codeql.yml

name: codeql

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Catches advisories published after a commit landed.
    - cron: "27 4 * * 1"

permissions: read-all

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  analyze:
    name: Analyze JavaScript and TypeScript
    # This workflow runs for pull requests from forks, so keep it GitHub-hosted
    # and isolated from privileged environments or repository credentials.
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
      security-events: write

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Initialize CodeQL
        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          languages: javascript-typescript
          queries: security-and-quality

      # No build step: CodeQL analyses the TypeScript sources directly. Building
      # the extension would only add the bundled output, which it cannot use.
      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          category: "/language:javascript-typescript"