Continuous Integration Best Practices #15

	# Security audit on code: CodeQL analysis for Python
	# https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors
	name: Security audit (code)

	on:
	push:
	pull_request:
	schedule:
	# Run weekly on Mondays at 00:00 UTC
	- cron: '0 0 * * 1'

	# Avoid duplicate runs when both push and pull_request trigger for the same commit
	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.head.sha \|\| github.sha }}
	cancel-in-progress: true

	permissions:
	security-events: write
	actions: read
	contents: read

	jobs:
	codeql:
	name: CodeQL
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: python
	queries: security-extended

	- name: Autobuild
	uses: github/codeql-action/autobuild@v3

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v3
	with:
	category: '/language:python'

Provide feedback