codeql.yml

name: codeql

# Wires the CodeQL scanning claimed at docs/RESPONSIBLE-TECH-AUDITS.md:390/407, CLAUDE.md,
# and docs/ROADMAP.md:94 — added 2026-07-05 (audit P0-7) because those docs claimed CodeQL
# ran when no such workflow existed.

on:
  # PRs into main + weekly schedule (CI-CD-STANDARD §11e); the redundant push: main
  # trigger was dropped 2026-07-17 — the PR run already covers every merged commit.
  pull_request:
    branches: [main]
  schedule:
    - cron: "17 10 * * 1"
  workflow_dispatch: {}

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read # required on private repos: codeql-action reads its own workflow-run metadata
    strategy:
      fail-fast: false
      matrix:
        language: [python, actions]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          languages: ${{ matrix.language }}

      # Code scanning is not enabled on this repository, so the SARIF-upload API is unavailable
      # and `analyze` fails outright with "Code scanning is not enabled for this repository".
      # Write the SARIF locally and gate on it ourselves instead — there is no code-scanning
      # dashboard to review, so the gate step below IS the enforcement. Keep this arrangement
      # until code scanning is actually turned on and the uploaded results are actually
      # triaged; a dashboard nobody reads is weaker than a job that fails the build.
      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          category: "/language:${{ matrix.language }}"
          upload: never
          output: sarif-results

      - name: Fail on error-severity findings
        run: python3 scripts/codeql_gate.py sarif-results