codeql.yml

name: codeql

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  schedule:
    # Weekly scan so newly-published CodeQL queries catch issues even when the
    # code hasn't changed. Monday 07:00 UTC.
    - cron: "0 7 * * 1"

# A newer push to the same ref cancels the in-flight run.
concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

# Least privilege at the top level: any scope not explicitly widened by a job
# stays read-only. The analyze job below adds security-events: write for the
# CodeQL upload — the only scope that needs more than read.
permissions:
  contents: read

jobs:
  analyze:
    name: analyze (python)
    runs-on: ubuntu-24.04
    timeout-minutes: 20

    # Permissions CodeQL needs: read code, write analysis results to the
    # Security tab. Everything else stays default-denied.
    permissions:
      contents: read
      security-events: write

    steps:
      # persist-credentials: false — the CodeQL actions use the job's
      # GITHUB_TOKEN directly, so the checkout token need not stay in
      # .git/config for later steps.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # CodeQL supports Python (the project's hook/script logic). Bash is not a
      # CodeQL language — shellcheck.yml covers the shell sources instead.
      - name: initialize codeql
        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          languages: python

      - name: analyze
        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          category: "/language:python"