
# code scanning, which is only available for public repos (or private repos
# with GitHub Code Security on Team/Enterprise). This repo is private on Free,
# so we analyze locally and upload SARIF as a workflow artifact instead.
# To use the Security tab: make the repo public, then set upload: true below.

on:
  push:
    branches: [main, master]
  pull_request:
  schedule:
    - cron: '0 6 * * 1'

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: npm

      - run: npm ci

      - uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript

      - run: npm run build

      - uses: github/codeql-action/analyze@v4
        with:
          upload: false
          output: codeql-results

      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: codeql-sarif
          path: codeql-results/*.sarif
          retention-days: 14
          if-no-files-found: ignore