[StepSecurity] ci: Restrict token permissions to harden GitHub Actions #3981

	name: "CodeQL"

	on:
	push:
	branches: [main]
	pull_request:
	# branches must be a subset of push branches
	branches: [main]
	# Run weekly on Sundays at 0:01 UTC
	schedule:
	- cron: '1 0 * * 0'
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	analyze:
	permissions:
	actions: read # for github/codeql-action/init to get workflow details
	contents: read # for actions/checkout to fetch code
	security-events: write # for github/codeql-action/analyze to upload SARIF results
	name: Analyze
	runs-on: ubuntu-latest

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	# Initializes the CodeQL tools for scanning.
	- name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: python
	# If you wish to specify custom queries, you can do so here or in a config file.
	# By default, queries listed here will override any specified in a config file.
	# Prefix the list here with "+" to use these queries and those in the config file.
	# queries: ./path/to/local/query, your-org/your-repo/queries@main

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v3

Provide feedback