codeql.yml

name: codeql

# CodeQL (js/ts) static analysis + a `pnpm audit` advisory gate.
# Direct pushes to main are the normal flow here, so the analyze job runs on
# push as well as PR; the weekly schedule catches newly published advisories
# and query-pack updates against an unchanged tree.

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '30 5 * * 1'

concurrency:
  group: codeql-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  analyze:
    name: analyze
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      security-events: write
      actions: read
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript
          build-mode: none

      - name: Analyze
        uses: github/codeql-action/analyze@v4
        with:
          category: '/language:javascript-typescript'

  audit:
    name: audit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up pnpm
        uses: pnpm/action-setup@v6

      - name: Set up Node 22
        uses: actions/setup-node@v7
        with:
          node-version: 22

      # Advisory gate on production dependencies only. `pnpm audit` resolves
      # from the lockfile, so no install is needed; dev-only advisories are
      # tracked by Dependabot instead of failing the gate.
      - name: Audit production dependencies (high+)
        run: pnpm audit --prod --audit-level high