codeql.yml

# SPDX-License-Identifier: MPL-2.0
# CodeQL disabled - no scannable source code detected
name: CodeQL Security Analysis

on:
  workflow_dispatch:  # Manual trigger only

# Least-privilege permissions: satisfies the workflow-linter's top-level
# `permissions:` requirement AND SonarQube githubactions:S8234, which flags
# the broad `read-all`. This workflow's only job is a disabled placeholder,
# so read access to repository contents is more than sufficient.
permissions:
  contents: read

# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
# updates do not pile up queued runs against the shared account-wide
# Actions concurrency pool. Applied only to read-only check workflows
# (no publish/mutation), so cancelling a superseded run is always safe.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true


jobs:
  placeholder:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: false
    steps:
      - run: echo "Enable when source code is added"