codeql-analysis.yml

# Copyright © Michal Čihař <michal@weblate.org>
#
# SPDX-License-Identifier: GPL-3.0-or-later

name: CodeQL

on:
  push:
    branches:
    - main
  pull_request:
    # The branches below must be a subset of the branches above
    branches:
    - main
  schedule:
  - cron: 0 4 * * 0

permissions:
  contents: read

jobs:
  analyze:
    permissions:
      actions: read  # for github/codeql-action/init to get workflow details
      contents: read  # for actions/checkout to fetch code
      security-events: write  # for github/codeql-action/autobuild to send a status report
    name: Analyze
    runs-on: ubuntu-22.04
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4.1.1
    - name: Install apt dependencies
      run: sudo ./ci/apt-install $CI_DATABASE
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.11'
        cache: pip
        cache-dependency-path: '**/requirements*.txt'
    - name: Used versions
      run: ./ci/print-versions
    - name: Install pip dependencies
      run: ./ci/pip-install

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v2
      with:
        setup-python-dependencies: false

    - name: Autobuild
      uses: github/codeql-action/autobuild@v2

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v2