From 19183926739c37eaed56fc16e2b4626f35557349 Mon Sep 17 00:00:00 2001
From: crynta <3nnigma.dev@gmail.com>
Date: Thu, 8 Oct 2026 18:26:51 +0200
Subject: [PATCH] ci: run the Rust CodeQL analysis weekly with room to finish

The first run after merging showed Actions and JavaScript/TypeScript
finishing in about two minutes and Rust on macOS and Windows hitting the
60-minute job limit. Rust now runs weekly and on demand with a 180-minute
limit and no cancellation by a newer run, while the fast languages keep
running after merges to main. Results in the vendored forks are ignored.
---
 .github/REPOSITORY.md            |  7 ++--
 .github/codeql/codeql-config.yml |  4 +++
 .github/workflows/codeql.yml     | 61 +++++++++++++++++++++-----------
 3 files changed, 49 insertions(+), 23 deletions(-)
 create mode 100644 .github/codeql/codeql-config.yml

diff --git a/.github/REPOSITORY.md b/.github/REPOSITORY.md
index cb41f46b..8f0fd307 100644
--- a/.github/REPOSITORY.md
+++ b/.github/REPOSITORY.md
@@ -77,9 +77,10 @@ release build, so only a maintainer can push one.
   secret format is blocked; the pusher can still bypass with a stated reason,
   which is recorded, and unsupported token formats are not detected.
 - Code scanning: *Default setup* stays off. [`workflows/codeql.yml`](workflows/codeql.yml)
-  analyses Actions and JavaScript/TypeScript, and Rust on macOS and Windows
-  runners so each platform's code is covered, after code changes reach
-  `main` and weekly. It does not run on pull requests.
+  analyses Actions and JavaScript/TypeScript after code changes reach `main`
+  and weekly, and Rust weekly and on demand on macOS and Windows runners, so
+  each platform's code is covered; a Rust analysis takes over an hour. It
+  does not run on pull requests, and results in `vendor/` are ignored.
 
 ## Issues and labels
 
diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 00000000..b71870cc
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,4 @@
+# Vendored forks are upstream code under their own review records; results
+# there are not actionable in this repository.
+paths-ignore:
+  - vendor
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d0ba530e..c86076b6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,8 +1,9 @@
 name: CodeQL
 
-# Runs after code reaches main and weekly, not on pull requests. Rust is
-# analysed on macOS and Windows: extraction follows the host's cfg, and most
-# native code exists only for those two platforms.
+# Actions and JavaScript/TypeScript are analysed after code reaches main and
+# weekly. Rust takes over an hour per platform, so it runs weekly and on
+# demand. It is analysed on macOS and Windows: extraction follows the host's
+# cfg, and most native code exists only for those two platforms.
 on:
   push:
     branches: [main]
@@ -16,30 +17,21 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: codeql-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   analyze:
-    name: Analyze (${{ matrix.language }}, ${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 60
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
     permissions:
       contents: read
       security-events: write
+    concurrency:
+      group: codeql-${{ matrix.language }}-${{ github.ref }}
+      cancel-in-progress: true
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - language: actions
-            os: ubuntu-24.04
-          - language: javascript-typescript
-            os: ubuntu-24.04
-          - language: rust
-            os: macos-15
-          - language: rust
-            os: windows-2025
+        language: [actions, javascript-typescript]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -48,6 +40,35 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           build-mode: none
+          config-file: ./.github/codeql/codeql-config.yml
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          category: /language:${{ matrix.language }}
+
+  rust:
+    name: Analyze (rust, ${{ matrix.os }})
+    if: ${{ github.event_name != 'push' }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 180
+    permissions:
+      contents: read
+      security-events: write
+    concurrency:
+      group: codeql-rust-${{ matrix.os }}-${{ github.ref }}
+      cancel-in-progress: false
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15, windows-2025]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          languages: rust
+          build-mode: none
+          config-file: ./.github/codeql/codeql-config.yml
       - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
-          category: /language:${{ matrix.language }}/os:${{ matrix.os }}
+          category: /language:rust/os:${{ matrix.os }}