codeql.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: CodeQL

on:
  # Release branch only: a push to dev always has a pull request open on it, and
  # that PR run scans the same tree.
  push:
    branches: [main]
  pull_request:
    branches: [main, dev]
    # Required once dev leaves the push trigger — a draft PR would otherwise
    # analyse once and never again, and the code-scanning result never arrives.
    types: [opened, synchronize, reopened, ready_for_review]
  schedule:
    - cron: '34 23 * * 0'
  workflow_dispatch:

jobs:
  codeql:
    name: CodeQL
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read
    uses: kirchDev/workflows/.github/workflows/_codeql.yml@94cbcbd676b989ac6c6327055a240132f5cd76a5 # v0.8.0