fix(ci): unblock docs-sync and release-please from CodeQL gate (#101) #216

	name: Security

	on:
	push:
	branches: ["main"]
	pull_request: # all PRs, all branches, on open/push/reopen
	schedule:
	- cron: "30 2 * * 1" # weekly Monday 02:30 UTC
	workflow_dispatch:

	# Scorecard requires minimal global permissions (no write at workflow level)
	permissions:
	contents: read

	jobs:
	scorecard:
	name: OpenSSF Scorecard
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	actions: read
	id-token: write

	steps:
	- name: Checkout
	uses: actions/checkout@v6
	with:
	persist-credentials: false

	- name: Run Scorecard
	uses: ossf/scorecard-action@v2.4.3
	with:
	results_file: results.sarif
	results_format: sarif
	# publish_results requires running on the default branch;
	# on PRs we still upload SARIF for code scanning but skip publishing
	publish_results: ${{ github.event_name != 'pull_request' }}

	- name: Upload to GitHub Security tab
	if: github.event_name != 'pull_request'
	uses: github/codeql-action/upload-sarif@v4
	with:
	sarif_file: results.sarif

	codeql:
	name: CodeQL (Python)
	runs-on: ubuntu-latest
	permissions:
	contents: read
	actions: read
	security-events: write

	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v4
	with:
	languages: python
	queries: security-and-quality

	- name: Autobuild
	uses: github/codeql-action/autobuild@v4

	- name: Analyze
	uses: github/codeql-action/analyze@v4
	with:
	category: "/language:python"

Provide feedback