name: "CodeQL"

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]
  schedule:
    - cron: '41 21 * * 3'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'cpp', 'python' ]

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        submodules: true

    - name: Cache pip
      uses: actions/cache@v4
      with:
        key: codeql-analysis--${{ github.event.inputs.os }}--${{ github.event.inputs.python }}--${{ hashFiles('./requirements-dev.txt') }}
        path: ~/.cache/pip

    - name: Setup python
      uses: actions/setup-python@v5
      with:
        python-version: ${{ github.event.inputs.python }}

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}

    - name: Update pip
      run: python -m pip install -U pip wheel setuptools

    - name: Install requirements
      run: python -m pip install -Ur requirements-dev.txt

    - name: Compile
      run: make wheel

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3