codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '0 8 * * 1'

permissions:
  contents: read
  actions: read
  security-events: write

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        language: [javascript-typescript, actions]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
        with:
          languages: ${{ matrix.language }}
          queries: security-extended
          # Compiled/minified bundles committed for distribution, not hand-written
          # source. Scanning them is both unhelpful (GitHub can't even render a
          # code preview for minified JS) and unstable: their line numbers shift
          # on every rebuild, so CodeQL's alert fingerprinting can't match an
          # alert here across commits — every push reports the same handful of
          # flagged patterns as "new", even after the underlying source (already
          # scanned separately, since these directories are 100% build output) is
          # fixed. The real source lives in admin-app/src/ and
          # integrations/bricks/editor-app/src/, both still fully scanned.
          # `paths-ignore` is not a direct action input on this codeql-action
          # version — it must go inside the inline `config` YAML.
          config: |
            paths-ignore:
              - SLASHED-for-WP/assets/admin-app/**
              - SLASHED-for-WP/integrations/bricks/assets/editor-app/**

      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
        with:
          category: /language:${{ matrix.language }}