codeql-analysis.yml

name: "CodeQL"

on:
  push:
    branches: [ "main" ]
    paths:
      - 'src/**'
      - 'tests/**'
      - '.github/workflows/codeql-analysis.yml'
  pull_request:
    branches: [ "main" ]
    paths:
      - 'src/**'
      - 'tests/**'
      - '.github/workflows/codeql-analysis.yml'
  schedule:
    - cron: '30 18 * * 1' # Runs every Monday at 18:30 UTC

# Centralize the Python version here for easy updates
env:
  PYTHON_VERSION: '3.12'

permissions:
  contents: read
  security-events: write
  actions: read

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    timeout-minutes: 36
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'python' ]

    steps:
    - name: Checkout repository
      uses: actions/checkout@v6

    - name: Set up Python ${{ env.PYTHON_VERSION }}
      uses: actions/setup-python@v6
      with:
        python-version: ${{ env.PYTHON_VERSION }}

    - name: Setup uv
      uses: astral-sh/setup-uv@v7
      with:
        enable-cache: true
        cache-dependency-glob: "uv.lock"

    - name: Install dependencies
      run: uv sync --frozen --group github-action

    # Updated to v4 to avoid deprecation of v3 in late 2026
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: ${{ matrix.language }}
        # Extended suites catch more complex vulnerabilities and code quality smells
        queries: security-extended,security-and-quality
        # Explicitly set the source root to ensure Python files are picked up
        source-root: src

    # Updated to v4 to match initialization
    - name: Perform Analysis
      uses: github/codeql-action/analyze@v4
      with:
        category: "/language:${{matrix.language}}"