docs: add a security policy (#19) #71

	name: CodeQL

	# GitHub's own static analysis. Free on public repositories; on a private repo it
	# requires GitHub Advanced Security, so this will simply not run until the
	# repository is public.
	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	# Lets the first scan be triggered without waiting for a push, and lets a
	# rerun be forced after a rule update.
	workflow_dispatch:
	schedule:
	# Rules are updated continuously, so a weekly run finds things that did not
	# exist as findings when the code was written.
	- cron: '0 7 * * 1'

	jobs:
	analyze:
	runs-on: ubuntu-latest
	# Skip rather than fail while the repository is private: code scanning needs
	# GitHub Advanced Security there, and a permanently red workflow trains people
	# to ignore red workflows.
	if: ${{ !github.event.repository.private }}
	permissions:
	security-events: write
	contents: read

	steps:
	- uses: actions/checkout@v7

	- uses: github/codeql-action/init@v4
	with:
	languages: javascript-typescript
	# security-extended adds lower-severity rules; worth it for a tool that
	# handles credentials and writes files from server-controlled ids.
	queries: security-extended

	- uses: github/codeql-action/analyze@v4

Navigation Menu