From d2f47dcad6560354de21f4809cf8560f7a244ef1 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Mon, 20 Oct 2025 01:44:27 -0700
Subject: [PATCH] attempt to configure rust extractor for the right target

---
 .github/codeql/rust-extractor.yaml | 4 ++++
 .github/workflows/codeql.yaml      | 9 ++++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 .github/codeql/rust-extractor.yaml

diff --git a/.github/codeql/rust-extractor.yaml b/.github/codeql/rust-extractor.yaml
new file mode 100644
index 0000000..5975d1a
--- /dev/null
+++ b/.github/codeql/rust-extractor.yaml
@@ -0,0 +1,4 @@
+name: rust-extractor
+version: 1.0.0
+options:
+  cargo_target: x86_64-unknown-uefi
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 4c55dc4..6f226cc 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -8,6 +8,9 @@ on:
   schedule:
   - cron: '33 16 * * 0'
 
+permissions:
+  contents: read # Needed to checkout the repository.
+
 jobs:
   analyze:
     name: analyze (${{ matrix.language }})
@@ -16,7 +19,7 @@ jobs:
       security-events: write # Needed to upload results.
       packages: read # Needed to fetch internal or private CodeQL packs.
       actions: read # Needed to read workflows.
-      contents: read # Needed to read code.
+      contents: read # Needed to checkout the repository.
 
     strategy:
       fail-fast: false
@@ -37,6 +40,10 @@ jobs:
       with:
         persist-credentials: false
 
+    - name: use rust extractor config
+      run: |
+        echo "CODEQL_EXTRACTOR_RUST_CONFIG=.github/codeql/rust-extractor.yaml" >> $GITHUB_ENV
+
     - name: initialize codeql
       uses: github/codeql-action/init@16140ae1a102900babc80a33c44059580f687047 #v4
       with: