kleinanzeigen-bot/.github/workflows/codeql-analysis.yml

# SPDX-FileCopyrightText: © Sebastian Thomschke and contributors
# SPDX-License-Identifier: AGPL-3.0-or-later
# SPDX-ArtifactOfProjectHomePage: https://github.com/Second-Hand-Friends/kleinanzeigen-bot
#
# https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning
name: "CodeQL"

on:  # https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
  schedule:
    # https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#schedule
    - cron: '10 10 * * 1'  # Mondays 10:10 UTC
  push:
    branches: ['main', 'release']  # run only on protected branches to avoid duplicate PR runs
    tags-ignore: ['**'] # don't build tags
    paths-ignore:
    - '**/*.md'
    - '.act*'
    - '.editorconfig'
    - '.git*'
    - 'codecov.yml'
  pull_request:
    paths-ignore:
    - '**/*.md'
    - '.act*'
    - '.editorconfig'
    - '.git*'
    - 'codecov.yml'
  workflow_dispatch:
    # https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#workflow_dispatch


defaults:
  run:
    shell: bash

env:
  PYTHON_VERSION: "3.14"

jobs:

  ###########################################################
  analyze:
  ###########################################################
    runs-on: ubuntu-latest
    timeout-minutes: 10

    permissions:
      # required for all workflows
      security-events: write

      # required to fetch internal or private CodeQL packs
      packages: read

      # only required for workflows in private repositories
      actions: read
      contents: read

    steps:
    - name: "Show: GitHub context"
      env:
        GITHUB_CONTEXT: ${{ toJSON(github) }}
      run: printf '%s' "$GITHUB_CONTEXT" | python -m json.tool


    - name: "Show: environment variables"
      run: env | sort


    - name: Git Checkout
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6.0.0
      # https://github.com/actions/checkout


    - name: "Install: Python and PDM"  # https://github.com/pdm-project/setup-pdm
      uses: pdm-project/setup-pdm@973541a5febeafcfdadf8a51211435be6ecfd90f # v4.5
      with:
        python-version: "${{ env.PYTHON_VERSION }}"
        cache: true


    - name: "Install: Python dependencies"
      run: |
        set -eux

        python --version
        python -m pip install --upgrade pip
        pip install --upgrade pdm
        if [[ ! -e .venv ]]; then
          pdm venv create || true
        fi
        pdm sync --clean -v


    - name: Initialize CodeQL
      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
      # https://github.com/github/codeql-action/blob/main/init/action.yml
      with:
        languages: actions,python
        # https://github.com/github/codeql-action#build-modes
        build-mode: none
        # https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#using-queries-in-ql-packs
        queries: security-and-quality

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
      # https://github.com/github/codeql-action