feat: surface Google SSO on the login page #246
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: codeql | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Weekly, so a newly published query catches an old vulnerability that was | |
| # not a finding on the day the code merged. Scanning only on change would | |
| # never re-examine code that has stopped being touched. | |
| - cron: '27 4 * * 1' | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| # No visibility guard here, deliberately. A job-level `if:` is evaluated | |
| # before the matrix expands, so a skipped run reports a single check under | |
| # the raw template name — `analyze (${{ matrix.language }})` — rather than | |
| # the two expanded names. That phantom name reached the `Protect main branch` | |
| # ruleset as a required check (GitHub's suggestion list offers whatever was | |
| # last reported), and once this repository went public and the job began | |
| # reporting the real names instead, nothing was left to satisfy the phantom: | |
| # every pull request stalled on "Expected — waiting for status to be | |
| # reported", unmergeable, with no failing job to point at. | |
| # | |
| # Code scanning is free while this repository is public. If it ever goes | |
| # private without GitHub Advanced Security, drop these contexts from the | |
| # ruleset — do not reintroduce an `if:` here. | |
| permissions: | |
| # Required to upload results to the code-scanning API. | |
| security-events: write | |
| contents: read | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: java-kotlin | |
| - language: javascript-typescript | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # `none` extracts from source instead of observing a compiler. Chosen | |
| # deliberately for the Java half: an autobuild would have to reproduce | |
| # the JDK 25 toolchain and full Maven dependency resolution, so it | |
| # fails for build reasons far more often than it finds a vulnerability. | |
| # The JavaScript half never has a build mode. | |
| build-mode: none | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: /language:${{ matrix.language }} |