codeql.yml

name: CodeQL Security Analysis

# Deliberately NOT on pull_request: the analysis took ~4½ runner-minutes per
# PR sync. If branch protection ever required the "Analyze (javascript)" check,
# that requirement must be dropped along with this trigger.
#
# DAILY, not on every push to main (#25771, maintainer ruling Q6 = C). The push
# trigger ran 100 analyses in 25.9 h, 86 of them cancelled by the next merge,
# and each one competed with PR and merge-queue runners. One daily run of
# `main` analyzes everything that landed the day before; the Monday deep pass
# it replaces ran the same query suite, so it folds into the daily one.
# `workflow_dispatch` re-analyzes `main` on demand, e.g. after landing a fix.
on:
  schedule:
    # 02:00 UTC every day
    - cron: '0 2 * * *'
  workflow_dispatch:

# A superseded analysis of an outdated commit has no value — cancel it. An
# on-demand run cancels an in-flight analysis of the same ref (the newer
# `main` head still gets analyzed).
concurrency:
  group: codeql-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    # Run wall of the 22 analyses that completed (success) in the last 100 runs,
    # 2026-10-24..26: p99 59.0 min, max 63.1. The bound is that p99 plus about half again.
    timeout-minutes: 90
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: ['javascript']

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          queries: security-and-quality

      - name: Autobuild
        uses: github/codeql-action/autobuild@v4

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{matrix.language}}"