From 64358a6128aa0c064065885ccc209737ceb92a5a Mon Sep 17 00:00:00 2001
From: Renn F <rennf93@users.noreply.github.com>
Date: Wed, 21 Oct 2026 01:11:12 +0200
Subject: [PATCH] ci(codeql): scan the workflows and every language in one
 code-ql job

---
 .github/workflows/code-ql.yml | 39 ++++++++++-------------------------
 1 file changed, 11 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml
index c63b269..f9030ff 100644
--- a/.github/workflows/code-ql.yml
+++ b/.github/workflows/code-ql.yml
@@ -3,53 +3,36 @@ name: CodeQL
 on:
   push:
     branches: [master]
-    paths:
-      - 'compose.yml'
-      - 'data/**'
-      - 'Dockerfile'
-      - 'examples/**'
-      - 'flaskapi_guard/**'
-      - '.pre-commit-config.yaml'
-      - 'pyproject.toml'
-      - 'tests/**'
   pull_request:
     branches: [master]
-    paths:
-      - 'compose.yml'
-      - 'data/**'
-      - 'Dockerfile'
-      - 'examples/**'
-      - 'flaskapi_guard/**'
-      - '.pre-commit-config.yaml'
-      - 'pyproject.toml'
-      - 'tests/**'
   schedule:
     - cron: '0 0 * * 1'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
-  analyze:
-    name: Analyze
+  # One job for every language, so the required check context is exactly `code-ql` (a matrix would suffix it
+  # with the language).
+  code-ql:
+    name: code-ql
     runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
       security-events: write
 
-    strategy:
-      matrix:
-        language: [python]
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:
-          languages: ${{ matrix.language }}
-
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+          languages: python,actions
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4
+        with:
+          # The category of the earlier `analyze` job, so the existing analyses and alerts carry over.
+          category: .github/workflows/code-ql.yml:analyze/language:python