codeql.yml

name: CodeQL

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

# Advanced CodeQL setup. This replaces GitHub's managed "Default
# setup": Default setup ran each language as a separate analysis and
# its PR-summary check raced the (slower) Python analysis, producing
# the recurring, non-blocking "1 configuration not found" warning.
# An advanced workflow runs all three languages as one matrix in a
# single run, so the summary check waits for every language and the
# race -- and the warning -- cannot occur.

# Triggered via the build.yml orchestrator (workflow_call) plus a
# weekly scheduled scan (cron). Manual dispatch retained for
# debugging.
on:
  workflow_call:
  schedule:
    - cron: "27 3 * * 1"
  workflow_dispatch:

# A new push to the same ref cancels an in-progress run for the
# superseded commit, so successive pushes don't pile up parallel
# CodeQL runs analysing stale commits.
concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    permissions:
      security-events: write   # upload analysis results
      contents: read           # checkout
      actions: read            # required for the 'actions' language
      packages: read           # fetch CodeQL query packs
    strategy:
      fail-fast: false
      matrix:
        language: ["actions", "c-cpp", "python"]

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Initialize CodeQL
        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
        with:
          languages: ${{ matrix.language }}
          build-mode: none
          # Excludes the ~36k generated src/morie/fn/ primitives from
          # extraction -- the dominant cost of the Python analysis.
          config-file: ./.github/codeql/codeql-config.yml

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
        with:
          category: "/language:${{ matrix.language }}"