codeql.yml

# CodeQL security analysis (BUILD-LIST P8). Scans JS/TS for vulnerabilities on PRs to
# main, pushes to main, and weekly (catches advisories that land between changes).
# Free for this public repo. No build step needed — CodeQL analyzes the source directly.
name: codeql

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  merge_group: {}
  schedule:
    - cron: '0 6 * * 1' # Mondays 06:00 UTC
  workflow_dispatch: {}

permissions:
  contents: read
  security-events: write
  actions: read

# Keyed per event as well as per ref. On `github.ref` alone, the Monday `schedule` run and a
# push to main collapse to the SAME group and cancel each other, and a cancelled analysis
# leaves the previous run's stale security-events standing as the current result.
# Only PR runs supersede; a push or a scheduled scan is the only run for that SHA.
concurrency:
  group: codeql-${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  analyze:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4.39.1
        with:
          languages: javascript-typescript
          queries: security-and-quality
          # The vendored DAWN design-system reference set is reading material, never
          # shipped or executed by the app — same jurisdiction call as the eslint
          # ignore (design_handoff/dawn/ASSETS.md).
          config: |
            paths-ignore:
              - design_handoff
              # MapLibre's worker + shared chunk, copied verbatim out of node_modules by
              # scripts/copy-maplibre-worker.mjs so the worker's relative sibling import
              # resolves at runtime (docs/MAPS.md §4a). Minified third-party output we cannot
              # patch — findings here would be unactionable, and CodeQL already skips
              # node_modules, which is the same code. Freshness is enforced by
              # scripts/copy-maplibre-worker.test.ts.
              - public/maplibre
      - name: Analyze
        uses: github/codeql-action/analyze@v4.39.1
        with:
          category: "/language:javascript-typescript"