Update codeql.yml

Signed-off-by: Kaito Udagawa <umireon@kaito.tokyo>

Author: umireon

.github/workflows/codeql.yml

@@ -6,6 +6,10 @@
 
 name: CodeQL Advanced
 
+# file: .github/workflows/codeql.yml
+# author: Kaito Udagawa <umireon@kaito.tokyo>
+# date: 2026-06-29
+
 on:
   push:
     branches: [main]
@@ -14,21 +18,41 @@ on:
   schedule:
     - cron: '40 21 * * 4'
 
+permissions: {}
+
+env:
+  HOMEBREW_NO_ANALYTICS: '1'
+  HOMEBREW_NO_AUTO_UPDATE: '1'
+  HOMEBREW_NO_ENV_HINTS: '1'
+  HOMEBREW_NO_INSTALL_CLEANUP: '1'
+
 jobs:
-  analyze:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-            build-mode: none
-            runs-on: ubuntu-24.04
-          - language: swift
-            build-mode: manual
-            runs-on: macos-26
-
-    name: Analyze (${{ matrix.language }})
-    runs-on: ${{ matrix.runs-on }}
+  analyze-actions:
+    runs-on: ubuntu-24.04
+
+    permissions:
+      security-events: write
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          languages: actions
+          build-mode: none
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          category: /language:actions
+
+  analyze-swift:
+    runs-on: macos-26
 
     permissions:
       security-events: write
@@ -41,7 +65,6 @@ jobs:
           persist-credentials: false
 
       - name: Generate project using XcodeGen
-        if: matrix.language == 'swift'
         shell: bash --noprofile --norc -euo pipefail -O nullglob {0}
         run: |
           brew install xcodegen
@@ -50,11 +73,10 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
+          languages: swift
+          build-mode: manual
 
       - name: Build Xcode project
-        if: matrix.language == 'swift'
         shell: bash --noprofile --norc -euo pipefail -O nullglob {0}
         run: |
           xcodebuild build \
@@ -71,4 +93,4 @@ jobs:
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
-          category: "/language:${{matrix.language}}"
+          category: /language:swift