Repository navigation
CodeQL Security Analysis #18460
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL Security Analysis | |
| # Deliberately NOT on pull_request: the analysis took ~4½ runner-minutes per | |
| # PR sync. If branch protection ever required the "Analyze (javascript)" check, | |
| # that requirement must be dropped along with this trigger. | |
| # | |
| # DAILY, not on every push to main (#25771, maintainer ruling Q6 = C). The push | |
| # trigger ran 100 analyses in 25.9 h, 86 of them cancelled by the next merge, | |
| # and each one competed with PR and merge-queue runners. One daily run of | |
| # `main` analyzes everything that landed the day before; the Monday deep pass | |
| # it replaces ran the same query suite, so it folds into the daily one. | |
| # `workflow_dispatch` re-analyzes `main` on demand, e.g. after landing a fix. | |
| on: | |
| schedule: | |
| # 02:00 UTC every day | |
| - cron: '0 2 * * *' | |
| workflow_dispatch: | |
| # A superseded analysis of an outdated commit has no value — cancel it. An | |
| # on-demand run cancels an in-flight analysis of the same ref (the newer | |
| # `main` head still gets analyzed). | |
| concurrency: | |
| group: codeql-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| name: Analyze | |
| runs-on: ubuntu-latest | |
| # Run wall of the 22 analyses that completed (success) in the last 100 runs, | |
| # 2026-10-24..26: p99 59.0 min, max 63.1. The bound is that p99 plus about half again. | |
| timeout-minutes: 90 | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ['javascript'] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-and-quality | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v4 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{matrix.language}}" |