From abb3f77f9f534c613aeb702d77616c467c60ffae Mon Sep 17 00:00:00 2001
From: Madraka <8898640+Madraka@users.noreply.github.com>
Date: Sun, 8 Nov 2026 02:46:48 +0300
Subject: [PATCH] ci: CodeQL code scanning

Adds .github/workflows/codeql.yml: CodeQL for javascript-typescript, rust
(build-mode none; Rust is generally available in CodeQL and the default
setup uses no build) and the workflow files (actions), on pull requests, on
pushes to main and weekly. Actions pinned to commit SHAs with the version
in a comment, as release.yml does. .github/codeql/codeql-config.yml keeps
generated code, fixtures, build output and the i18n loaders out of the
analysis so findings land in hand-written code.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Madraka <8898640+Madraka@users.noreply.github.com>
---
 .github/codeql/codeql-config.yml | 17 +++++++++
 .github/workflows/codeql.yml     | 60 ++++++++++++++++++++++++++++++++
 2 files changed, 77 insertions(+)
 create mode 100644 .github/codeql/codeql-config.yml
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 00000000..bb1ad16a
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,17 @@
+# CodeQL analysis configuration (.github/workflows/codeql.yml).
+#
+# Everything generated or not hand-written is left out, so findings point at code someone can fix
+# here: the JSON Schema → TypeScript/Rust output (AGENTS.md "Never edit generated files"), the
+# i18n parameter types and loaders, golden fixtures, build output and the vendored test archives.
+name: Cloudhal
+
+paths-ignore:
+  - "**/generated/**"
+  - "**/dist/**"
+  - "**/node_modules/**"
+  - "**/fixtures/**"
+  - "**/__snapshots__/**"
+  - apps/studio/src/i18n/loaders/**
+  - target/**
+  - .i18n/**
+  - "**/*.min.js"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..88561a51
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,60 @@
+name: CodeQL
+
+# Code scanning (GitHub Advanced Security, free on public repositories): CodeQL analyses the
+# TypeScript/JavaScript packages, the Rust crates and the workflow files themselves on every pull
+# request, on every push to main and once a week, and uploads the results to Security › Code
+# scanning. Rust uses `build-mode: none` (the extractor needs no build; rustup and cargo on the
+# runner are enough). .github/codeql/codeql-config.yml excludes generated code, fixtures and build
+# output so findings land in hand-written code only.
+#
+# Actions are pinned to commit SHAs with the version in a comment (as release.yml does); Dependabot
+# updates the SHA and the comment together.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Monday 05:17 UTC, before the working day in Europe.
+    - cron: "17 5 * * 1"
+
+permissions: {}
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
+      # Only private repositories need these (to fetch internal CodeQL packs and workflow data).
+      packages: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            build-mode: none
+          - language: rust
+            build-mode: none
+          - language: actions
+            build-mode: none
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          config-file: ./.github/codeql/codeql-config.yml
+      - uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          category: "/language:${{ matrix.language }}"