CodeQL #48

	name: "CodeQL"

	on:
	push:
	branches: [ master ]
	pull_request:
	# The branches below must be a subset of the branches above
	branches: [ master ]
	schedule:
	- cron: '45 4 * * 1'

	permissions:
	contents: read

	jobs:
	analyze:
	name: Analyze
	runs-on: ubuntu-latest
	permissions:
	security-events: write

	strategy:
	fail-fast: false
	matrix:
	language: [ 'java' ]

	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
	with:
	egress-policy: audit

	- name: Checkout repository
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	fetch-depth: 256

	- name: Cache
	uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
	with:
	path: \|
	~/.ivy2/cache/
	~/work/josm/josm/tools/
	key: ${{ runner.os }}-ivy2-${{ hashFiles('build.xml', 'ivy.xml', 'tools/ivy.xml') }}

	- name: Initialize CodeQL
	uses: github/codeql-action/init@820e3160e279568db735cee8ed8f8e77a6da7818 # v3.32.6
	with:
	languages: ${{ matrix.language }}

	- name: Compile with Ant
	run: \|
	ant compile extract-libraries epsg

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@820e3160e279568db735cee8ed8f8e77a6da7818 # v3.32.6

Provide feedback