Migrate light and Sun fixtures off lab state global #3101
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Weekly catch-up so newly-published rules surface against quiet weeks. | |
| - cron: "27 5 * * 1" | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| jobs: | |
| analyze: | |
| name: Analyze | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [javascript-typescript] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # security-extended adds taint-flow + injection rules beyond the | |
| # default set. Worth it for an app that handles user health data, | |
| # E2EE crypto (crypto.js / venice-e2ee.js), markdown rendering, | |
| # and PDF/AI input parsing. | |
| queries: security-extended | |
| # Skip vendored libraries (Chart.js, pdf.js, mammoth, JSZip, | |
| # cashu-ts, evolu, transformers via CDN, etc.) — findings inside | |
| # those are upstream, not our code, and produce a flood of noise | |
| # on first run. Same for built docs. | |
| config: | | |
| paths-ignore: | |
| - vendor/** | |
| - node_modules/** | |
| - brands/** | |
| # Test fixtures intentionally exercise unsafe patterns | |
| # (URL substring matching, hardcoded sensitive-named locals, | |
| # XSS payloads) to verify the production guards. CodeQL flags | |
| # those as findings; useful in principle, useless in practice | |
| # on the browser test suite. Production code is still | |
| # fully scanned. | |
| - tests/** | |
| query-filters: | |
| # js/xss-through-dom doesn't recognize this codebase's two | |
| # central sanitizers — escapeHTML() (covers every dynamic | |
| # value interpolated into innerHTML) and safeMarkerId() | |
| # (allowlist guard at the five views.js entry points where | |
| # marker keys flow into inline-onclick handlers). The rule | |
| # fires on every `innerHTML = templateLiteral` site | |
| # regardless. Both sanitizers are pinned by tests/test-audit.js | |
| # §3 (escapeHTML coverage) and §3b (safeMarkerId wiring + | |
| # adversarial probes), and tests/test-marker-key-safety.js | |
| # (38 unit assertions). Excluding the rule removes a high | |
| # false-positive signal without compromising the actual XSS | |
| # defense — every other CodeQL rule continues to run. | |
| - exclude: | |
| id: js/xss-through-dom | |
| - uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: /language:${{ matrix.language }} |