From cd5217bfec898b056b7c70a56b402290883540ea Mon Sep 17 00:00:00 2001
From: lcampbell2 <l.campbell144768@gmail.com>
Date: Tue, 14 Apr 2026 12:03:03 -0300
Subject: [PATCH 1/2] create separate codeql analysis job for PRs

---
 .github/workflows/codeql-analysis.yml | 40 +++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index ba0cb3a5cb..2b44437ed3 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -3,6 +3,8 @@ name: "CodeQL"
 on:
   push:
     branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
   schedule:
     # Run every Tuesday at 00:00 UTC
     - cron: "0 0 * * 2"
@@ -17,6 +19,7 @@ jobs:
     name: Analyze
     runs-on: ubuntu-latest
     timeout-minutes: 60
+    if: github.event_name != 'pull_request'
 
     permissions:
       security-events: write
@@ -48,3 +51,40 @@ jobs:
         uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{ matrix.language }}"
+
+  analyze-pr:
+    name: Analyze
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    if: github.event_name == 'pull_request'
+
+    permissions:
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: javascript-typescript
+            build-mode: none
+          - language: python
+            build-mode: none
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"
+          upload: false

From 2db927f3c89eb41dc7a8603e7bbd43ca6b0bd1e0 Mon Sep 17 00:00:00 2001
From: lcampbell2 <l.campbell144768@gmail.com>
Date: Tue, 14 Apr 2026 12:35:27 -0300
Subject: [PATCH 2/2] collapse into one job

---
 .github/workflows/codeql-analysis.yml | 72 ++++++---------------------
 1 file changed, 16 insertions(+), 56 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 2b44437ed3..055093577d 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -1,77 +1,36 @@
-name: "CodeQL"
+name: CodeQL Analysis
 
 on:
   push:
-    branches: [ "master" ]
+    branches: ["master"]
   pull_request:
-    branches: [ "master" ]
+    branches: ["master"]
   schedule:
     # Run every Tuesday at 00:00 UTC
     - cron: "0 0 * * 2"
-  workflow_dispatch:
 
 concurrency:
   group: codeql-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  security-events: write
+  actions: read
+  contents: read
+
 jobs:
   analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    if: github.event_name != 'pull_request'
-
-    permissions:
-      security-events: write
-      actions: read
-      contents: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-            build-mode: none
-          - language: javascript-typescript
-            build-mode: none
-          - language: python
-            build-mode: none
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
-        with:
-          category: "/language:${{ matrix.language }}"
-
-  analyze-pr:
-    name: Analyze
+    name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     timeout-minutes: 60
-    if: github.event_name == 'pull_request'
-
-    permissions:
-      actions: read
-      contents: read
 
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - language: actions
-            build-mode: none
-          - language: javascript-typescript
-            build-mode: none
-          - language: python
-            build-mode: none
+        language:
+          - javascript-typescript
+          - python
+          - actions
 
     steps:
       - name: Checkout repository
@@ -81,10 +40,11 @@ jobs:
         uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
+          # Built-in query suites: security-extended includes more rules than
+          # the default suite and is recommended for security-focused scanning.
+          queries: security-extended
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{ matrix.language }}"
-          upload: false