codeql.yml

name: CodeQL

# Triggers `pull_request` for PR checks, `push` to master for baseline analysis,
# `merge_group` so PRs in the merge queue have their pre-merge runs reported,
# and `schedule` for the weekly baseline that GitHub default-setup used to do.

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  merge_group:
  schedule:
    - cron: "0 6 * * 1"

permissions:
  actions: read
  contents: read
  security-events: write

jobs:
  Analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        language: [actions, java-kotlin]
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive

      # Use `build-mode: none` for `java-kotlin` (added in CodeQL 2.16.5,
      # March 2024). With `none`, the Java extractor scans source files
      # directly instead of tracing a Maven/Ant build — which means the
      # `paths-ignore` directive in `codeql-config-java-kotlin.yml` actually
      # filters submodule paths (`IDE/`, `jython3/`) from the analysis. With
      # the previous build-trace mode, `paths-ignore` translated to
      # `LGTM_INDEX_FILTERS` but the Java extractor traced everything that
      # got compiled by the Maven build (including submodules), so submodule
      # alerts persisted regardless. See wala/ML#476.
      #
      # `build-mode: none` removes the need for `actions/setup-java`, the
      # `Install Jython3` ant build, the `Install IDE` Maven install, and the
      # `Build with Maven` step — none of those are needed when CodeQL works
      # straight from sources. Builds for the other CI gates (regular
      # `mvn test`, etc.) still happen in `continuous-integration.yml` — this
      # change only affects the CodeQL job.
      - uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.language == 'java-kotlin' && 'none' || '' }}
          config-file: ./.github/codeql/codeql-config-${{ matrix.language }}.yml

      - uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"