codeql.yml

name: CodeQL

# Static analysis for the TypeScript tree. This is GitHub's default setup
# expressed as a workflow file rather than enabled from the repository
# settings, so the query suite, the excluded paths and the schedule are
# reviewable in the diff like everything else here.
#
# Deliberately NOT on `push: main`. The weekly run already analyses the
# default branch, which is what keeps the Security tab current, and every
# change reaches `main` through a pull request that is analysed on the way
# in. Adding a push trigger would analyse the same tree a second time
# minutes later for no additional signal.
on:
  pull_request:
    branches: [main]
  schedule:
    # Mondays, 04:27 UTC. Off the hour so the run does not queue behind
    # everyone else's midnight cron.
    - cron: "27 4 * * 1"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyse javascript-typescript
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      # Required to write the results into the repository's code-scanning
      # alerts. Free for public repositories.
      security-events: write
      # Required by the CodeQL action to read workflow run metadata.
      actions: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # `build-mode: none` is the correct mode for JavaScript/TypeScript —
      # CodeQL extracts from source and needs neither a compile step nor
      # installed dependencies.
      #
      # The excluded paths are all generated or vendored output. Chief
      # among them is `src/generated`, the ~9 MB Prisma client with a
      # 224 KB inline schema literal in it: extracting that costs real
      # minutes and can produce nothing actionable, because nobody edits
      # it and the fix for anything found there is `pnpm prisma generate`.
      - name: Initialise CodeQL
        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          languages: javascript-typescript
          build-mode: none
          config: |
            paths-ignore:
              - src/generated
              - .next
              - dist
              - coverage
              - playwright-report
              - test-results
              - public

      - name: Analyse
        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          category: "/language:javascript-typescript"