Merge pull request #60 from IntentProof/security-advisory-publish #21

	name: codeql

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: "0 6 * * 1"

	permissions:
	actions: read
	contents: read
	security-events: write

	jobs:
	allowlist-expiry:
	name: "IntentProof Security: CodeQL Allowlist"
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Validate allowlist expiry dates
	run: bash ./scripts/check-codeql-allowlist.sh

	gitleaks:
	name: "IntentProof Security: Secret Scan"
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Install gitleaks
	run: \|
	curl -sSfL \
	"https://github.com/gitleaks/gitleaks/releases/download/v8.24.2/gitleaks_8.24.2_linux_x64.tar.gz" \
	\| tar -xz
	sudo install -m 755 gitleaks /usr/local/bin/gitleaks

	- name: Run gitleaks
	run: gitleaks detect --source . --config .gitleaks.toml --verbose --redact

	analyze:
	name: "IntentProof Security: CodeQL (${{ matrix.language }})"
	needs: allowlist-expiry
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	language: [python]
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"

	- name: Install package for CodeQL
	run: pip install -e ".[dev]"

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: ${{ matrix.language }}
	queries: security-and-quality

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v3
	with:
	category: "/language:${{ matrix.language }}"

Provide feedback