codeql.yml

name: codeql

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly, so a newly published query catches an old vulnerability that was
    # not a finding on the day the code merged. Scanning only on change would
    # never re-examine code that has stopped being touched.
    - cron: '27 4 * * 1'

permissions:
  contents: read

jobs:
  analyze:
    name: analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    # No visibility guard here, deliberately. A job-level `if:` is evaluated
    # before the matrix expands, so a skipped run reports a single check under
    # the raw template name — `analyze (${{ matrix.language }})` — rather than
    # the two expanded names. That phantom name reached the `Protect main branch`
    # ruleset as a required check (GitHub's suggestion list offers whatever was
    # last reported), and once this repository went public and the job began
    # reporting the real names instead, nothing was left to satisfy the phantom:
    # every pull request stalled on "Expected — waiting for status to be
    # reported", unmergeable, with no failing job to point at.
    #
    # Code scanning is free while this repository is public. If it ever goes
    # private without GitHub Advanced Security, drop these contexts from the
    # ruleset — do not reintroduce an `if:` here.
    permissions:
      # Required to upload results to the code-scanning API.
      security-events: write
      contents: read
      actions: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: java-kotlin
          - language: javascript-typescript
    steps:
      - uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          # `none` extracts from source instead of observing a compiler. Chosen
          # deliberately for the Java half: an autobuild would have to reproduce
          # the JDK 25 toolchain and full Maven dependency resolution, so it
          # fails for build reasons far more often than it finds a vulnerability.
          # The JavaScript half never has a build mode.
          build-mode: none

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:${{ matrix.language }}