codeql.yml

name: CodeQL

on:
  push:
    # Deliberately still `main`, which is now TRUNK rather than the release
    # branch — scanning every merge to trunk surfaces findings earlier than
    # scanning `release` would. This is a behaviour change, not an oversight.
    branches: [main]
  schedule:
    - cron: '23 6 * * 1'

# CodeQL is advisory rather than a required PR check. Scan the trusted main tip
# after merges plus a weekly safety-net run instead of scanning every PR update.
# Deliberately scans trunk rather than `release`: every commit reaches `release`
# via a promotion from `main`, so scanning `main` covers the same code and
# surfaces findings a promotion earlier. The weekly run remains the backstop for
# anything sitting on `main` between promotions.
# Both triggers stay on the self-hosted check fleet; there is intentionally no
# GitHub-hosted fallback here because the scan can wait for fleet capacity.
#
# This repository does not currently have GitHub Code Security enabled, so
# retain the SARIF as a workflow artifact instead of asking the API to ingest it.
permissions:
  actions: read
  contents: read

jobs:
  analyze:
    name: Analyze JavaScript and TypeScript
    runs-on: ${{ vars.SELF_HOSTED_CHECKS || 'ubuntu-latest' }}
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7.0.1
        with:
          persist-credentials: false
      - uses: github/codeql-action/init@v4.37.9
        with:
          languages: javascript-typescript
          build-mode: none
      - uses: github/codeql-action/analyze@v4.37.9
        with:
          upload: false
          output: codeql-results
      - uses: actions/upload-artifact@v7
        with:
          name: codeql-results
          path: codeql-results
          retention-days: 7