codeql.yml

# Copyright (C) 2026 Intel Corporation
# SPDX-License-Identifier: Apache-2.0

name: codeql

# CodeQL advanced setup. The repository's default setup never analysed a PR
# opened from a fork, and every PR comes from a fork (CONTRIBUTING.md), so
# nothing was scanned before merge. This workflow runs on `pull_request`,
# which covers fork PRs too. Default setup must be off for its uploads to be
# accepted: Settings -> Code security -> CodeQL analysis -> Advanced.
on:
  push:
    branches: [main]
  # A PR that changes no Python and no workflow has nothing for either language
  # to analyse; push and the weekly schedule still scan the whole tree.
  pull_request:
    branches: [main]
    paths:
      - '**.py'
      - '.github/workflows/**'
      - '.github/actions/**'
  schedule:
    - cron: '23 4 * * 1'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

# intel-ubuntu-latest: see ci.yml.
jobs:
  analyze:
    name: CodeQL (${{ matrix.language }})
    runs-on: ${{ github.repository_owner == 'intel' && 'intel-ubuntu-latest' || 'ubuntu-latest' }}
    permissions:
      contents: read          # to check out the code
      security-events: write  # to upload the results to code scanning
    strategy:
      fail-fast: false
      matrix:
        # Same languages and query suite as the default setup this replaces.
        language: [actions, python]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
        with:
          languages: ${{ matrix.language }}
          build-mode: none
      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
        with:
          category: /language:${{ matrix.language }}