Merge pull request #2635 from copse-dev/copse/take-a-look-at-latest-m… #2173
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| # Deliberately still `main`, which is now TRUNK rather than the release | |
| # branch — scanning every merge to trunk surfaces findings earlier than | |
| # scanning `release` would. This is a behaviour change, not an oversight. | |
| branches: [main] | |
| schedule: | |
| - cron: '23 6 * * 1' | |
| # CodeQL is advisory rather than a required PR check. Scan the trusted main tip | |
| # after merges plus a weekly safety-net run instead of scanning every PR update. | |
| # Deliberately scans trunk rather than `release`: every commit reaches `release` | |
| # via a promotion from `main`, so scanning `main` covers the same code and | |
| # surfaces findings a promotion earlier. The weekly run remains the backstop for | |
| # anything sitting on `main` between promotions. | |
| # Both triggers stay on the self-hosted check fleet; there is intentionally no | |
| # GitHub-hosted fallback here because the scan can wait for fleet capacity. | |
| # | |
| # This repository does not currently have GitHub Code Security enabled, so | |
| # retain the SARIF as a workflow artifact instead of asking the API to ingest it. | |
| permissions: | |
| actions: read | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze JavaScript and TypeScript | |
| runs-on: ${{ vars.SELF_HOSTED_CHECKS || 'ubuntu-latest' }} | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: github/codeql-action/init@v4.37.9 | |
| with: | |
| languages: javascript-typescript | |
| build-mode: none | |
| - uses: github/codeql-action/analyze@v4.37.9 | |
| with: | |
| upload: false | |
| output: codeql-results | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: codeql-results | |
| path: codeql-results | |
| retention-days: 7 |