codeql.yml

name: CodeQL

permissions:
  actions: read
  contents: read
  security-events: write

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    branches: [master, develop]
  push:
    branches: [master, develop]
  schedule:
    - cron: '0 6 * * 1' # weekly, Monday 06:00 UTC

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        language: [javascript-typescript, python]

    steps:
      - uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: none
          config: |
            paths-ignore:
              # Servers/utils/safeOutboundUrl.ts is the single choke point for
              # outbound fetch() calls made to admin-configured URLs (MLflow,
              # JIRA Data Center, Azure AI Foundry). A user-supplied URL flows
              # through assertSafeOutboundUrl and into fetch() by design.
              #
              # CodeQL's js/request-forgery taint tracker does not recognise
              # the runtime sanitizer and will always report the fetch as SSRF.
              # Removing the file would revert six extension fetch() sites to
              # raw, unchecked calls. See the file header for the full threat
              # model and compensating controls (Admin role gate, protocol
              # allowlist, cloud-metadata block, credential-embedding block,
              # ReDoS-safe trailing-slash trim). Unit tests: the sibling
              # safeOutboundUrl.test.ts, 13 cases.
              - Servers/utils/safeOutboundUrl.ts

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: '/language:${{ matrix.language }}'