codeql.yml

---
name: CodeQL

# Disabled by default. Only `workflow_dispatch` is left as a trigger, so it
# runs only when someone starts it by hand; the automatic triggers below are
# commented out.
#
# SonarQube Cloud (sonarqube.yml) is the default code scanner for this
# organization's public repositories, as Renovate is the default dependency
# bot. A repository created from this template that is private, or that
# belongs to a private organization, may be better served by CodeQL (and by
# Dependabot): to switch, restore the commented `push` and `schedule`
# triggers below, and follow the note at the top of
# .github/dependabot.yml. Code scanning on a private or internal repository
# needs GitHub Code Security enabled, or the upload step fails. The
# dispatch trigger stays even while disabled because a workflow with no
# `on:` at all is invalid, and GitHub reports it as a failed run.
#
# CodeQL security analysis of this repository's GitHub Actions workflows.
#
# Actions only, and it is worth being clear how small that scope is. CodeQL
# supports JavaScript/TypeScript, Ruby, Python, Go, Java/Kotlin, C/C++, C# and
# GitHub Actions. It does not support shell, Dockerfile, Makefile or plain
# YAML, which is most of the rest of what this repository ships. Those are
# covered on every commit by the hooks in .pre-commit-config.yaml instead.
# What CodeQL adds is the workflows under .github/workflows/.
#
# This analyzed Python until the pipeline scripts moved to
# ivan-pinatti-labs/gh-actions, which left the repository with no Python at
# all. A CodeQL language with no source does not pass empty, it fails the run
# outright ("CodeQL could not process any code written in Python"), so the
# language has to move in the same pull request as the scripts rather than
# after them.
#
# No `pull_request:` trigger. Code scanning derives alert lineage from
# default-branch analyses, and this adds nothing a reviewer acts on inside a
# pull request, so a weekly schedule plus the merge to main keeps the Security
# tab current once enabled. workflow_dispatch is there for a manual run.
on:
  # push:
  #   branches: [main]
  # schedule:
  #   # Staggered across the organization's repositories so their CodeQL runs
  #   # do not all contend for a runner at the same minute.
  #   - cron: "0 10 * * 1"
  workflow_dispatch: {}

permissions: {}

jobs:
  analyze:
    name: Analyze Actions
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      # The SARIF upload below attaches to this repository's code scanning tab.
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          languages: actions
          # 'security-extended' rather than the default suite: it keeps the
          # lower-severity and higher-false-positive security queries the
          # default omits, which is worth it over a tooling directory this
          # small. Quality queries are deliberately not run here.
          queries: security-extended

      - name: Analyze
        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          # A distinct category keeps this analysis's alert lineage separate
          # from any image or dependency scanner reporting into the same tab.
          category: codeql-actions