Harden auth, sync, and Supabase security #119
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🔐 CodeQL Security Scan | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Runs every Monday at 09:00 UTC | |
| - cron: '0 9 * * 1' | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| jobs: | |
| analyze: | |
| name: Analyze JavaScript/TypeScript | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: ⬇️ Checkout | |
| uses: actions/checkout@v4 | |
| - name: 🔍 Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: javascript-typescript | |
| # Config excludes public/ (154 minified React bundle files) and docs/ | |
| # which would otherwise generate hundreds of false-positive warnings. | |
| # Uses security-extended only — security-and-quality adds stylistic | |
| # rules that are not actionable for a single-file server app. | |
| config-file: ./.github/codeql/codeql-config.yml | |
| - name: 🏗️ Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: 📊 Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: /language:javascript-typescript |