codeql.yml

name: "CodeQL"

on:
  push:
    branches: [ "main" ]     # Trigger the workflow on pushes to the main branch
  pull_request:
    branches: [ "main" ]     # Trigger the workflow on pull requests to the main branch

jobs:
  analyze:
    name: Analyze
    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}  # Run the job on macOS-latest if the language is Swift, otherwise on ubuntu-latest
    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}  # Set a shorter timeout for Swift and a longer timeout for other languages
    permissions:
      security-events: write  # Set security events permission to write

      actions: read           # Set actions permission to read
      contents: read          # Set contents permission to read

    strategy:
      fail-fast: false       # Do not fail the workflow immediately if one matrix job fails
      matrix:
        language: [ 'javascript-typescript', 'python' ]  # Define matrix jobs for JavaScript/TypeScript and Python

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4   # Checkout the repository at version 4 of the actions/checkout action

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3   # Initialize CodeQL analysis for the specified languages in the matrix

      with:
        languages: ${{ matrix.language }}  # Use the specified language from the matrix

    - name: Autobuild
      uses: github/codeql-action/autobuild@v3  # Automatically build the CodeQL database for analysis

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3   # Perform CodeQL analysis

      with:
        category: "/language:${{matrix.language}}"  # Specify the category for analysis based on the matrix language