Skip to content
NutsNews chestnut logoNutsNews Wiki

Technical guide · Overview

Page status: Active

CodeQL Security Scan

NutsNews uses GitHub CodeQL for security scanning.

Visual overview

Primary diagram

System map

NutsNews uses GitHub CodeQL for security scanning.

Render the repository-owned system map when you need it.

Diagram is not rendered yet.

View as text
CodeQL Security Scan

NutsNews uses GitHub CodeQL for security scanning.

flowchart TB
  accTitle: CodeQL Security Scan
  accDescr {
    NutsNews uses GitHub CodeQL for security scanning.
  }
  A["CodeQL Security Scan"] --> B["CODEQL_SECURITY_SCAN.md"]
  B --> C["Auto-generated placeholder diagram"]

CodeQL Security Scan

Fullscreen diagram view.

CodeQL Security Scan

Section titled “CodeQL Security Scan”

NutsNews uses GitHub CodeQL for security scanning.

What it scans

Section titled “What it scans”
  • web/ Next.js app
  • worker/ Cloudflare Workers code
  • .github/workflows/ GitHub Actions workflows

What it helps catch

Section titled “What it helps catch”
  • JavaScript and TypeScript security issues
  • Unsafe code patterns in API routes and worker code
  • GitHub Actions workflow security issues
  • Problems that GitHub can show as code scanning alerts on pull requests

When it runs

Section titled “When it runs”
  • On pushes to main
  • On pull requests into main
  • Weekly on Tuesday
  • Manually from the GitHub Actions tab

Where to view results

Section titled “Where to view results”

Go to:

GitHub repo -> Security -> Code scanning

Or check the workflow run:

GitHub repo -> Actions -> CodeQL Security Scan

Notes

Section titled “Notes”

This workflow uses build-mode: none because NutsNews is JavaScript/TypeScript and GitHub Actions workflow analysis. That keeps the scan simple and avoids needing to install dependencies or run the full Next.js build.

The scan excludes generated and build output folders such as node_modules, .next, coverage, reports, and worker/generated-wrangler.