static-analysis.yaml

name: Static analysis

on:
  push:
    branches:
      - main

  pull_request:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  pre-commit-checks:
    name: Pre-commit checks
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        id: setup_python
        with:
          python-version: "3.12.4"

      - name: UV Cache
        uses: actions/cache@v4
        id: cache-uv
        with:
          path: ~/.cache/uv
          key: uvcache-${{ runner.os }}-${{ steps.setup_python.outputs.python-version }}-${{ hashFiles('requirements.txt', 'requirements-dev.txt') }}

      - name: Install packages
        run: |
          python -m pip install -U uv pre-commit
          uv pip install --system -r requirements-dev.txt
          uv pip install --system -e .

      - name: Run pre-commit
        run: pre-commit run --show-diff-on-failure --color=always --all-files

  analyze:
    name: Analyze
    runs-on: ubuntu-latest

    permissions:
      contents: read
      actions: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: python
          config-file: ./.github/codeql-config.yml
          queries: security-extended

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3