codeql-analysis.yml

# Copyright © Michal Čihař <michal@weblate.org>
#
# SPDX-License-Identifier: GPL-3.0-or-later

name: CodeQL

on:
  push:
    branches:
    - main
  pull_request:
    # The branches below must be a subset of the branches above
    branches:
    - main
  schedule:
  - cron: 0 4 * * 0

permissions:
  contents: read

jobs:
  analyze:
    permissions:
      actions: read  # for github/codeql-action/init to get workflow details
      contents: read  # for actions/checkout to fetch code
      security-events: write  # for github/codeql-action/autobuild to send a status report
    name: Analyze
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
    - name: Install apt dependencies
      run: sudo ./ci/apt-install
    - uses: astral-sh/setup-uv@v4
      with:
        enable-cache: true
        cache-dependency-glob: ''
        cache-suffix: '3.13'
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.13'
    - name: Used versions
      run: ./ci/print-versions
    - name: Install Python dependencies
      run: ./ci/pip-install

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3

    - name: Autobuild
      uses: github/codeql-action/autobuild@v3

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3