codeql.yml

name: CodeQL

on:
  schedule:
    # Mondays at 2 AM UTC
    - cron: '0 2 * * 1'
  workflow_dispatch:

permissions:
  contents: read
  security-events: write

jobs:
  codeql-analysis:
    name: CodeQL Security Analysis
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          # CodeQL treats JS and TS as one language; listing both duplicated
          # every alert and doubled the runtime.
          languages: javascript-typescript

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Use the declared npm version
        run: npm install --global "$(node -p "require('./package.json').packageManager")"

      - name: Install dependencies
        run: npm ci

      - name: Build for analysis
        run: npm run build
        env:
          NEXT_PUBLIC_FIREBASE_API_KEY: 'mock-api-key'
          NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN: 'mock.firebaseapp.com'
          NEXT_PUBLIC_FIREBASE_PROJECT_ID: 'mock-project'
          NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET: 'mock.appspot.com'
          NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID: '123456789'
          NEXT_PUBLIC_FIREBASE_APP_ID: 'mock-app-id'
          GEMINI_API_KEY: 'mock-genai-key'

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4