codeql.yml

name: codeql

# Static analysis on every push/PR + a weekly Monday cron so new CodeQL
# rules + new advisories surface on the security tab even when the
# branch is quiet. Manual trigger via `gh workflow run codeql.yml` for
# ad-hoc re-runs (handy when bumping the codeql-action major version).
#
# Skipped while the repo is private - CodeQL is gated behind GitHub
# Advanced Security for private repos, but free on public ones. The
# `if: github.event.repository.private == false` guard on the job
# below makes the workflow a no-op until the repo flips public.
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # 04:23 UTC every Monday. Off-peak hour to avoid the top-of-hour
    # cron rush, and Monday so a Tuesday-morning glance at the security
    # tab catches anything new from the weekend.
    - cron: "23 4 * * 1"
  workflow_dispatch:

permissions:
  security-events: write
  actions: read
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: analyze (${{ matrix.language }})
    # Gate: skip on private repos (where CodeQL would 403 without GHAS).
    # Becomes a no-op until the repo is made public.
    if: ${{ github.event.repository.private == false }}
    runs-on: windows-2022
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        language: [rust]

    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2

      - name: init codeql
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}

      # CodeQL's Rust extractor watches `cargo build`. Default profile is
      # fine: clippy/security queries don't need optimised codegen.
      - name: build
        run: cargo build

      - name: analyze
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"