Make the reviewer surface a SPA, on the same console the organizer uses #43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # GitHub's own static analysis, free on this repository because it is public. | |
| # | |
| # Read what it reports with the same scepticism the security-audit skill applies | |
| # to any stock ruleset: CodeQL's default JavaScript queries look for Express | |
| # routes, `child_process`, `mysql.query` and `dangerouslySetInnerHTML`, none of | |
| # which exist here. This app's dangerous operations are its own — `raw()` past | |
| # the HTML escaper, `db.raw()` past the org-scoping in `buildWhere`, `redirect()`, | |
| # `input.str()` — and a query that has not been told about those cannot find a | |
| # bug in them. Six stock Semgrep packs scored zero on this codebase for exactly | |
| # that reason. | |
| # | |
| # So CodeQL runs here to catch what it is genuinely good at and we are not: | |
| # cross-function taint through code nobody thought to look at, and any | |
| # ecosystem-shaped vulnerability that arrives with a future dependency. The | |
| # repo-specific half lives in `.claude/skills/security-audit/`, runs in ci.yml, | |
| # and is the one that has actually found things. | |
| # | |
| # `security-extended` over the default suite: the default is tuned for a low | |
| # false-positive rate on a PR gate, and this is a weekly sweep where a false | |
| # positive costs a minute and a miss costs a release. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Mondays 07:00 UTC. A weekly run matters more than the PR runs: most of | |
| # what CodeQL will ever say about this repo depends on advisories published | |
| # after the code was written, not on the diff. | |
| - cron: '0 7 * * 1' | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze JavaScript/TypeScript | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| # Uploading results to the Security tab is the whole point. | |
| security-events: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 | |
| with: | |
| languages: javascript-typescript | |
| queries: security-extended | |
| # `www/` is a separate Astro deployable with its own lockfile and no | |
| # access to D1; it is analysed by nothing here on purpose. If it ever | |
| # grows server-side code, give it its own matrix entry rather than | |
| # folding it into the app's results. | |
| config: | | |
| paths-ignore: | |
| - node_modules | |
| - www | |
| - .wrangler | |
| - tests/fixtures | |
| # No build step: the Worker is ES modules served as-is and the console is | |
| # plain ES modules with no bundler, so CodeQL's autobuild has nothing to | |
| # do and `npm ci` would only add a minute. | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 | |
| with: | |
| category: /language:javascript-typescript |