[pancakereport]

codeql.yml uses github/codeql-action@v3, which GitHub plans to deprecate in December 2026 (changelog). Repos with their own CodeQL workflow, like this one, have to move to v4 themselves. This also widens what CodeQL scans beyond Python.

Changes

• init and analyze go to @v4.
• New languages:
  • javascript-typescript: scans server/static/js/ (layout_preview.js, utils.js).
    • Excluded: the vendored minified libraries (server/static/vendor/, tests/a11y/axe.min.js), via paths-ignore.
    • Not scanned: the inline <script> blocks in the .j2 templates. CodeQL reads .js and .html files, not Jinja templates.
  • actions: scans the workflow files themselves, for script injection from untrusted input, checking out PR code in privileged workflows, and overly broad permissions.
• No build step: all three languages use build-mode: none, so the autobuild step is gone.
• Cleanup: removes the setup template's leftover comments and its Swift runner and timeout logic. The Python category stays /language:python, so existing Python alerts carry over.

Testing

This PR's own checks are the test: the Analyze job should run three times (python, javascript-typescript, actions) and upload results under three categories. Any new alerts from the two new languages show up under Security → Code scanning.

🤖 Generated with Claude Code

[github-actions]

Coverage for unit tests for Python 3.14

File	Stmts	Miss	Cover	Missing
server
__init__.py	52	4	92%	55, 65–67, 87
cache.py	6	1	83%	12
forms.py	138	14	90%	23–25, 41–43, 70, 93, 168–171, 178, 186
models.py	211	26	88%	60, 64, 67, 70, 73, 76–81, 143–152, 182, 200, 257, 260, 283, 327, 341
views.py	767	513	33%	39, 49–85, 95–129, 140–144, 161–170, 186–203, 214–221, 230–252, 263–276, 285, 296–299, 317–318, 320–325, 327–328, 342–366, 375–397, 406–433, 450–452, 462–504, 544–574, 583–613, 633, 647–650, 652–655, 664–694, 703–720, 751–755, 764–810, 816–868, 880–882, 889–910, 918–939, 971, 995, 1040–1049, 1051, 1066–1067, 1072–1085, 1099, 1104, 1131–1132
server/controllers
__init__.py	82	17	79%	27–28, 36–39, 43, 72, 76, 85, 101–110
auth_controllers.py	40	23	42%	22–51, 57–59
health_controllers.py	21	7	67%	18–19, 24–28
server/services/auth
__init__.py	28	3	89%	25–26, 30
server/services/canvas
__init__.py	80	61	24%	18–25, 29, 33, 37, 43, 55–64, 69–105, 109–124, 128
fake_canvas.py	39	26	33%	9, 12, 15, 20–25, 28–29, 37–46, 49–56
server/services/core
assign.py	76	3	96%	25, 28, 113
data.py	61	34	44%	13–18, 22–26, 30–34, 38–40, 44–55, 90–92, 101–102, 106–107
export.py	27	6	78%	36–38, 40–42
room.py	61	18	70%	11–33, 57, 70–71, 74
student.py	192	5	97%	33, 37–38, 47, 284
server/services/email
__init__.py	50	3	94%	47, 74, 92
smtp.py	100	25	75%	20, 60–62, 84–92, 104–105, 117–124, 128–130, 141–142
server/services/email/templates
__init__.py	33	1	97%	20
server/typings
exception.py	34	4	88%	42, 53, 59–60
server/utils
date.py	7	1	86%	30
misc.py	16	7	56%	13–19
TOTAL	2391	802	66%

Tests	Skipped	Failures	Errors	Time
300	0 💤	0 ❌	0 🔥	14.145s ⏱️

[github-actions]

