From 30eee1049f115873710938a18e12f72e382ac51c Mon Sep 17 00:00:00 2001
From: Trask Stalnaker <trask.stalnaker@gmail.com>
Date: Tue, 10 Jun 2025 12:59:37 -0700
Subject: [PATCH] Run CodeQL on PRs

---
 .github/workflows/codeql-daily.yml | 48 --------------------
 .github/workflows/codeql.yml       | 73 ++++++++++++++++++++++++++++++
 2 files changed, 73 insertions(+), 48 deletions(-)
 delete mode 100644 .github/workflows/codeql-daily.yml
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql-daily.yml b/.github/workflows/codeql-daily.yml
deleted file mode 100644
index e66728407..000000000
--- a/.github/workflows/codeql-daily.yml
+++ /dev/null
@@ -1,48 +0,0 @@
-name: CodeQL (daily)
-
-on:
-  schedule:
-    # Daily at 01:30 (UTC)
-    - cron: '30 1 * * *'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  analyze:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Set up Java 17
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
-        with:
-          languages: java
-          # using "latest" helps to keep up with the latest Kotlin support
-          # see https://github.com/github/codeql-action/issues/1555#issuecomment-1452228433
-          tools: latest
-
-      - name: Set up gradle
-        uses: gradle/actions/setup-gradle@8379f6a1328ee0e06e2bb424dadb7b159856a326 # v4.4.0
-      - name: Assemble
-        # skipping build cache is needed so that all modules will be analyzed
-        run: ./gradlew assemble --no-build-cache
-
-      - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
-
-  workflow-notification:
-    needs:
-      - analyze
-    if: always()
-    uses: ./.github/workflows/reusable-workflow-notification.yml
-    with:
-      success: ${{ needs.analyze.result == 'success' }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 000000000..4a7aa57c1
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,73 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "07 04 * * 4"  # weekly at 04:07 UTC on Thursday
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    permissions:
+      contents: read
+      actions: read  # for github/codeql-action/init to get workflow details
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+          - language: java
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Java 17
+        if: matrix.language == 'java'
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Set up gradle
+        if: matrix.language == 'java'
+        uses: gradle/actions/setup-gradle@8379f6a1328ee0e06e2bb424dadb7b159856a326 # v4.4.0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
+        with:
+          languages: ${{ matrix.language }}
+          # using "latest" helps to keep up with the latest Kotlin support
+          # see https://github.com/github/codeql-action/issues/1555#issuecomment-1452228433
+          tools: latest
+
+      - name: Assemble
+        if: matrix.language == 'java'
+        # --no-build-cache is required for codeql to analyze all modules
+        # --no-daemon is required for codeql to observe the compilation
+        # (see https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli/preparing-your-code-for-codeql-analysis#specifying-build-commands)
+        run: ./gradlew assemble --no-build-cache --no-daemon
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
+        with:
+          category: "/language:${{matrix.language}}"
+
+  workflow-notification:
+    permissions:
+      contents: read
+      issues: write
+    needs:
+      - analyze
+    if: always()
+    uses: ./.github/workflows/reusable-workflow-notification.yml
+    with:
+      success: ${{ needs.analyze.result == 'success' }}