ci(guards): run every guard the job names, and compile docs-only pull requests #1095

	name: CodeQL

	on:
	push:
	branches:
	- main
	- develop
	pull_request:
	# Run on any incoming PR regardless of the base branch so feature
	# branches targeting `develop` also get analysed.
	workflow_dispatch:
	schedule:
	- cron: '32 6 * * 1'

	permissions:
	contents: read

	jobs:
	analyze:
	name: CodeQL — ${{ matrix.language }}
	runs-on: ubuntu-latest
	timeout-minutes: 30
	permissions:
	actions: read
	contents: read
	security-events: write
	env:
	JAVA_TOOL_OPTIONS: -Djava.awt.headless=true

	strategy:
	fail-fast: false
	matrix:
	language:
	- java-kotlin

	steps:
	- name: Check out repository
	uses: actions/checkout@v7

	- name: Set up Temurin JDK 17
	uses: actions/setup-java@v5
	with:
	distribution: temurin
	java-version: '17'
	cache: maven

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v4
	with:
	languages: ${{ matrix.language }}
	queries: security-and-quality

	- name: Build (engine module)
	# Scoped to the engine module alone: no `-am`, so nothing but core is built
	# and nothing but core reaches the extractor. Since the 2.0 split
	# graph-compose-core is one of several artifacts published to Maven Central,
	# which makes this narrower than both the publish train and the canonical
	# verify gate in ci.yml — the render backends and templates ship unscanned.
	# Widening it to the code-bearing published modules is tracked for 2.2,
	# together with a triage pass on the standing alert set.
	run: ./mvnw -B -ntp -DskipTests -pl :graph-compose-core package

	- name: Perform CodeQL analysis
	uses: github/codeql-action/analyze@v4
	with:
	category: "/language:${{ matrix.language }}"

Provide feedback