name: CodeQL

# Static analysis for the TypeScript tree. This is GitHub's default setup
# expressed as a workflow file rather than enabled from the repository
# settings, so the query suite, the excluded paths and the schedule are
# reviewable in the diff like everything else here.
#
# Runs on every push to `main` as well as on pull requests. Most changes
# reach `main` through a pull request that is analysed on the way in, but
# not all of them: an asset uploaded through the web UI or a maintenance
# commit pushed directly lands without one, and the weekly run would only
# catch it days later. The push run re-analyses a merged tree once more,
# which is the cost of every commit on `main` having an analysis of its own.
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Mondays, 04:27 UTC. Off the hour so the run does not queue behind
    # everyone else's midnight cron.
    - cron: "27 4 * * 1"
  workflow_dispatch:

permissions:
  contents: read

# A pull request keeps only its newest run: an older head is superseded and
# never merged. A push to `main` is grouped by commit and never cancelled, so
# two merges in quick succession each keep their own analysis instead of the
# second one cancelling (or replacing the queued run of) the first.
concurrency:
  group: codeql-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  analyze:
    name: Analyse javascript-typescript
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
      # Required to write the results into the repository's code-scanning
      # alerts. Free for public repositories.
      security-events: write
      # Required by the CodeQL action to read workflow run metadata.
      actions: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # `build-mode: none` is the correct mode for JavaScript/TypeScript —
      # CodeQL extracts from source and needs neither a compile step nor
      # installed dependencies.
      #
      # The excluded paths are all generated or vendored output. Chief
      # among them is `src/generated`, the ~9 MB Prisma client with a
      # 224 KB inline schema literal in it: extracting that costs real
      # minutes and can produce nothing actionable, because nobody edits
      # it and the fix for anything found there is `pnpm prisma generate`.
      - name: Initialise CodeQL
        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          languages: javascript-typescript
          build-mode: none
          config: |
            paths-ignore:
              - src/generated
              - .next
              - dist
              - coverage
              - playwright-report
              - test-results
              - public

      - name: Analyse
        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          category: "/language:javascript-typescript"