chore(schema): generate PostgreSQL schema documentation #801
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # SAST (#146). CodeQL scans both languages in the repo and reports findings to | |
| # the Security tab / PR "Code scanning" checks. | |
| # | |
| # Mode: ADVISORY. This workflow does not gate merges on its own — a finding shows | |
| # as a neutral PR annotation, not a required failure, so a false positive can't | |
| # wedge an unrelated PR. To gate on results, enable code-scanning merge | |
| # protection in a branch ruleset (Settings → Rules → "Require code scanning | |
| # results", pick the CodeQL tool and a severity threshold); nothing in this file | |
| # has to change. | |
| # | |
| # build-mode: none — CodeQL's buildless analysis, so the scan needs neither the | |
| # .NET SDK nor npm install. Chosen for speed and to avoid coupling the scan to a | |
| # preview .NET 10 toolchain; if C# coverage ever needs the compiler's view, | |
| # switch that language to build-mode: autobuild. | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| schedule: | |
| # Weekly, Monday 07:00 UTC — catches advisories in CodeQL's own query packs | |
| # that land between commits, so a quiet week is still scanned. | |
| - cron: "0 7 * * 1" | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze ${{ matrix.language }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| security-events: write # upload findings to the Security tab | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: csharp | |
| - language: javascript-typescript | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v7 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: none | |
| # security-extended = the default security set plus lower-severity | |
| # security queries, but WITHOUT the maintainability/quality queries | |
| # that security-and-quality layers on. Those quality heuristics | |
| # (e.g. cs/path-combine flagging Path.Combine(dir, "literal.js") in a | |
| # test, where nothing is actually dropped) are false-positive noise on | |
| # a gate whose job is finding vulnerabilities. Keep the wider security | |
| # coverage; drop the quality bucket. | |
| queries: security-extended | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{ matrix.language }}" |