codeql.yml

# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# CodeQL — thin caller of the estate reusable in hyperpolymath/standards
# (CI regularisation spec: "REMAKE · GATE: thin caller of codeql-reusable.yml").
# One call per language, per the reusable's design. januskey has no
# JavaScript/TypeScript, so the reusable's javascript-typescript default would
# fail with "no source code seen"; it analyses the workflow YAML (actions) and
# the Rust crates (rust, build-mode none).
name: CodeQL Security Analysis

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC

# Queue rather than cancel: a cancelled CodeQL run uploads nothing, and a
# ruleset that expects a code-scanning result for the head commit then waits
# on it indefinitely (same reasoning as standards' own codeql.yml).
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

# Must cover everything the reusable's analyze job requests: a reusable cannot
# widen its caller's grant, and asking for more ends the run in startup_failure.
permissions:
  actions: read
  contents: read
  security-events: write

jobs:
  codeql-actions:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@a85aa8e70326cceedae169013a47daee554918b7 # standards main, 2026-10-19 (#1296)
    with:
      language: actions
  codeql-rust:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@a85aa8e70326cceedae169013a47daee554918b7 # standards main, 2026-10-19 (#1296)
    with:
      language: rust