From 17469c8240142180a07eb78280f355a2ed50064e Mon Sep 17 00:00:00 2001 From: bgard68 <30295154+bgard68@users.noreply.github.com> Date: Thu, 20 Aug 2026 07:11:21 -0500 Subject: [PATCH] ci: scan the TypeScript frontend with CodeQL too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeQL analysed csharp only, so roughly half the attack surface went unscanned. The SPA stores and refreshes tokens, renders API-supplied text, and builds request bodies — the places CodeQL's javascript-typescript pack is actually good at. build-mode: none, so it uses CodeQL's own extractor and needs no npm install. Co-Authored-By: Claude Opus 5 --- .github/workflows/codeql.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e6255fd..f07cf0d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -44,6 +44,11 @@ jobs: include: - language: csharp build-mode: none + # The SPA handles tokens, renders API-supplied text, and builds request bodies, so it + # is as much of a target as the API. build-mode: none uses CodeQL's own extractor and + # needs no npm install. + - language: javascript-typescript + build-mode: none steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1