Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions .github/workflows/codeql-analysis.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
name: CodeQL

on:
push:
branches:
- main
Comment on lines +1 to +6

Copilot AI Mar 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description mentions disabling the default CodeQL setup via API, but this repo change only adds a new workflow. If disabling the default setup is required to stop the existing actions language scan failures, please capture that as a tracked/manual step (e.g., in repo docs) or ensure the repo settings change is completed as part of the PR process, since it can’t be reviewed from this diff.

Copilot uses AI. Check for mistakes.
pull_request:
branches:
- main
schedule:
- cron: '0 6 * * 1'

jobs:
analyze:
name: Analyze (Python)
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps:
- name: Checkout
uses: actions/checkout@v4
Comment on lines +17 to +22

Copilot AI Mar 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The job sets permissions but only grants security-events: write. When permissions is specified, all unspecified scopes become none, so actions/checkout@v4 will not have contents: read and the workflow is likely to fail. Add at least contents: read (and typically actions: read per CodeQL guidance) alongside security-events: write.

Copilot uses AI. Check for mistakes.

- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: python

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: '/language:python'
Loading