name: 🔎 CodeQL

on:

workflow_dispatch:

push:

branches: ["main"]

pull_request:

schedule:

- cron: "0 9 * * 2"

concurrency:

group: ${{ github.workflow }}-${{ github.ref }}

cancel-in-progress: true

permissions: {}

jobs:

analyze:

name: 🔎 analyze ${{ matrix.language }}

runs-on: ubuntu-24.04

permissions:

contents: read # check out the code to analyze

security-events: write # upload the analysis results to code scanning

strategy:

fail-fast: false

matrix:

language: [python, actions]

steps:

- name: Checkout code

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

- name: Initialize CodeQL

uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

with:

languages: ${{ matrix.language }}

config-file: ./.github/codeql/codeql-config.yml

# the custom pack holds Python queries only, so the actions analysis must not load it

queries: ${{ matrix.language == 'python' && '+./.github/codeql/queries' || '' }}

- name: Perform CodeQL Analysis

uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

with:

category: "/language:${{ matrix.language }}"