codeql.yml

# CodeQL Security Analysis
# Performs deep semantic code analysis to find security vulnerabilities
# https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors

name: "CodeQL"

on:
  push:
    branches: [main]
  pull_request:
    branches: [main, 'dev/**']
  schedule:
    # Run weekly on Sunday at midnight UTC
    - cron: "0 0 * * 0"

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    timeout-minutes: 360
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        # GitHub's Default setup scanned all four of these until this
        # advanced workflow replaced it on 2026-01-21 with Go only; the
        # other three categories then went stale and the Security >
        # Tools page reported "Default setup" as failing ever since.
        # Keep the same /language:<name> categories so the tool status
        # stays continuous.
        language: [go, javascript-typescript, python, actions]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          # Use custom configuration for query tuning and path exclusions
          config-file: .github/codeql/codeql-config.yml

      - name: Setup Go
        if: matrix.language == 'go'
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Autobuild
        if: matrix.language == 'go'
        uses: github/codeql-action/autobuild@v4

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{matrix.language}}"