Coverage for e2e tests for Python 3.14

File	Stmts	Miss	Cover	Missing
server
__init__.py	52	12	77%	13, 16–22, 27, 55, 65–67, 87
cache.py	6	1	83%	12
forms.py	138	21	85%	23–25, 41–43, 68–70, 92–98, 168–171, 178, 186
models.py	211	70	67%	27, 60, 64, 67, 70, 73, 76–81, 111, 126–132, 136, 140, 143–152, 161–162, 169–170, 177–182, 189–197, 200, 214, 217–219, 222, 226, 238, 242, 246, 250–251, 257, 260, 280, 283, 304, 309, 314, 319, 324, 327, 341
views.py	767	656	14%	38–40, 49–85, 95–129, 140–144, 161–170, 186–203, 214–221, 230–252, 263–276, 285, 296–299, 310–329, 342–366, 375–397, 406–433, 442–453, 462–504, 515–523, 531–535, 544–574, 583–613, 622–655, 664–694, 703–720, 726–729, 739–746, 751–755, 764–810, 816–868, 874–884, 889–910, 915–945, 950–954, 962–972, 976–978, 983–1016, 1026–1030, 1037–1061, 1066–1067, 1072–1085, 1094, 1099, 1104, 1120–1136, 1146–1147
server/controllers
__init__.py	82	46	44%	26–44, 47–49, 60–87, 90, 101–110, 113
auth_controllers.py	40	26	35%	14–16, 22–51, 57–59
dev_login_controllers.py	58	44	24%	17–30, 35–52, 60–61, 68–79, 84–101
health_controllers.py	21	12	43%	9, 14–19, 24–28
server/services/auth
__init__.py	28	7	75%	25–26, 30, 62–63, 68–69
server/services/canvas
__init__.py	80	61	24%	18–25, 29, 33, 37, 43, 55–64, 69–105, 109–124, 128
fake_canvas.py	39	26	33%	9, 12, 15, 20–25, 28–29, 37–46, 49–56
server/services/core
assign.py	76	58	24%	10–13, 16, 19, 22, 25, 28, 36, 40–46, 54–55, 63, 67, 83–148, 162–178
data.py	61	41	33%	13–18, 22–26, 30–34, 38–40, 44–55, 62, 72–74, 79, 90–92, 96–97, 101–102, 106–107
export.py	27	22	19%	11–45
layout_preview.py	92	57	38%	81, 85, 90, 94, 105–110, 116–119, 128–130, 140, 147, 159–162, 167–171, 175–177, 199–200, 206–209, 218–222, 227, 239–259
room.py	61	56	8%	11–33, 41–89
student.py	192	159	17%	33, 37–38, 42, 46–48, 57–60, 70–72, 79, 88–93, 104–107, 110–114, 122–136, 140–143, 152–157, 161, 165, 172–307
server/services/csv
__init__.py	26	17	35%	11–12, 20, 27–30, 40, 54–56, 63–68
server/services/email
__init__.py	50	38	24%	23–40, 44–81, 90–101
smtp.py	100	78	22%	20, 28–41, 49–50, 54–63, 68–93, 99–131, 136–142
server/services/email/templates
__init__.py	33	23	30%	9–11, 14–17, 20, 30–41, 45–47
server/services/google
__init__.py	55	39	29%	21–36, 40–43, 47–53, 57–76
server/typings
exception.py	34	13	62%	20–36, 42, 47, 53, 59–60, 69, 72
server/utils
date.py	7	4	43%	17–19, 30
misc.py	16	13	19%	5–9, 13–19, 23
TOTAL	2391	1600	33%

Tests	Skipped	Failures	Errors	Time
14	0 💤	0 ❌	0 🔥	43.243s ⏱️

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.45%. Comparing base (56afab5) to head (93166e6).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #135   +/-   ##
=======================================
  Coverage   66.45%   66.45%           
=======================================
  Files          29       29           
  Lines        2391     2391           
=======================================
  Hits         1589     1589           
  Misses        802      802           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🚀 Staging Preview Deployed!

URL: https://preview-seating-pr-135-137456085712.us-west1.run.app