codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "0 6 * * 1"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # * 코드 변경 감지 — docs-only PR 은 analyze job 을 if-skip (status: success).
  #   schedule 트리거 (주 1회 cron) 은 코드 변경 무관하게 항상 분석.
  changes:
    name: Detect code changes
    runs-on: ubuntu-latest
    outputs:
      code: ${{ steps.filter.outputs.code }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - id: filter
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
        run: |
          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then
            echo "code=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          # ^ three-dot: 공통 조상부터의 변경만 (PR diff 와 동일)
          if git diff --name-only "$BASE_SHA"...HEAD \
              | grep -qvE '(^|/)([^/]+\.md|LICENSE[^/]*|\.gitignore)$|^docs/'; then
            echo "code=true" >> "$GITHUB_OUTPUT"
          else
            echo "code=false" >> "$GITHUB_OUTPUT"
          fi

  analyze:
    name: Analyze
    needs: changes
    if: github.event_name == 'schedule' || needs.changes.outputs.code == 'true'
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: python
          config-file: .github/codeql-config.yml

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4