codeql.yml

name: 'CodeQL'

# CodeQL used to be a per-push job in ci.yml. Security findings rarely change
# commit-to-commit and the scan is non-blocking (never a required check), so
# running it on every merge to `main` just piled onto the scarce hosted Linux
# pool. Run it on a nightly schedule (plus manual dispatch) instead; findings
# still surface in the Security tab. If fresher results are wanted, add a
# path-filtered `push` trigger for security-relevant sources.
on:
 schedule:
 - cron: '0 3 * * *' # nightly (~03:00 UTC), staggered from the E2E nightly
 workflow_dispatch:

permissions:
 actions: 'read'
 contents: 'read'
 security-events: 'write'

concurrency:
 group: 'codeql'
 cancel-in-progress: false

jobs:
 codeql:
 name: 'CodeQL'
 runs-on: 'ubuntu-latest'
 # Analysis normally finishes in ~7-9 min (22 min worst case observed). Cap it
 # so a runner that drops its heartbeat mid-analysis can't hold a slot for the
 # default 6h.
 timeout-minutes: 30
 steps:
 - name: 'Checkout'
 uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3

 - name: 'Initialize CodeQL'
 uses: 'github/codeql-action/init@df559355d593797519d70b90fc8edd5db049e7a2' # ratchet:github/codeql-action/init@v3
 with:
 languages: 'javascript'

 - name: 'Perform CodeQL Analysis'
 uses: 'github/codeql-action/analyze@df559355d593797519d70b90fc8edd5db049e7a2' # ratchet:github/codeql-action/analyze@v3