Skip to content

ci: add CodeQL analysis #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
saagpatel merged 1 commit into from
May 18, 2026
Merged

ci: add CodeQL analysis #16

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
name: CodeQL

on:
push:
branches: [polish/v1.0-improvements]
pull_request:
branches: [polish/v1.0-improvements]
Comment on lines +5 to +7
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Include the main branch in CodeQL triggers

With these branches filters, GitHub only runs the push workflow for pushes to polish/v1.0-improvements and the PR workflow for PRs targeting that same branch; I checked the repo context and the normal branch is main (for example docs/developer/releases.md pushes releases from main, and the local repo has a main branch). As a result, PRs into main and direct pushes to main get no CodeQL analysis, so the added security coverage is skipped for the primary development/release path unless this branch name is changed or main is included.

Useful? React with 👍 / 👎.

workflow_dispatch:
schedule:
- cron: '37 8 * * 1'

permissions:
contents: read
security-events: write

jobs:
analyze:
name: Analyze (${{ matrix.language }})
runs-on: ubuntu-latest
timeout-minutes: 360
strategy:
fail-fast: false
matrix:
language: [javascript-typescript, python]

steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Initialize CodeQL
uses: github/codeql-action/init@v4
with:
languages: ${{ matrix.language }}

- name: Perform CodeQL analysis
uses: github/codeql-action/analyze@v4