codeql.yml

name: CodeQL

# Static security + quality analysis (SAST) for the C# codebase.
# Enterprise baseline: scan on every push/PR to main and on a weekly cron so newly
# disclosed query-pack rules catch regressions even when the code is quiet.
on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  schedule:
    # Mondays 03:17 UTC — odd minute to dodge the top-of-hour Actions congestion.
    - cron: '17 3 * * 1'

# Cancel a superseded in-flight scan when new commits land on the same ref.
concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze (csharp)
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      actions: read
      contents: read
      security-events: write   # required to upload SARIF to the Security tab

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      # Buildless (build-mode: none): the C# extractor reads source directly instead of compiling,
      # so it never extracts the source-generator output under obj/ — and paths-ignore in the config
      # then genuinely excludes generated code. It also sidesteps autobuild's lack of .slnx support,
      # so no Restore/Build steps (or .NET SDK setup) are needed here.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: csharp
          build-mode: none
          # Full pack (security + maintainability) lives in the config file, which also excludes
          # generated build output (obj/bin) so the scan only flags hand-fixable source.
          config-file: ./.github/codeql/codeql-config.yml

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:csharp"