codeql.yml

name: "CodeQL Advanced Security Analysis"

on:
  push:
    branches: [ "main", "dev" ]
  pull_request:
    branches: [ "main", "dev" ]
  schedule:
    - cron: '0 2 * * *'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze TypeScript/Next.js
    runs-on: ubuntu-latest
    timeout-minutes: 360
    
    # Required permissions for CodeQL
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: javascript-typescript
        build-mode: none
        # Standard robust query suites catch XSS, SQLi, Logic flaws, etc.
        queries: security-extended,security-and-quality

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4
      with:
        category: "/language:javascript-typescript"

  dependency-review:
    name: Dependency Security Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    
    permissions:
      contents: read
      # Required for dependency-review-action to comment on PRs
      pull-requests: write
    
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Dependency Review
      uses: actions/dependency-review-action@v4
      with:
        fail-on-severity: high
        comment-summary-in-pr: always
        vulnerability-check: true

  security-summary:
    name: Security Analysis Summary
    needs: [analyze]
    runs-on: ubuntu-latest
    if: always()
    
    steps:
    - name: Generate Summary
      run: |
        echo "# Security Analysis Complete 🛡️" >> $GITHUB_STEP_SUMMARY
        echo "The advanced CodeQL analysis and Dependency Review have finished." >> $GITHUB_STEP_SUMMARY
        echo "All findings have been uploaded directly to the GitHub Security tab." >> $GITHUB_STEP_SUMMARY
        echo "View detailed results at: https://github.com/${{ github.repository }}/security/code-scanning" >> $GITHUB_STEP_SUMMARY