# Generated by /setup-meerkat — safe to delete; re-run the skill to recreate it.
#
# Arm: SAST (CodeQL). The analysis uploads its findings to code scanning; there is
# no exit code to gate on, so the results tab is the record. Change `languages` for
# a project that is not JavaScript/TypeScript.
#
# A `.vue` (or Svelte) single-file component has no extractor here: those files are
# recorded `n/a — no extractor` in the project's standard, and the reviewer's manual
# checklist covers their template and script logic.
#
# Every `uses:` ref below is pinned to the commit this skill shipped with. Re-check
# them when you upgrade the skill.

name: security-sast

on:
  pull_request:
  schedule:
    - cron: "17 3 * * 1"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: security-sast-${{ github.ref }}
  cancel-in-progress: true

jobs:
  sast:
    name: SAST (CodeQL)
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 1

      # A fork pull request or a private mirror has no code-scanning upload
      # permission. The job still reports, so a required check never goes missing.
      - name: A fork pull request or a private mirror has no upload permission
        if: ${{ !(github.event.repository.private == false && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) }}
        run: echo "::notice::CodeQL analysis is skipped here — a fork pull request or a private mirror has no code-scanning upload permission"

      - uses: github/codeql-action/init@4bfa242aa49c5f7c6770b98670d354a7dfac05f8 # v3
        if: ${{ github.event.repository.private == false && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
        with:
          languages: javascript-typescript
          queries: security-extended
          build-mode: none

      - uses: github/codeql-action/analyze@4bfa242aa49c5f7c6770b98670d354a7dfac05f8 # v3
        if: ${{ github.event.repository.private == false && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
        with:
          category: /language:javascript-typescript