codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "17 3 * * 1"

permissions:
  actions: read
  contents: read
  security-events: write

jobs:
  analyze:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript
      - id: analyze
        uses: github/codeql-action/analyze@v4
      - name: Enforce CodeQL findings
        env:
          SARIF_DIR: ${{ steps.analyze.outputs.sarif-output }}
        run: |
          set -euo pipefail
          findings="$(jq -s '
            [
              .[]
              | .runs[]?.results[]?
              | select((.level // "warning") == "error" or (.level // "warning") == "warning")
            ]
            | length
          ' "$SARIF_DIR"/*.sarif)"
          echo "CodeQL warning/error findings: $findings" | tee -a "$GITHUB_STEP_SUMMARY"
          if [ "$findings" -ne 0 ]; then
            jq -rs '
              .[]
              | .runs[]?.results[]?
              | select((.level // "warning") == "error" or (.level // "warning") == "warning")
              | "\(.level // "warning") \(.ruleId // "unknown-rule") \(.locations[0].physicalLocation.artifactLocation.uri // "unknown-file"):\(.locations[0].physicalLocation.region.startLine // 0): \(.message.text // "No message")"
            ' "$SARIF_DIR"/*.sarif
          fi
          test "$findings" -eq 0