mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
Marc-André Bombeck
dde45c76a6
Static analysis was the one class of check the pipeline had no answer for: lint catches style, the type checker catches shape, the tests catch behaviour, and nothing walked the data flow from an untrusted input to a sink. This is GitHub's default setup written out as a workflow file, so the query suite, the excluded paths and the schedule sit in the diff rather than behind a settings toggle. Pull requests and a weekly run on the default branch. No push trigger: everything reaches main through a pull request that was already analysed, and the weekly run is what keeps the Security tab current. src/generated is excluded. Extracting the 9 MB Prisma client costs minutes and can produce nothing anyone would act on, because the fix for anything found in there is to regenerate it.