Add CodeQL analysis workflow#258
Conversation
This workflow file sets up CodeQL analysis for the repository, defining triggers for pushes and pull requests on the main branch, and scheduling regular scans.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
There was a problem hiding this comment.
Pull request overview
This pull request adds a CodeQL security analysis workflow to automatically scan the codebase for vulnerabilities. The workflow is configured to run on pushes and pull requests to the main branch, as well as on a weekly schedule (Wednesdays at 19:42 UTC).
Changes:
- Added CodeQL workflow file with analysis for GitHub Actions and JavaScript/TypeScript code
- Configured automatic scanning triggers and scheduled security scans
- Set up matrix strategy to analyze multiple language types
| # the `language` matrix defined below to confirm you have the correct set of | ||
| # supported CodeQL languages. | ||
| # | ||
| name: "CodeQL Advanced" |
There was a problem hiding this comment.
The workflow name is "CodeQL Advanced" but this appears to be a standard CodeQL setup without advanced customizations. Consider using a simpler name like "CodeQL" or "CodeQL Analysis" to avoid confusion.
| name: "CodeQL Advanced" | |
| name: "CodeQL Analysis" |
Co-authored-by: Copilot <[email protected]>
This workflow file sets up CodeQL analysis for the repository, defining triggers for pushes and pull requests on the main branch, and scheduling regular scans.