codeql.yml

name: CodeQL

# Static security analysis. Free for public repositories, and worth having here specifically
# because this app handles files and URLs the user supplies - project files, imported video,
# YouTube links that are passed to a server process. Findings appear under Security → Code
# scanning rather than as a failing check, so this does not gate merges.

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly, so an advisory published after a quiet period still gets found.
    - cron: '17 4 * * 1'

permissions:
  contents: read
  security-events: write

# main is exempt for the same reason it is in ci.yml, and one more: the analysis of main is the
# baseline that pull-request alerts are compared against, so cancelling it leaves the comparison
# pointing at an older commit.
concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  analyze:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7

      - uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript
          # Includes the security rules that are off by default, which is the reason to run this
          # at all rather than rely on the linter.
          queries: security-extended
          # Which paths are worth analysing, and why the others are not.
          config-file: ./.github/codeql-config.yml

      - uses: github/codeql-action/analyze@v4