codeql.yml

name: "CodeQL"
on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  schedule:
    - cron: "34 6 * * 2"
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  analyze:
    name: Analyze
    runs-on: "ubuntu-latest"
    timeout-minutes: 360
    permissions:
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language: ["javascript-typescript", "actions"]
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
      - uses: andykenward/github-actions/setup-pnpm@29a88e7e0d84f5c1de18a54e5435a7c9be824971 #v2.0.0
        with:
          node-version: 24
      - name: Cache
        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 #v5.0.2
        with:
          path: |
            ~/.cache/
          key: ${{ runner.os }}-node-${{ hashFiles('**/pnpm-lock.yaml', '**/eslint.config.js', '**/prettier.config.cjs', '**/tsconfig.json', '**/knip.json', '**/vitest.config.ts', '**/vitest.setup.ts') }}
      - name: Rebuild the dist/ directory
        run: pnpm run build
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{matrix.language}}"