security.yml

name: Security

# Security analysis: the code with CodeQL, the dependencies with npm audit. On
# top of pushes, a weekly run catches vulnerabilities published afterwards.
on:
  push:
    branches: [main, develop]
  pull_request:
  schedule:
    - cron: "0 6 * * 1"
  # By hand, with a category: the analysis is published under that
  # configuration name. Used to close the alerts of an abandoned configuration
  # (the workflow used to be securite.yml) without erasing their history: a clean
  # analysis under the old name marks them fixed.
  workflow_dispatch:
    inputs:
      category:
        description: CodeQL category (empty = the default one)
        type: string
        default: ""

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # The job id is part of the CodeQL category: renaming it would orphan the
  # existing alerts.
  codeql:
    name: Code analysis (CodeQL)
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
        with:
          languages: javascript-typescript

      - name: Analyze
        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
        with:
          category: ${{ inputs.category }}

  dependencies:
    name: Dependency audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: npm

      - run: npm ci --no-audit --no-fund

      - name: npm audit
        run: npm audit --audit-level=high