Create codeql.yml

Author: SIGNIAINDEX

.github/workflows/codeql.yml

@@ -0,0 +1,133 @@
+name: CodeQL
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "0 3 * * 1" # Mondays 03:00 UTC
+  workflow_dispatch:
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+env:
+  NODE_VERSION: "20"
+  PNPM_VERSION: "9"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript-typescript", "rust"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          # Use extended queries for better coverage; you can tighten later.
+          queries: security-extended
+
+      # -----------------------------
+      # Build steps (recommended for better results)
+      # CodeQL will attempt autobuild; we also provide explicit builds.
+      # -----------------------------
+
+      - name: Setup Node (JS/TS only)
+        if: ${{ matrix.language == 'javascript-typescript' }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: "pnpm"
+
+      - name: Setup pnpm (JS/TS only)
+        if: ${{ matrix.language == 'javascript-typescript' }}
+        uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+
+      - name: Install JS dependencies (JS/TS only)
+        if: ${{ matrix.language == 'javascript-typescript' }}
+        run: |
+          set -euo pipefail
+          if [ -f package.json ]; then
+            pnpm install --frozen-lockfile || pnpm install
+          fi
+          if [ -f console/web/package.json ]; then
+            (cd console/web && pnpm install --frozen-lockfile || pnpm install)
+          fi
+          if [ -f console/interface/package.json ]; then
+            (cd console/interface && pnpm install --frozen-lockfile || pnpm install)
+          fi
+          if [ -f sdk/ts/package.json ]; then
+            (cd sdk/ts && pnpm install --frozen-lockfile || pnpm install)
+          fi
+
+      - name: Build JS/TS (JS/TS only)
+        if: ${{ matrix.language == 'javascript-typescript' }}
+        run: |
+          set -euo pipefail
+          # Run builds if scripts exist. Keep failures meaningful.
+          if [ -f package.json ] && pnpm -s run | grep -q "^build"; then
+            pnpm run build
+          fi
+          if [ -f console/web/package.json ] && (cd console/web && pnpm -s run | grep -q "^build"); then
+            (cd console/web && pnpm run build)
+          fi
+          if [ -f console/interface/package.json ] && (cd console/interface && pnpm -s run | grep -q "^build"); then
+            (cd console/interface && pnpm run build)
+          fi
+          if [ -f sdk/ts/package.json ] && (cd sdk/ts && pnpm -s run | grep -q "^build"); then
+            (cd sdk/ts && pnpm run build)
+          fi
+
+      - name: Install Rust toolchain (Rust only)
+        if: ${{ matrix.language == 'rust' }}
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo (Rust only)
+        if: ${{ matrix.language == 'rust' }}
+        uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+
+      - name: Build Rust (Rust only)
+        if: ${{ matrix.language == 'rust' }}
+        run: |
+          set -euo pipefail
+          # Build key crates for analysis quality.
+          cargo build --release --locked --manifest-path crates/signia-core/Cargo.toml
+          cargo build --release --locked --manifest-path crates/signia-plugins/Cargo.toml
+          cargo build --release --locked --manifest-path crates/signia-store/Cargo.toml
+          cargo build --release --locked --manifest-path crates/signia-api/Cargo.toml
+          cargo build --release --locked --manifest-path crates/signia-cli/Cargo.toml
+          cargo build --release --locked --manifest-path crates/signia-solana-client/Cargo.toml
+
+          # If on-chain program exists, build it as well (Cargo-only).
+          if [ -f programs/signia-registry/Cargo.toml ]; then
+            cargo build --release --locked --manifest-path programs/signia-registry/Cargo.toml
+          fi
+
+      # Autobuild fallback (in case explicit build is insufficient)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"