# CodeQL security scanning - Phase 6A org hardening
name: codeql
on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '41 3 * * 1'

permissions:
  contents: read
  security-events: write
  actions: read

jobs:
  analyze:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    strategy:
      matrix:
        language: [python]
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: github/codeql-action/init@f5c2471be782132e47a6e6f9c725e56730d6e9a3 # v3
        with:
          languages: ${{ matrix.language }}
      - uses: github/codeql-action/autobuild@f5c2471be782132e47a6e6f9c725e56730d6e9a3 # v3
      - uses: github/codeql-action/analyze@f5c2471be782132e47a6e6f9c725e56730d6e9a3 # v3
