codeql.yml

# ================================================================================
# 
# Workflow: CodeQL Analysis
# 
# This GitHub Actions workflow performs static code analysis using GitHub CodeQL
# to detect potential security vulnerabilities and quality issues in the CmpStr
# project.
# 
# CodeQL is a security analysis engine that examines your codebase for known
# patterns of vulnerabilities such as injection flaws, logic errors, or unsafe
# dependencies.
# 
# This will run on every push to the `master` branch, analyzing the codebase
# for JavaScript and TypeScript files. The workflow includes steps to:
# 
#    - Checkout the repository
#    - Set up Node.js environment
#    - Initialize CodeQL with the specified languages
#    - Install project dependencies
#    - Build the project
#    - Perform the CodeQL analysis
# 
# ================================================================================

name: Analyze

on:
  push:
    branches: [ master ]

jobs:
  analyze:
    name: Analyze with CodeQL
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        language: [ 'javascript-typescript' ]

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7

      - name: Use Node.js 24.x
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: 'npm'

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}

      - name: Install Dependencies
        run: npm ci

      - name: Build Project
        run: npm run build

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"