codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly Tuesday 04:29 UTC — outside business hours, decoupled from
    # the Monday dependency-check window.
    - cron: "29 4 * * 2"
  workflow_dispatch: {}

permissions:
  contents: read
  # CodeQL v4.36.3 reads workflow-run metadata in the post-processing step
  # that enriches SARIF with run fingerprints (see job log line "Adding
  # fingerprints to SARIF file"). Without `actions: read` the action exits
  # with "Resource not accessible by integration - workflow-runs#get-a-
  # workflow-run" AFTER analysis is already done — the SARIF is correct
  # but the job is marked failed. `actions: read` is the minimum required
  # to let CodeQL inspect its own run; it does NOT widen privileges
  # beyond reading public workflow metadata.
  actions: read
  # Public repositories can publish CodeQL SARIF to GitHub code scanning.
  # `security-events: write` is the least privilege required by CodeQL
  # upload; results then appear as code scanning alerts instead of only as
  # workflow artifacts.
  security-events: write

concurrency:
  group: codeql-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze (${{ matrix.os }} / ${{ matrix.language }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        language: ["javascript-typescript", "python"]
    uses: NDDev-it-com/ci-workflows/.github/workflows/public-codeql.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
    with:
      runner: ${{ matrix.os }}
      languages: '["${{ matrix.language }}"]'
      config_file: ./.github/codeql/codeql-config.yml
      autobuild: true
      output_directory: codeql-results
      upload_sarif_artifact: true
      artifact_name: codeql-${{ matrix.os }}-${{ matrix.language }}-sarif