codeql_analysis.yml

name: CodeQL

on:
  push:
    branches:
      - master
    # Docs-only changes carry no code for CodeQL to analyze, so skip them.
    # The weekly schedule below still re-scans master regardless.
    paths-ignore:
      - 'docs/**'
      - '**/*.md'
      - '**/*.rst'
  pull_request:
    branches:
      - master
    paths-ignore:
      - 'docs/**'
      - '**/*.md'
      - '**/*.rst'
  schedule:
    - cron: '0 0 * * 0'

# Cancel a superseded in-progress run on the same branch/PR (saves runner minutes).
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze
    # CodeQL is a security scan, not a correctness gate, and adds several minutes.
    # Keep it off the PR fast path: it runs on every master push and on the weekly
    # schedule above. The fast `code-quality` job below still runs on PRs.
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: "python"
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3

  code-quality:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.12'

    - name: Cache Python dependencies
      uses: actions/cache@v5
      with:
        path: ~/.cache/pip
        key: ${{ runner.os }}-pip-3.12-${{ hashFiles('pyproject.toml') }}
        restore-keys: |
          ${{ runner.os }}-pip-3.12-

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -e .[pro]
        pip install flake8 mypy pylint

    - name: Install cd-hit and mmseqs2
      run: |
        sudo apt-get update
        sudo apt-get install -y cd-hit
        sudo apt-get install -y mmseqs2

    - name: Run flake8 (check style)
      run: flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics

    - name: Run mypy (check static typing)
      run: mypy aaanalysis/__init__.py --follow-imports=skip

    - name: Check docstring house style
      run: python .claude/skills/docstrings/scripts/check_docstrings.py

    - name: Check doc/signature drift
      run: python .claude/skills/docstrings/scripts/doc_signature_drift.py

    - name: Check example-notebook parameter coverage (advisory, non-blocking)
      continue-on-error: true
      run: python .claude/skills/docstrings/scripts/check_example_notebooks.py