codeql.yml

name: CodeQL

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]
  schedule:
    - cron: '0 6 * * 1'

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  detect:
    runs-on: ubuntu-latest
    outputs:
      has_python: ${{ steps.check.outputs.has_python }}
      has_js: ${{ steps.check.outputs.has_js }}
    steps:
      - uses: actions/checkout@v6
      - id: check
        run: |
          [ -f pyproject.toml ] && echo "has_python=true" >> $GITHUB_OUTPUT || echo "has_python=false" >> $GITHUB_OUTPUT
          [ -f frontend/package.json ] && echo "has_js=true" >> $GITHUB_OUTPUT || echo "has_js=false" >> $GITHUB_OUTPUT

  analyze:
    needs: detect
    if: needs.detect.outputs.has_python == 'true' || needs.detect.outputs.has_js == 'true'
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language: [python, javascript-typescript]
    steps:
      - id: gate
        run: |
          skip=false
          if [[ "${{ matrix.language }}" == "python" && "${{ needs.detect.outputs.has_python }}" != "true" ]]; then
            skip=true
          fi
          if [[ "${{ matrix.language }}" == "javascript-typescript" && "${{ needs.detect.outputs.has_js }}" != "true" ]]; then
            skip=true
          fi
          echo "skip=$skip" >> $GITHUB_OUTPUT
      - uses: actions/checkout@v6
        if: steps.gate.outputs.skip != 'true'
      - uses: github/codeql-action/init@v4
        if: steps.gate.outputs.skip != 'true'
        with:
          languages: ${{ matrix.language }}
          queries: security-and-quality
      - uses: github/codeql-action/autobuild@v4
        if: steps.gate.outputs.skip != 'true'
      - uses: github/codeql-action/analyze@v4
        if: steps.gate.outputs.skip != 'true'
        with:
          category: /language:${{ matrix.language }}