base-studio-code/.github/workflows/codeql.yml at main · kevinthelago/base-studio-code · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
name: CodeQL

# Static analysis (SAST) of our own code — complements Dependabot (which only
# covers dependency CVEs). Findings land in the repo's Security → Code scanning tab.
# JS/TS is analyzed today; add the `rust` language to the matrix once CodeQL's Rust
# support is GA (until then Rust is covered by `cargo audit` + clippy).

on:
  # CodeQL on pull requests + the weekly schedule (not on every push).
  # Skip docs-only PRs: CodeQL analyzes JS/TS, so a markdown/docs change cannot
  # affect findings. `paths-ignore` skips the run only when EVERY changed file is
  # docs — any code change still triggers a full scan. CodeQL is not a required
  # check (the always-run "CI gate" in ci.yml is), so a skipped run won't wedge a PR.
  pull_request:
    branches: [main, develop]
    paths-ignore:
      - "**/*.md"
      - "docs/**"
      - "LICENSE"
  schedule:
    - cron: "0 7 * * 1" # Mondays 07:00 UTC — catch newly-published rules

permissions:
  contents: read
  security-events: write
  actions: read

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        language: [javascript-typescript]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Initialize CodeQL
        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4
        with:
          language: ${{ matrix.language }}
          queries: security-extended
          # Scan SHIPPED code only (#1011). `design/` is a browser-rendered reference
          # prototype (never bundled — see CLAUDE.md "Design Reference"), and test files are
          # mocks/fixtures, not attack surface. The remaining lower-priority regex alerts
          # (incomplete-hostname-regexp / missing-regexp-anchor) live only in those two places,
          # so excluding them clears the noise without hiding any shipped-code finding.
          config: |
            paths-ignore:
              - design
              - "**/*.test.ts"
              - "**/*.test.tsx"

      # JS/TS needs no compile; autobuild is effectively a no-op but kept for
      # forward-compat if a buildable language is added to the matrix.
      - name: Autobuild
        uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4

      - name: Analyze
        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4
        with:
          category: "/language:${{ matrix.language }}"