codeql.yml

name: CodeQL

# SAST (SEC-07/08, CICD-20). Two languages: python (the validator itself) and
# actions (the 6 workflows + action.yml, for the injection/permission classes
# CodeQL's actions query pack understands).

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "17 6 * * 1" # weekly, Monday 06:17 UTC

permissions:
  contents: read

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write # required to upload SARIF to code scanning
    strategy:
      fail-fast: false
      matrix:
        language: ["python", "actions"]
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false
      - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
        with:
          languages: ${{ matrix.language }}
      - uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
        with:
          category: "/language:${{ matrix.language }}"