fix(mcp): make interference maps honest #363
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Static application security testing. `npm audit` covers known-vulnerable | |
| # dependencies, which says nothing about a defect written here. CodeQL covers the | |
| # other half: injection, path traversal, unsafe regex, prototype pollution, and | |
| # similar, in first-party code. | |
| # | |
| # The weekly run matters as much as the per-PR one. New queries ship continuously, | |
| # so unchanged code can become newly-detectable; without a schedule, a finding only | |
| # surfaces the next time someone happens to touch that file. | |
| # | |
| # Findings surface in the Security tab and as pull-request annotations. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Mondays 07:00 UTC, offset from the Dependabot run so review load is spread. | |
| - cron: '0 7 * * 1' | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: codeql-${{ github.ref }} | |
| # Superseded pull-request runs are cancelled; runs on main are not, so the default | |
| # branch always ends up with a completed analysis rather than a cancelled one. | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| security-events: write # upload the SARIF results | |
| actions: read # read workflow run metadata | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # `actions` analyzes the workflow files themselves — the expression-injection | |
| # class this repo also guards structurally in `src/workflow-security.test.ts`. | |
| # The guard checks the shapes it knows to look for; this checks dataflow, and | |
| # the two catch different mistakes. | |
| language: [javascript-typescript, actions] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| languages: ${{ matrix.language }} | |
| config-file: ./.github/codeql/codeql-config.yml | |
| # No build step: both languages are extracted directly from source, so | |
| # `autobuild` would only add a failure mode without changing what is analyzed. | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| category: '/language:${{ matrix.language }}' |