codeql.yml•1.97 kB
name: CodeQL Analysis
on:
push:
branches: [ main, master, develop ]
pull_request:
branches: [ main, master ]
schedule:
# Run at 00:00 UTC every Monday
- cron: '0 0 * * 1'
jobs:
analyze:
name: Analyze Code
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: [ 'javascript' ]
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
# Specify queries to run
queries: security-extended,security-and-quality
# Use security-extended for additional security coverage
# Use security-and-quality for both security and maintainability checks
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20.x'
cache: 'npm'
- name: Install dependencies
run: |
npm ci
# Install production dependencies only for accurate analysis
npm prune --production
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: "/language:${{matrix.language}}"
# Upload results to GitHub Security tab
upload: true
# Add sarif output for integration with other tools
output: results-${{ matrix.language }}.sarif
- name: Upload SARIF as artifact
uses: actions/upload-artifact@v4
if: always()
with:
name: codeql-results-${{ matrix.language }}
path: results-${{ matrix.language }}.sarif
retention-days: 7