codeql-analysis.yml

name: "GitHub CodeQL"

on:
  push:
    branches: [main]
    tags: ["*"]
  pull_request:
    branches: [main]
  workflow_dispatch:

# Cancel previous runs within same workflow and if within a PR (all branch runs complete)
# (head_ref [branch name] is unique to and only for PRs, otherwise use always-unique run_id)
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  analyse:
    name: Analyse
    if: ${{!github.event.repository.private}}
    permissions:
      actions: read
      contents: read
      security-events: write
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        persist-credentials: false
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.9'
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip3 install .
    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: python
        # Override the default behavior so that the action doesn't attempt
        # to auto-install Python dependencies
        setup-python-dependencies: false

      # Override language selection by uncommenting this and choosing your languages
      # with:
      #   languages: go, javascript, csharp, python, cpp, java
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3