codeql.yml

name: codeql

# Vulnerability management: analyze pull requests before merge; the weekly run
# analyzes ``refs/heads/main`` directly, which both catches newly-discovered query
# classes with no code change and refreshes the canonical default-branch alert
# state (closing fixed alerts) that PR-only uploads cannot. Per-merge ``push: main``
# analysis was dropped per CI-CD-STANDARD §11e — the PR run already gated the same
# diff, so the only cost of relying on the weekly run for alert bookkeeping is up
# to a week's latency in the Security tab, not a weaker merge gate.
on:
  pull_request:
    branches: [main]
  schedule:
    - cron: "27 4 * * 1" # Mondays, 04:27 UTC

permissions:
  contents: read

# Cancel a superseded analysis when a PR branch is updated; the latest revision is
# the only one whose result the merge gate cares about.
concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: CodeQL analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
    strategy:
      fail-fast: false
      matrix:
        # CICD-20: `actions` analyzes the workflow YAML itself (the same
        # surface zizmor's workflow-lint job in ci.yml covers with a
        # different, faster rule set) for injection/permissions/dangerous-
        # trigger issues CodeQL's own query suite catches; `python` is the
        # application code. `security-and-quality` has no `actions`-language
        # pack (github/codeql-action#2658 — "Query pack
        # actions-security-and-quality cannot be found"), so `actions` runs
        # CodeQL's default query suite for that language instead.
        include:
          - language: python
            queries: security-and-quality
          - language: actions
            queries: ""
    steps:
      # Harden-Runner (SEC-04): audit mode first, see ci.yml for the rollout note.
      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
        with:
          egress-policy: audit
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false
      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4
        with:
          languages: ${{ matrix.language }}
          queries: ${{ matrix.queries }}
      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4