Merge pull request #616 from debugmcp/codex/595-js-local-scope-contract #1096
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| schedule: | |
| # Monday 18:00 UTC — deliberately AFTER dependabot's Monday ~06:00 batch has been | |
| # merged. Auto-merged PRs are pushed with GITHUB_TOKEN, which does not trigger the | |
| # `push` event, so this scheduled run is what actually analyses the week's | |
| # dependency merges on main. | |
| - cron: '0 18 * * 1' | |
| workflow_dispatch: # on-demand re-analysis when main lands commits without a push event | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ javascript-typescript ] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 | |
| with: | |
| category: /language:${{ matrix.language }} |