codeql.yml

name: CodeQL

on:
  push:
    branches:
      - main
      - develop
  pull_request:
    # Run on any incoming PR regardless of the base branch so feature
    # branches targeting `develop` also get analysed.
  workflow_dispatch:
  schedule:
    - cron: '32 6 * * 1'

permissions:
  contents: read

jobs:
  analyze:
    name: CodeQL — ${{ matrix.language }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      actions: read
      contents: read
      security-events: write
    env:
      JAVA_TOOL_OPTIONS: -Djava.awt.headless=true

    strategy:
      fail-fast: false
      matrix:
        language:
          - java-kotlin

    steps:
      - name: Check out repository
        uses: actions/checkout@v7

      - name: Set up Temurin JDK 17
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '17'
          cache: maven

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          queries: security-and-quality

      - name: Build (engine module)
        # Scoped to the engine module alone: no `-am`, so nothing but core is built
        # and nothing but core reaches the extractor. Since the 2.0 split
        # graph-compose-core is one of several artifacts published to Maven Central,
        # which makes this narrower than both the publish train and the canonical
        # verify gate in ci.yml — the render backends and templates ship unscanned.
        # Widening it to the code-bearing published modules is tracked for 2.2,
        # together with a triage pass on the standing alert set.
        run: ./mvnw -B -ntp -DskipTests -pl :graph-compose-core package

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"