codeql.yml

name: CodeQL
on:
  schedule:
    - cron: '0 17 * * *'

permissions:
  contents: read

jobs:
  codeQL:
    if: ${{ github.repository_owner == 'ihub-pub' }}
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      matrix:
        java_version: [ 17, 21 ]
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          disable-sudo: true
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up JDK ${{ matrix.java_version }}
        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
        with:
          java-version: ${{ matrix.java_version }}
          distribution: 'adopt'

      - name: Initialize CodeQL
        uses: github/codeql-action/init@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8

      - name: Autobuild
        uses: github/codeql-action/autobuild@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8