codeql-analysis.yml

# Copyright (c) 2026 Microsoft Corporation. All rights reserved.
# SPDX-License-Identifier: MIT
name: CodeQL Security Analysis

on:
  schedule:
    # Weekly scan: Sundays at 4 AM UTC
    - cron: '0 4 * * 0'
  workflow_call:

permissions:
  contents: read

jobs:
  analyze:
    name: CodeQL Analysis
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write  # Required for SARIF upload to Security tab
      actions: read
    
    strategy:
      fail-fast: false
      matrix:
        # Repository contains GitHub Actions workflows, Python, and JavaScript/TypeScript (VS Code extension source)
        # CodeQL 'actions' scans workflows, 'python' scans scripts, and 'javascript-typescript' covers both JS and TS
        # PowerShell and shell scripts are not CodeQL-supported (covered by PSScriptAnalyzer and shellcheck)
        language: [ 'actions', 'python', 'javascript-typescript' ]
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0
        with:
          languages: ${{ matrix.language }}
          queries: security-extended,security-and-quality

      - name: Autobuild
        uses: github/codeql-action/autobuild@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0
        with:
          category: "/language:${{ matrix.language }}"

      - name: Add job summary
        if: always()
        run: |
          {
            echo "## CodeQL Security Analysis Complete"
            echo "**Language:** ${{ matrix.language }}"
            echo "**Queries:** security-extended, security-and-quality"
            echo ""
            echo "📊 View results in the Security tab under Code Scanning"
          } >> "$GITHUB_STEP_SUMMARY"