From b3196212e95b6bef2ca762860596c77afeb26a70 Mon Sep 17 00:00:00 2001 From: ci-maintainer Date: Fri, 10 Jul 2026 02:16:45 -0400 Subject: [PATCH] [ci-maintainer] fix: activate CodeQL SAST workflow (rename from .disabled) Fixes #6275 Signed-off-by: ci-maintainer Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/codeql.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 000000000..91d110b49 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,34 @@ +name: CodeQL Analysis + +on: + push: + branches: ["main"] + pull_request: + branches: ["main"] + schedule: + - cron: '0 4 * * 1' # Weekly Monday 04:00 UTC + +permissions: + contents: read + +jobs: + analyze: + name: Analyze (javascript-typescript) + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - name: Checkout repository + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + + - name: Initialize CodeQL + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + languages: javascript-typescript + queries: security-and-quality + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + category: "/language:javascript-typescript"