codeql.yml

name: codeql

# Wires the CodeQL scanning claimed at docs/RESPONSIBLE-TECH-AUDITS.md:390/407, CLAUDE.md,
# and docs/ROADMAP.md:94 — added 2026-07-05 (audit P0-7) because those docs claimed CodeQL
# ran when no such workflow existed.

on:
  # PRs into main + weekly schedule (CI-CD-STANDARD §11e); the redundant push: main
  # trigger was dropped 2026-07-17 — the PR run already covers every merged commit.
  pull_request:
    branches: [main]
  schedule:
    - cron: "17 10 * * 1"
  workflow_dispatch: {}

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language: [python, actions]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
        with:
          languages: ${{ matrix.language }}

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
        with:
          category: "/language:${{ matrix.language }}"