Repository navigation

CodeQL #3

	name: CodeQL

	# Static analysis (SAST) of the Python generator scripts and the workflow files.
	# Results go to the public repo's Security > Code scanning tab. Runs only on the
	# public repo, like scorecard.yml; internal mirrors block ubuntu-latest runners.
	on:
	# Allow manual runs from the Actions tab ("Run workflow" button).
	workflow_dispatch:
	push:
	branches: [ "master" ]
	schedule:
	- cron: '41 20 * * 4'

	permissions:
	contents: read

	jobs:
	analyze:
	name: Analyze (${{ matrix.language }})
	runs-on: ubuntu-latest
	if: github.repository_owner == 'oneapi-src'
	permissions:
	# Needed to upload the results to code-scanning dashboard.
	security-events: write
	contents: read
	strategy:
	fail-fast: false
	matrix:
	language: [ "python", "actions" ]

	steps:
	- name: Checkout code
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Initialize CodeQL
	uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
	with:
	languages: ${{ matrix.language }}
	build-mode: none

	- name: Perform CodeQL analysis
	uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
	with:
	category: "/language:${{ matrix.language }}"