codeql.yml

name: "CodeQL Security Scan"

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]  # #5104: a draft starts only the cheap audits
    branches: [main]
    # #5132: on a PR only when engine code, a dependency pin or a workflow changes; the schedule below is the backstop
    # for everything else (tests, docs, site, corpora).
    paths:
      - "gitgalaxy/**"
      - ".github/**"
      - "pyproject.toml"
      - "ci/requirements/**"
      - "templates/requirements/**"
      - "requirements*.txt"
      - "action.yml"
  schedule:
    - cron: '0 12 * * 1'

permissions:
  contents: read

concurrency:
  # One run per workflow per PR (or per ref outside a PR). Without this, a PR
  # that picks up several labels in one `gh pr create` starts a separate,
  # IDENTICAL run per label event on the same SHA (measured 2026-09-09: four
  # Full Suite Gate runs and five rosetta-audit runs for one commit), and a
  # re-push leaves the superseded run occupying the queue. cancel-in-progress
  # is scoped to pull_request on purpose -- the push/schedule/tag runs are the
  # ones that commit (docs, history charts, releases), and cancelling one
  # mid-write is how you get a half-written commit.
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  analyze:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}  # #5104: draft PRs skip heavy CI
    name: Analyze
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: ['python']

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
        with:
          languages: ${{ matrix.language }}
          queries: security-extended,security-and-quality

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
        with:
          category: "/language:${{matrix.language}}"