git-embedded/.github/workflows/codeql.yml at master · CLDMV/git-embedded · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
#
# @Project: @cldmv/git-embedded
# @Filename: /.github/workflows/codeql.yml
# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
# @Author: Nate Corcoran <CLDMV>
# @Email: <Shinrai@users.noreply.github.com>
# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
#

# Individual repo: .github/workflows/codeql.yml
#
# REQUIRED REPO SETTING — CodeQL must be in "Advanced" mode for this workflow
# to upload SARIF. If the repo has CodeQL "Default setup" enabled (the
# GitHub-managed alternative), upload runs fail with:
#
#   "Code Scanning could not process the submitted SARIF file: CodeQL
#    analyses from advanced configurations cannot be processed when the
#    default setup is enabled"
#
# The org-bootstrap-repo action automatically disables default setup
# (overwrite-with-warn) on every fanout run, so a freshly-bootstrapped
# repo lands in the right state by default. If you want to KEEP default
# setup (the GitHub-managed config) instead of this workflow, DELETE
# this codeql.yml file — with the conflict gone, the bootstrap leaves
# default setup alone on subsequent runs.
#
# Manual fix when running outside the bootstrap:
#   Settings → Code security and analysis → Code scanning → CodeQL
#   analysis → ⚙️ → Switch to advanced.
name: 🔍 CodeQL

on:
    push:
        branches: [master, main]
    # Same fork-PR consideration as ci.yml: pull_request fires for forks; SARIF
    # upload to base-repo Security tab fails with read-only token. Acceptable —
    # push-to-master analysis after merge catches anything missed. DO NOT use
    # pull_request_target (runs base-repo workflow with secrets against fork
    # code; dangerous).
    pull_request:
        types: [opened, synchronize, reopened, ready_for_review]
        # Include the v4 integration branches (`next`, `hotfixes`) so feature
        # and hotfix PRs trigger CodeQL. Without these, branch protection
        # rulesets that require the CodeQL check on `next`/`hotfixes` will
        # sit on "waiting for results" indefinitely. Branches that don't
        # exist in a given repo simply never trigger the workflow — harmless
        # for repos that haven't adopted the v4 staging-branch flow.
        branches: [master, main, next, hotfixes]
    schedule:
        - cron: "37 14 * * 1" # weekly Monday 14:37 UTC; GitHub updates queries over time

permissions:
    security-events: write
    contents: read
    actions: read

concurrency:
    group: codeql-${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.ref != 'refs/heads/main' }}

jobs:
    analyze:
        uses: CLDMV/.github/.github/workflows/reusable-codeql.yml@v4
        with:
            languages: "javascript-typescript"
            # Override defaults if needed:
            # queries: "security-extended,security-and-quality"
            # paths_ignore: "node_modules/,dist/,coverage/,**/test/**"
            # config_file: ".github/codeql-config.yml"
            # build_mode: "autobuild"