ci: run the Rust CodeQL analysis weekly with room to finish

.github/REPOSITORY.md

@@ -77,9 +77,10 @@ release build, so only a maintainer can push one.
   secret format is blocked; the pusher can still bypass with a stated reason,
   which is recorded, and unsupported token formats are not detected.
 - Code scanning: *Default setup* stays off. [`workflows/codeql.yml`](workflows/codeql.yml)
-  analyses Actions and JavaScript/TypeScript, and Rust on macOS and Windows
-  runners so each platform's code is covered, after code changes reach
-  `main` and weekly. It does not run on pull requests.
+  analyses Actions and JavaScript/TypeScript after code changes reach `main`
+  and weekly, and Rust weekly and on demand on macOS and Windows runners, so
+  each platform's code is covered; a Rust analysis takes over an hour. It
+  does not run on pull requests, and results in `vendor/` are ignored.
 
 ## Issues and labels
 

.github/codeql/codeql-config.yml

@@ -0,0 +1,4 @@
+# Vendored forks are upstream code under their own review records; results
+# there are not actionable in this repository.
+paths-ignore:
+  - vendor

.github/workflows/codeql.yml

@@ -1,8 +1,9 @@
 name: CodeQL
 
-# Runs after code reaches main and weekly, not on pull requests. Rust is
-# analysed on macOS and Windows: extraction follows the host's cfg, and most
-# native code exists only for those two platforms.
+# Actions and JavaScript/TypeScript are analysed after code reaches main and
+# weekly. Rust takes over an hour per platform, so it runs weekly and on
+# demand. It is analysed on macOS and Windows: extraction follows the host's
+# cfg, and most native code exists only for those two platforms.
 on:
   push:
     branches: [main]
@@ -16,30 +17,21 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: codeql-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   analyze:
-    name: Analyze (${{ matrix.language }}, ${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 60
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
     permissions:
       contents: read
       security-events: write
+    concurrency:
+      group: codeql-${{ matrix.language }}-${{ github.ref }}
+      cancel-in-progress: true
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - language: actions
-            os: ubuntu-24.04
-          - language: javascript-typescript
-            os: ubuntu-24.04
-          - language: rust
-            os: macos-15
-          - language: rust
-            os: windows-2025
+        language: [actions, javascript-typescript]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -48,6 +40,35 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           build-mode: none
+          config-file: ./.github/codeql/codeql-config.yml
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          category: /language:${{ matrix.language }}
+
+  rust:
+    name: Analyze (rust, ${{ matrix.os }})
+    if: ${{ github.event_name != 'push' }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 180
+    permissions:
+      contents: read
+      security-events: write
+    concurrency:
+      group: codeql-rust-${{ matrix.os }}-${{ github.ref }}
+      cancel-in-progress: false
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15, windows-2025]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          languages: rust
+          build-mode: none
+          config-file: ./.github/codeql/codeql-config.yml
       - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
-          category: /language:${{ matrix.language }}/os:${{ matrix.os }}
+          category: /language:rust/os:${{ matrix.os }}