From c6cce7d51003b7ae280edfb96683998969219169 Mon Sep 17 00:00:00 2001
From: Renn F <rennf93@users.noreply.github.com>
Date: Wed, 21 Oct 2026 01:13:44 +0200
Subject: [PATCH] ci(codeql): scan the workflows and every language in one
 code-ql job

---
 .github/workflows/code-ql.yml | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml
index 68393ac..ab35d1d 100644
--- a/.github/workflows/code-ql.yml
+++ b/.github/workflows/code-ql.yml
@@ -2,7 +2,9 @@ name: CodeQL
 
 on:
   push:
+    branches: [master]
   pull_request:
+    branches: [master]
   schedule:
     - cron: '0 5 * * 1'
   workflow_dispatch:
@@ -10,13 +12,16 @@ on:
 permissions: {}
 
 jobs:
-  analyze:
-    name: Analyze (go)
+  # One job for every language, so the required check context is exactly `code-ql` (a matrix would suffix it
+  # with the language).
+  code-ql:
+    name: code-ql
     runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
       security-events: write
+
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -26,10 +31,13 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
-          languages: go
+          languages: go,actions
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        with:
+          # The category of the earlier `analyze` job, so the existing analyses and alerts carry over.
+          category: .github/workflows/code-ql.yml:analyze