name: "CodeQL Python"

on:
  push:
    branches: [ "master"]
    tags: ['*']
  pull_request:
    paths:
      - bindings/python/*
      - bindings/python/**/*.py
      - .github/workflows/*python.yml
  schedule:
    - cron: '17 10 * * 2'
  workflow_dispatch:
  workflow_call:
    inputs:
      ref:
        required: true
        type: string

jobs:
  analyze-python:
    name: Analyze Python
    if: github.repository_owner == 'mongodb' || (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')
    runs-on: "macos-latest"
    timeout-minutes: 360
    permissions:
      # required for all workflows
      security-events: write
      # required to fetch internal or private CodeQL packs
      packages: read
    steps:
    - name: Checkout repository
      uses: actions/checkout@v5
      with:
        fetch-depth: 0
        ref: ${{ inputs.ref }}
        persist-credentials: false
    - uses: actions/setup-python@v6
      with:
        python-version: 3.x

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@16140ae1a102900babc80a33c44059580f687047 # v4
      with:
        languages: python
        build-mode: none
        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
        queries: security-extended
        config: |
          paths:
            - bindings/python/pymongocrypt

    - name: Install package
      run: |
        cd bindings/python
        export LIBMONGOCRYPT_VERSION=$(cat ./scripts/libmongocrypt-version.txt)
        git fetch origin $LIBMONGOCRYPT_VERSION
        bash ./scripts/release.sh
        pip install dist/*.whl

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@16140ae1a102900babc80a33c44059580f687047 # v4
      with:
        category: "/language:python"
