Repository navigation
chore(deps): update uvicorn[standard] requirement from >=0.29 to >=0.51.0 #74
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Static analysis (code scanning) for the two source languages in this repo: | |
| # * python — the uv workspace (packages/*, apps/{api,worker,mcp-gateway}) | |
| # * javascript-typescript — the pnpm workspace (apps/web / @forge/web) | |
| # | |
| # Runs on pushes to main, on every PR, and on a weekly schedule so the baseline | |
| # keeps re-scanning even when the tree is quiet. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Weekly, Mondays at 03:27 UTC (off-peak, avoids the top-of-hour rush). | |
| - cron: "27 3 * * 1" | |
| # Least privilege at the top level: read-only by default. The analyze job | |
| # opts into exactly the extra scopes CodeQL needs. | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: codeql-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| name: analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| # Code scanning (CodeQL SARIF upload) requires GitHub Advanced Security, | |
| # which isn't available on a PRIVATE repo — skip cleanly there so the check | |
| # doesn't fail; this activates automatically once the repo is public. | |
| if: ${{ github.event.repository.private == false }} | |
| permissions: | |
| contents: read # checkout | |
| security-events: write # upload CodeQL results to code scanning | |
| actions: read # read workflow run metadata (private-repo safe) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # Both languages are interpreted — no compiled build step required. | |
| - language: python | |
| build-mode: none | |
| - language: javascript-typescript | |
| build-mode: none | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| queries: security-extended | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0 | |
| with: | |
| category: "/language:${{ matrix.language }}" |