codeql-analysis.yaml

# Run CodeQL over the package. For more configuration options see codeql/codeql-config.yaml
# and: https://github.com/github/codeql-action

name: CodeQL
on:
  push:
    branches:
    - main
    - staging
  pull_request:
    branches:
    - main
    - staging
    # Avoid unnecessary scans of pull requests.
    paths:
    - '**/*.py'
  schedule:
  - cron: 20 15 * * 3
permissions:
  contents: read

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
        # Learn more about CodeQL language support at https://git.io/codeql-language-support
        language: [python]
        python: ['3.12']
    steps:

    - name: Harden Runner
      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
        disable-sudo: true

    - name: Checkout repository
      uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5

    - name: Set up Python ${{ matrix.python }}
      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
        python-version: ${{ matrix.python }}

    # For more details see the comment in _build.yaml.
    - name: Create empty virtual environment for Actions
      run: mkdir .venv
    - name: Install dependencies
      run: make setup

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
      with:
        languages: ${{ matrix.language }}
        config-file: .github/codeql/codeql-config.yaml
        # Override the default behavior so that the action doesn't attempt
        # to auto-install Python dependencies
        setup-python-dependencies: false
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4