From 8031389a67d4cb116cf34d4f4bb8237a75e0b7e0 Mon Sep 17 00:00:00 2001 From: Daichi Narushima <1938249+dceoy@users.noreply.github.com> Date: Sun, 14 Jun 2026 22:54:28 +0900 Subject: [PATCH] Add GitHub CodeQL analysis to CI workflow (#35) * chore: add GitHub CodeQL analysis to CI workflow Enable automated security scanning with GitHub CodeQL to detect potential vulnerabilities in Python code. Co-Authored-By: Claude Haiku 4.5 * chore: run CodeQL analysis on pull requests Co-authored-by: Cursor * Add checks and statuses read permissions for dependabot auto-merge. Co-authored-by: Cursor --------- Co-authored-by: Claude Haiku 4.5 Co-authored-by: Cursor --- .github/workflows/ci.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 71b1f5a..2ab5565 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -62,6 +62,19 @@ jobs: runs-on: ubuntu-slim secrets: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + github-codeql-analysis: + if: > + github.event_name == 'push' + || github.event_name == 'pull_request' + || (github.event_name == 'workflow_dispatch' && inputs.workflow == 'lint-and-test') + permissions: + contents: read + security-events: write + actions: read + uses: dceoy/gh-actions-for-devops/.github/workflows/github-codeql-analysis.yml@main # zizmor: ignore[unpinned-uses] + with: + language: > + ["python"] dependabot-auto-merge: if: > github.event_name == 'pull_request' && github.actor == 'dependabot[bot]' @@ -73,5 +86,7 @@ jobs: contents: write pull-requests: write actions: read + checks: read + statuses: read with: unconditional: true