codeql.yml

# CodeQL static analysis — GitHub-native security scanner, free for public
# repos. Findings land in the Security tab and open annotated PRs when new
# issues are introduced.
#
# Scans both Python (cli/) and TypeScript (src/) since the repo ships both.
# Weekly schedule catches new CodeQL rules against unchanged code; push +
# PR triggers catch regressions on active development.
#
# Docs: https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Monday 06:00 UTC — off-peak, well after Dependabot's weekly PRs
    # finish landing so the results reflect the fresh dep tree.
    - cron: "0 6 * * 1"

permissions:
  actions: read
  contents: read
  security-events: write

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        language: ["python", "javascript-typescript"]

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          # `security-and-quality` includes the default `security-extended`
          # ruleset plus code-quality checks. Fine for a small codebase;
          # switch to `security-extended` if noise gets too loud later.
          queries: security-and-quality
          # Skip vendored code and generated assets. Golden fixtures under
          # cli/tests/fixtures/ are upstream projects' code copied verbatim
          # for parser regression testing — their bugs (e.g. Saleor's
          # super-not-enclosing-class in product/models.py) are not ours to
          # fix and would drown the security tab in noise.
          config: |
            paths-ignore:
              - cli/tests/fixtures/**
              - dist/**
              - out/**
              - node_modules/**
              - '**/*.min.js'

      # No build step needed — both Python and TypeScript are analyzed
      # by CodeQL directly from source. If we ever add a language that
      # needs compilation (Go, C++) we would add `- uses: github/codeql-action/autobuild@v3` here.

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"