DollhouseMCP

name: "CodeQL Analysis" on: push: branches: [main, develop] pull_request: branches: [main, develop] schedule: # Run at 2:30 AM UTC every day - cron: '30 2 * * *' jobs: analyze: name: Analyze runs-on: ubuntu-latest timeout-minutes: 360 permissions: actions: read contents: read security-events: write strategy: fail-fast: false matrix: language: ['javascript-typescript'] steps: - name: Checkout repository uses: actions/checkout@v4 - name: Initialize CodeQL uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} config-file: ./.github/codeql/codeql-config.yml # Override the default database location if needed db-location: '${{ runner.temp }}/codeql_databases' - name: Setup Node.js uses: actions/setup-node@v4 with: node-version: '20.x' cache: 'npm' - name: Install dependencies run: npm ci - name: Build project run: npm run build - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v3 with: category: "/language:${{matrix.language}}" upload: true # Note: False positives are handled via suppression config at .github/codeql/codeql-config.yml