codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "30 4 * * 1" # weekly Monday 04:30 UTC

permissions:
  contents: read
  security-events: write

jobs:
  analyze:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        language: [python, javascript-typescript]
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4.38.1
        with:
          languages: ${{ matrix.language }}
          queries: security-and-quality
          config-file: ./.github/codeql/codeql-config.yml

      - name: Analyze
        uses: github/codeql-action/analyze@v4.38.1
        with:
          category: "/language:${{ matrix.language }}"

  # ── Stable required-check aggregate (issue #317 / ER-SDLC-001) ──────────
  # See test.yml's backend-required-gate comment for why this exists: GitHub
  # rulesets reject a "workflows" rule pinning individual job contexts
  # (HTTP 422), so this is the one stable context required_status_checks
  # should target for this workflow. `needs: [analyze]` already waits for
  # every matrix leg (python, javascript-typescript) to conclude.
  codeql-required-gate:
    name: codeql-required-gate
    runs-on: ubuntu-latest
    if: always()
    needs: [analyze]
    steps:
      - name: Require every CodeQL analysis leg to have succeeded
        env:
          NEEDS_CONTEXT: ${{ toJSON(needs) }}
        run: |
          python3 - <<'PY'
          import json
          import os
          import sys

          results = json.loads(os.environ["NEEDS_CONTEXT"])
          failed = {name: info["result"] for name, info in results.items() if info["result"] != "success"}
          if failed:
              print(f"::error::Required CodeQL job(s) did not succeed: {failed}")
              sys.exit(1)
          print(f"All required CodeQL jobs succeeded: {sorted(results)}")
          PY