From de0bab2c09debf90c480a48d25f6f3a7f03c89ad Mon Sep 17 00:00:00 2001
From: Joey Perrott <josephperrott@gmail.com>
Date: Fri, 31 Jan 2025 15:09:02 +0000
Subject: [PATCH 1/2] ci: configure codeql locally within the repo to allow for
 customization

Moving to the configuration being in the repo allows us to specify which specific rules are run in analysis.
---
 .github/workflows/codeql.yml | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 000000000000..b239c0cb13ed
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,35 @@
+name: 'CodeQL'
+
+on:
+  push:
+    branches: ['main', '*.*.x']
+  schedule:
+    - cron: '39 9 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: 'ubuntu-latest'
+    permissions:
+      security-events: write
+      packages: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            build-mode: none
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@1a7989f3955e0c69f0e0ccc14aee54a387a0fd31 #v3.28.8
+        with:
+          languages: javascript-typescript
+          build-mode: none
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@86b04fb0e47484f7282357688f21d5d0e32175fe #v3.28.8
+        with:
+          category: '/language:javascript-typescript'

From f97da1c338ab6b5558a39beca296cc9f8b0ed9ca Mon Sep 17 00:00:00 2001
From: Joey Perrott <josephperrott@gmail.com>
Date: Fri, 31 Jan 2025 15:24:10 +0000
Subject: [PATCH 2/2] ci: disable evalutations that arecausing codeql timeouts

Disabling js/bad-code-sanitization and js/regex-injection because a recent update caused tons of
 timeouts and we don't have anything where cryptographic usage is ultra important in our use cases.
---
 .github/codeql/config.yml    | 8 ++++++++
 .github/workflows/codeql.yml | 5 +----
 2 files changed, 9 insertions(+), 4 deletions(-)
 create mode 100644 .github/codeql/config.yml

diff --git a/.github/codeql/config.yml b/.github/codeql/config.yml
new file mode 100644
index 000000000000..ad81a268eda4
--- /dev/null
+++ b/.github/codeql/config.yml
@@ -0,0 +1,8 @@
+name: 'Angular CLI CodeQL config'
+
+query-filters:
+  # TODO(josephperrott): reevaluate if these can be reenabled.
+  - exclude:
+      id: js/bad-code-sanitization
+  - exclude:
+      id: js/regex-injection
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b239c0cb13ed..99de6caf443e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,10 +15,6 @@ jobs:
       packages: read
     strategy:
       fail-fast: false
-      matrix:
-        include:
-          - language: javascript-typescript
-            build-mode: none
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -29,6 +25,7 @@ jobs:
         with:
           languages: javascript-typescript
           build-mode: none
+          config-file: .github/codeql/config.yml
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@86b04fb0e47484f7282357688f21d5d0e32175fe #v3.28.8
         with: