chore: GA-readiness fixes (F1–F6) + Specter 100% structural-coverage gate #1859
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL Security Analysis | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| branches: [ main, develop ] | |
| schedule: | |
| - cron: '30 1 * * 1' # Weekly scan on Mondays at 1:30 AM UTC | |
| jobs: | |
| analyze: | |
| name: Analyze Code | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'javascript' ] # python removed: Python tree archived to OWAR. TS/JS covers frontend/. | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v5 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-and-quality | |
| # Prototype mockups are not shipped code; their inline JS produces | |
| # noise alerts (unused vars, demo origin checks). Exclude them so | |
| # CodeQL only scans the real frontend/ + scripts. | |
| config: | | |
| paths-ignore: | |
| - docs/engineering/prototypes | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v4 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{matrix.language}}" |