From 93afdd363379a4e8dd4f7fa31dff1642f218060f Mon Sep 17 00:00:00 2001 From: Evan Wondrasek Date: Tue, 3 Nov 2026 13:24:22 -0800 Subject: [PATCH] CodeQL as an advanced setup that reads .claude/mods Default setup found no code it could read, since the TypeScript is all under .claude/mods and the JavaScript extractor skips dot-folders, so it had stopped scanning. This config names that folder and .github/workflows. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/codeql.yml | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..af7409d --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,36 @@ +# CodeQL as an advanced setup, because default setup can't be told where the code is: the TypeScript lives under +# .claude/mods, a dot-folder the JavaScript extractor skips, so default setup found nothing to read and stopped scanning. +# The config names both folders this repo has code in. +name: CodeQL + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: "17 9 * * 1" # weekly, so new queries reach code that hasn't changed + +permissions: + contents: read + +jobs: + analyze: + runs-on: ubuntu-26.04 + timeout-minutes: 15 + permissions: + contents: read + security-events: write + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 + with: + languages: actions, javascript-typescript + build-mode: none + config: | + paths: + - .claude/mods + - .github/workflows + - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1