codeql.yml

name: codeql

# Wires the CodeQL scanning claimed at docs/RESPONSIBLE-TECH-AUDITS.md:390/407, CLAUDE.md,
# and docs/ROADMAP.md:94 — added 2026-07-05 (audit P0-7) because those docs claimed CodeQL
# ran when no such workflow existed.

on:
  # PRs into main + weekly schedule (CI-CD-STANDARD §11e); the redundant push: main
  # trigger was dropped 2026-07-17 — the PR run already covers every merged commit.
  pull_request:
    branches: [main]
  schedule:
    - cron: "17 10 * * 1"
  workflow_dispatch: {}

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read # required on private repos: codeql-action reads its own workflow-run metadata
    strategy:
      fail-fast: false
      matrix:
        language: [python, actions]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
        with:
          languages: ${{ matrix.language }}

      # Code scanning is not enabled on this private repo (no GitHub Advanced Security), so the
      # SARIF-upload API is unavailable and `analyze` fails outright with "Code scanning is not
      # enabled for this repository". Write the SARIF locally and gate on it ourselves instead —
      # there is no code-scanning dashboard to review, so the gate step below IS the enforcement.
      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
        with:
          category: "/language:${{ matrix.language }}"
          upload: never
          output: sarif-results

      - name: Fail on error-severity findings
        run: python3 scripts/codeql_gate.py sarif-results