codeql.yml

name: CodeQL

# Static security analysis (SAST) for the React/TypeScript frontend. Complements
# the existing `npm audit` job in ci.yml (which only catches known-CVE deps) by
# scanning the app's own JS/TS source. Free on this PUBLIC repo.
#
# JS/TS needs no build for extraction (build-mode: none is the CodeQL default for
# this language), so there is no npm install / vite build step here.

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    # Docs/data-only fast-path §2 (verbara-meta/ADR-0016): CodeQL is NON-required and
    # has NO merge_group trigger, so a workflow-level paths-ignore is SAFE here (no
    # required context to strand). Skip the SAST scan on doc/spec-only PRs — the
    # allowlist inverse of §3.4. (This §2 lever is ONLY for non-required, non-queued
    # workflows; ci.yml uses the §1 gate job instead.)
    paths-ignore:
      - 'docs/**'
      - '**/*.md'
      - 'CHANGELOG.md'
  schedule:
    - cron: '0 6 * * 0'

permissions:
  actions: read
  contents: read
  security-events: write

jobs:
  analyze:
    name: Analyze (JS/TS)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4.38.1
        with:
          languages: javascript-typescript
          queries: security-extended,security-and-quality

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4.38.1
        with:
          category: '/language:javascript-typescript'