codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "0 6 * * 1"

permissions:
  security-events: write
  contents: read
  # CodeQL's analyze action calls /repos/{owner}/{repo}/actions/runs/{run_id}
  # for telemetry. Without actions:read it errors "Resource not accessible
  # by integration" and the job exits 1 even though the scan succeeded.
  actions: read

jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: 22

      - name: Install and build
        run: npm install && npx tsc

      - uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript

      # Repo is private under a free user account, so SARIF upload requires
      # GitHub Advanced Security (paid). The scan itself still runs and any
      # findings are visible in the job logs. Don't block PRs on the upload.
      # Drop continue-on-error if/when GHAS is enabled.
      - uses: github/codeql-action/analyze@v4
        continue-on-error: true