Repository navigation

fix(sync): count a Property with a recorded failure in the reconciliation-age alert #2796

	name: CodeQL

	# BQC-7.7: static security analysis (CodeQL). Public repo → code scanning is
	# free; SARIF uploads use the security-events permission below. Findings land
	# as code-scanning alerts (Security tab); a failed ANALYSIS is a hard gate
	# (no continue-on-error) — see docs/operations/security-ci-policy.md.

	on:
	workflow_dispatch:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	# Weekly full re-scan (new queries/CVE classes land between PRs).
	schedule:
	- cron: '24 5 * * 1'

	# Superseded runs of this workflow are cancelled so they stop competing for
	# runners with the commit that replaced them. main is never cancelled: its runs
	# gate the release.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

	permissions:
	contents: read

	jobs:
	analyze:
	name: Analyze (javascript-typescript)
	runs-on: ubuntu-latest
	permissions:
	contents: read
	# BQC-7.7: SARIF upload to code scanning (pre-provisioned for this).
	security-events: write

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- name: Initialize CodeQL
	uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
	with:
	languages: javascript-typescript
	# security-extended = the security suite + medium-precision findings.
	queries: security-extended

	# javascript-typescript needs no build (extractor build-mode: none).
	- name: Perform CodeQL analysis
	uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1