name: "CodeQL action"

on:
  push:
    branches: [main, releases/v*]
  pull_request:
  merge_group:
    types: [checks_requested]
  schedule:
    # Weekly on Sunday.
    - cron: "30 1 * * 0"
  workflow_dispatch:

defaults:
  run:
    shell: bash

env:
  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks

jobs:
  analyze:
    if: github.triggering_actor != 'dependabot[bot]'
    runs-on: ubuntu-26.04

    strategy:
      fail-fast: false
      matrix:
        language:
          - actions
          - javascript

    permissions:
      contents: read
      security-events: write

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Initialize CodeQL
        uses: ./init
        id: init
        with:
          languages: ${{ matrix.language }}
          build-mode: none
          config-file: ./.github/codeql/codeql-config-${{ matrix.language }}.yml
      # confirm steps.init.outputs.codeql-path points to the codeql binary
      - name: Print CodeQL Version
        run: >
          "$CODEQL" version --format=json
        env:
          CODEQL: ${{steps.init.outputs.codeql-path}}
      - name: Perform CodeQL Analysis
        uses: ./analyze
        with:
          category: "/language:${{ matrix.language }}"
          upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}