name: "CodeQL Advanced"

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  schedule:
    - cron: "29 8 * * 6"
  workflow_dispatch:

# Default to least privilege. Override per-job where needed.
# cancel superseded in-flight runs for the same PR to free hosted-runner
# capacity. only cancels pull_request runs; push runs on protected branches
# (main/develop) are never cancelled mid-flight.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    # WHY: whole-repo JS CodeQL can exhaust GitHub-hosted disk during the
    # PolynomialReDoS dataflow query. Trusted events use the larger robot fleet;
    # pull_request stays GitHub-hosted so forked code never runs on self-hosted.
    runs-on: ${{ fromJSON(github.event_name == 'pull_request' && '["ubuntu-latest"]' || '["self-hosted","Linux","X64","hetzner-robot"]') }}
    timeout-minutes: 360
    permissions:
      # required for all workflows
      security-events: write

      # required to fetch internal or private CodeQL packs
      packages: read

      # only required for workflows in private repositories
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: javascript-typescript
            build-mode: none
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

      - name: Report disk before CodeQL
        shell: bash
        run: |
          df -h
          du -sh "$GITHUB_WORKSPACE" 2>/dev/null || true

      - name: Free GitHub-hosted runner disk
        if: runner.environment == 'github-hosted'
        shell: bash
        run: |
          # WHY: this preserves the full CodeQL query suite while giving the
          # hosted fallback enough headroom for CodeQL's temporary databases.
          sudo rm -rf \
            /usr/local/lib/android \
            /usr/share/dotnet \
            /opt/ghc \
            /opt/hostedtoolcache/go \
            /opt/hostedtoolcache/Python \
            /opt/hostedtoolcache/Ruby || true
          df -h

      - name: Initialize CodeQL
        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          config-file: ./.github/codeql/codeql-config.yml
          # WHY: the paths-ignore config shrinks the JS/TS database ~36x (~107MB), so
          # the memory pressure behind exit-137 is resolved at the source. threads can
          # return toward the machine's 12-core capacity for fast analysis (holding the
          # robot briefly instead of ~1h); ram stays a generous ceiling (~120GB of the
          # 244GB box) purely as a safety net against an unmeasured pathological query.
          ram: 120000
          threads: 8

      - if: matrix.build-mode == 'manual'
        shell: bash
        run: |
          echo 'If you are using a "manual" build mode for one or more of the' \
            'languages you are analyzing, replace this with the commands to build' \
            'your code, for example:'
          echo '  make basic-capabilities'
          echo '  make release'
          exit 1

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9
        with:
          category: "/language:${{matrix.language}}"