chore(deps-dev): bump the dev-dependencies group with 6 updates #249

	# Runs ESLint across the workspace and uploads results as SARIF so issues
	# show up in the GitHub Security tab alongside CodeQL. The existing PR
	# verification (`.github/workflows/ci.yml` → `pnpm lint`) remains the
	# fast-feedback path; this workflow is the indexed long-term view.
	name: ESLint

	on:
	push:
	branches: ["main"]
	pull_request:
	branches: ["main"]
	schedule:
	# Sunday 02:38 UTC — weekly rescan even if no commits land.
	- cron: "38 2 * * 0"

	permissions:
	contents: read
	security-events: write
	actions: read

	jobs:
	eslint:
	name: Run eslint scanning
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Setup pnpm
	uses: pnpm/action-setup@v6

	- name: Setup Node.js
	uses: actions/setup-node@v7
	with:
	node-version-file: .nvmrc
	cache: pnpm

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Run ESLint (SARIF output)
	env:
	SARIF_ESLINT_IGNORE_SUPPRESSED: "true"
	# `--format` resolves to the formatter declared as a root devDep.
	# `continue-on-error` keeps the workflow green so the SARIF upload
	# still runs when ESLint finds violations — the upload itself
	# surfaces them as code-scanning alerts.
	run: \|
	pnpm exec eslint . \
	--format @microsoft/eslint-formatter-sarif \
	--output-file eslint-results.sarif
	continue-on-error: true

	- name: Upload SARIF to GitHub
	uses: github/codeql-action/upload-sarif@v4.37.3
	with:
	sarif_file: eslint-results.sarif
	wait-for-processing: true

Navigation Menu