From e918a5c7d735cdfd081902e8fc56f445f5db32af Mon Sep 17 00:00:00 2001
From: nicktrn <55853254+nicktrn@users.noreply.github.com>
Date: Mon, 24 Aug 2026 23:00:27 +0100
Subject: [PATCH] ci: run codeql on all prs via advanced setup

Default setup does not run on pull requests from forks, so external
contributions currently ship unscanned. Advanced setup covers them: on
pull_request the analysis runs in the base repository's context, and the
code scanning upload endpoint accepts results from a fork's read-only
token.

The bare pull_request trigger (no branches filter) preserves today's
behaviour of scanning stacked PRs, whose base is not main.

Languages and categories match default setup exactly, so existing alerts
keep their analysis origin instead of being closed and recreated. The
repository guard skips the workflow in forks, where code scanning may be
unavailable; fork PRs still run, because on pull_request the guard is
evaluated against the base repository.

Default setup must be disabled for these uploads to be accepted -
CodeQL rejects results from advanced configurations while it is on.
---
 .github/workflows/codeql.yml | 40 ++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000000..9fb39b1c505
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,40 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    if: github.repository == 'triggerdotdev/trigger.dev'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write # Upload SARIF to GitHub Security tab
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, javascript-typescript]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        with:
+          category: /language:${{ matrix.language }}