ci: split CodeQL into separate PR and push/schedule jobsuser/jvalesmena/codeql-sharding

The previous single-job approach with a 4-shard matrix caused PRs to
spin up 4 identical runners all building the same changed files.

Split into two jobs:
- analyze-pr: runs only on pull_request, single runner, builds changed
  samples via Build-ChangedSamples.ps1. No shard matrix overhead.
- analyze: runs on push/schedule, 4-shard matrix, each shard builds its
  slice of all samples. Also drops the now-unnecessary 'get-changed-files'
  step from the push path.

Co-authored-by: Copilot <[email protected]>

1 files changed, 51 insertions, 9 deletions

diff --git a/.github/workflows/Code-Scanning.yml b/.github/workflows/Code-Scanning.yml
index c28d2a52..393f69df 100644
--- a/.github/workflows/Code-Scanning.yml
+++ b/.github/workflows/Code-Scanning.yml
@@ -1,7 +1,8 @@
 # This workflow runs the latest CodeQL CLI and checks against CodeQL's Cpp library.
 # This is the source for the GitHub Security Code Scanning job.
-# Samples are split across 4 parallel shards to reduce total wall-clock time while
-# keeping ThrottleLimit 1 per shard (required for accurate CodeQL tracing).
+# On push/schedule: samples are split across 4 parallel shards to reduce wall-clock
+# time while keeping ThrottleLimit 1 per shard (required for accurate CodeQL tracing).
+# On pull_request: only changed samples are built in a single job (no sharding needed).
 
 name: "CodeQL Analysis"
 
@@ -26,8 +27,12 @@ on:
   workflow_dispatch:
 
 jobs:
-  analyze:
-    name: Analysis (shard ${{ matrix.shard }} of 4)
+  # -----------------------------------------------------------------------
+  # PR job: single runner, builds only changed samples
+  # -----------------------------------------------------------------------
+  analyze-pr:
+    name: Analysis (PR)
+    if: github.event_name == 'pull_request'
     runs-on: windows-latest
     permissions:
       actions: read
@@ -39,7 +44,6 @@ jobs:
       matrix:
         language: [c-cpp]
         build-mode: [manual]
-        shard: [1, 2, 3, 4]
 
     steps:
       - name: Checkout repository
@@ -63,8 +67,7 @@ jobs:
           build-mode: ${{ matrix.build-mode }}
           config-file: microsoft/Windows-Driver-Developer-Supplemental-Tools/config/codeql-config.yml@development
 
-      - if: github.event_name == 'pull_request'
-        name: Build changed samples (PR)
+      - name: Build changed samples (PR)
         run: |
           $changedFiles = "${{ steps.get-changed-files.outputs.all_changed_files }}".Split(',')
           .\.github\scripts\Build-ChangedSamples.ps1 -ChangedFiles $changedFiles -Verbose
@@ -73,8 +76,47 @@ jobs:
           WDS_Platform: x64
           WDS_WipeOutputs: ${{ true }}
 
-      - if: github.event_name != 'pull_request'
-        name: Build sample shard ${{ matrix.shard }} of 4
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"
+
+  # -----------------------------------------------------------------------
+  # Push/schedule job: 4 parallel shards, each builds a slice of all samples
+  # -----------------------------------------------------------------------
+  analyze:
+    name: Analysis (shard ${{ matrix.shard }} of 4)
+    if: github.event_name != 'pull_request'
+    runs-on: windows-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [c-cpp]
+        build-mode: [manual]
+        shard: [1, 2, 3, 4]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
+
+      - name: Install Nuget Packages
+        run: nuget restore .\packages.config -PackagesDirectory .\packages\
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          config-file: microsoft/Windows-Driver-Developer-Supplemental-Tools/config/codeql-config.yml@development
+
+      - name: Build sample shard ${{ matrix.shard }} of 4
         run: |
           $totalShards = 4
           $shardIndex  = ${{ matrix.shard }} - 1