codeql.yml

name: CodeQL

on:
  push:
    branches:
      - main
    paths:
      - "deploy/local-gateway/**"
      - ".github/workflows/**"
  # Code-scanning merge protection requires fresh analysis on every PR.
  # Do not path-filter pull requests or dependency-only/config PRs can be blocked
  # waiting for a CodeQL result that was never scheduled.
  pull_request:
    branches:
      - main
  schedule:
    - cron: "29 4 * * 1"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  actions: read
  contents: read
  packages: read
  security-events: write

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    if: >-
      github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: actions
            build-mode: none
          - language: javascript-typescript
            build-mode: none

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          config: |
            queries:
              - uses: security-and-quality
            # This repository intentionally reads the PAT from runtime tmpfs and
            # forwards it over HTTP only to the private github-mcp Docker service.
            # Keep all other security-and-quality queries enabled.
            query-filters:
              - exclude:
                  id: js/file-access-to-http

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
        with:
          category: /language:${{ matrix.language }}