codeql.yml

# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# Thin wrapper around metadatastician/standards codeql-reusable.yml.
# Matches the echidna sibling-repo pattern (estate-wide consolidation:
# 263 deployments, 69 unique SHAs, 26% structural drift). Default
# language is javascript-typescript (84.8% of estate); the reusable is
# single-language / single-job by design — multi-language wrappers
# call the reusable once per language. echidnabot is a Rust crate with no
# JavaScript or TypeScript file, so this caller passes `language: rust`.
# A second job scans the workflow files (`language: actions`).
name: CodeQL Security Analysis
on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC

# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
# updates do not pile up queued runs against the shared account-wide
# Actions concurrency pool. Safe — read-only scan, no mutation.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  contents: read
jobs:
  analyze:
    permissions:
      actions: read
      contents: read
      security-events: write
    uses: metadatastician/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01
    with:
      language: rust
  analyze-actions:
    permissions:
      actions: read
      contents: read
      security-events: write
    uses: metadatastician/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7
    with:
      language: actions