codeql.yml

name: CodeQL

# SAST (SEC-07/08, CICD-20). Two languages: python (the validator itself) and
# actions (the 6 workflows + action.yml, for the injection/permission classes
# CodeQL's actions query pack understands).

# CICD §11e trigger shape: PRs into main + weekly schedule. No push trigger —
# the pull_request run already analyzed the same changes before merge.
on:
  pull_request:
  schedule:
    - cron: "17 6 * * 1" # weekly, Monday 06:17 UTC

# Cancel superseded runs of the same ref (CICD §11c).
concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write # required to upload SARIF to code scanning
    strategy:
      fail-fast: false
      matrix:
        language: ["python", "actions"]
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false
      - uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
        with:
          languages: ${{ matrix.language }}
      - uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
        with:
          category: "/language:${{ matrix.language }}"