Repository navigation

ci: bump the actions group across 1 directory with 8 updates #67

	name: CodeQL

	# Not on push to main: PRs are scanned before merge, and the weekly run (or a manual
	# run) refreshes the alert list for main.
	on:
	pull_request:
	branches: [ main ]
	workflow_dispatch:
	schedule:
	# Weekly, so newly published queries catch code that has not changed.
	- cron: "27 4 * * 1"

	permissions:
	contents: read

	jobs:
	analyze:
	name: Analyze Python
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	actions: read
	contents: read

	steps:
	- name: Checkout code
	uses: actions/checkout@v7

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v4
	with:
	languages: python
	queries: security-extended
	config: \|
	paths-ignore:
	# Emitted scaffolding, not library code.
	- tenxgraph_api/cli/templates
	- tests

	- name: Perform CodeQL analysis
	uses: github/codeql-action/analyze@v4
	with:
	category: "/language:python"