codeql.yml

# SPDX-License-Identifier: MPL-2.0
# Thin wrapper around hyperpolymath/standards codeql-reusable.yml.
# Matches the echidna sibling-repo pattern (estate-wide consolidation:
# 263 deployments, 69 unique SHAs, 26% structural drift). Default
# language is javascript-typescript (84.8% of estate); the reusable is
# single-language / single-job by design — multi-language wrappers
# call the reusable once per language. echidnabot is JS/TS today, so
# the default suffices.
name: CodeQL Security Analysis
on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC

# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
# updates do not pile up queued runs against the shared account-wide
# Actions concurrency pool. Safe — read-only scan, no mutation.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  contents: read
jobs:
  analyze:
    permissions:
      contents: read
      security-events: write
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 # main as of 2026-06-01
    secrets: inherit