codeql.yml

name: "CodeQL"

on:
  push:
    branches:
      - "main"
  workflow_call:

jobs:
  analyze:
    name: "Analyze"
    runs-on: "ubuntu-latest"
    permissions:
      actions: "read"
      contents: "read"
      security-events: "write"

    steps:
      - name: "Checkout repository"
        uses: "actions/checkout@v4"
      - uses: "actions/cache@v4"
        with:
          path: "~/.cache/pip"
          key: "${{ runner.os }}-pip-${{ hashFiles('**/*requirements.txt', '**/*constraints.lock', '**/setup.py', '**/pyproject.toml') }}"
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: "Set up Python"
        uses: "actions/setup-python@v5"
        with:
          python-version: "3.11"
      - name: "Manually install from sources"
        run: |
          python -m pip install -e . -e ./pulp-glue-gem
          echo "CODEQL_PYTHON=$(which python)" >> "$GITHUB_ENV"
      - name: "Initialize CodeQL"
        uses: "github/codeql-action/init@v3"
        with:
          languages: "python"
          setup-python-dependencies: false

      - name: "Perform CodeQL Analysis"
        uses: "github/codeql-action/analyze@v3"
        with:
          category: "/language:python"