From a6827a39dec02dbb97adcc9fabd86aab02b0823a Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Mon, 9 Nov 2026 18:24:06 +0000
Subject: [PATCH] Merge `analyze-javascript` and `analyze-other` into one
 matrixed job

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/codeql/codeql-config-actions.yml |  5 +++
 .github/workflows/codeql.yml             | 48 ++++++------------------
 2 files changed, 16 insertions(+), 37 deletions(-)
 create mode 100644 .github/codeql/codeql-config-actions.yml

diff --git a/.github/codeql/codeql-config-actions.yml b/.github/codeql/codeql-config-actions.yml
new file mode 100644
index 000000000..dda7a42c1
--- /dev/null
+++ b/.github/codeql/codeql-config-actions.yml
@@ -0,0 +1,5 @@
+paths-ignore:
+  - lib
+  - tests
+queries:
+  - uses: security-and-quality
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 73045aedb..86741ec45 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,10 +19,17 @@ env:
   CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
 
 jobs:
-  analyze-javascript:
+  analyze:
     if: github.triggering_actor != 'dependabot[bot]'
     runs-on: ubuntu-26.04
 
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - actions
+          - javascript
+
     permissions:
       contents: read
       security-events: write
@@ -34,48 +41,15 @@ jobs:
         uses: ./init
         id: init
         with:
-          languages: javascript
-          config-file: ./.github/codeql/codeql-config-javascript.yml
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config-file: ./.github/codeql/codeql-config-${{ matrix.language }}.yml
       # confirm steps.init.outputs.codeql-path points to the codeql binary
       - name: Print CodeQL Version
         run: >
           "$CODEQL" version --format=json
         env:
           CODEQL: ${{steps.init.outputs.codeql-path}}
-      - name: Perform CodeQL Analysis
-        uses: ./analyze
-        with:
-          category: "/language:javascript"
-          upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}
-
-  analyze-other:
-    if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-26.04
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-
-    permissions:
-      contents: read
-      security-events: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Initialize CodeQL
-        uses: ./init
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: none
-          config: >
-            paths-ignore:
-              - lib
-              - tests
-            queries:
-              - uses: security-and-quality
       - name: Perform CodeQL Analysis
         uses: ./analyze
         with: