codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  schedule:
    - cron: "0 14 * * 3"

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  codeql:
    permissions:
      security-events: write
      contents: read
      actions: read
    # WHY @main, not a pinned SHA: forkwright/.github publishes no tags, so a
    # SHA pin here has no dependabot bump path and just freezes. forkwright/
    # .github is first-party -- same org, same trust boundary -- not the
    # third-party supply-chain case a SHA pin defends against.
    uses: forkwright/.github/.github/workflows/codeql.yml@main
    with:
      analyze_actions: true
      analyze_rust: true
      rust_toolchain: "nightly"