From 2c03e6570a3b1a8d68f0ad9897c4e36ac74a8cdc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 4 Sep 2024 09:00:08 +0000
Subject: [PATCH 1/2] MNT: (deps): Bump github/codeql-action from 2 to 3

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2 to 3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v2...v3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/code-analysis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml
index c1771b1e6..71d08d02d 100644
--- a/.github/workflows/code-analysis.yml
+++ b/.github/workflows/code-analysis.yml
@@ -19,7 +19,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       # Override language selection by uncommenting this and choosing your languages
       # with:
       #   languages: go, javascript, csharp, python, cpp, java
@@ -36,4 +36,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

From 178f086f7de9c576959ff2b3f15f98a4e8ff2ccb Mon Sep 17 00:00:00 2001
From: Ryan May <rmay@ucar.edu>
Date: Thu, 31 Oct 2024 13:04:13 -0600
Subject: [PATCH 2/2] CI: Update CodeQL config

Tweak to run on certain path changes, use concurrency to cancel
in-progress jobs, and add permissions for reporting.
---
 .github/codeql/codeql-config.yml    |  7 +++++++
 .github/workflows/code-analysis.yml | 30 ++++++++++++++---------------
 2 files changed, 22 insertions(+), 15 deletions(-)
 create mode 100644 .github/codeql/codeql-config.yml

diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 000000000..1e886b0cd
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,7 @@
+name: "CodeQL Config"
+
+queries:
+  - uses: security-and-quality
+
+paths-ignore:
+  - examples
diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml
index 71d08d02d..48ba26c09 100644
--- a/.github/workflows/code-analysis.yml
+++ b/.github/workflows/code-analysis.yml
@@ -1,14 +1,27 @@
 name: "Code Analysis"
 
+concurrency:
+  group: ${{ github.workflow}}-${{ github.head_ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [master, ]
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [master]
+    paths:
+      - '**.py'
+      - '.github/codeql/**'
+      - '.github/workflows/code-analysis.yml'
+
   schedule:
     - cron: '0 8 * * 6'
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   CodeQL:
     runs-on: ubuntu-latest
@@ -17,23 +30,10 @@ jobs:
     - name: Checkout repository
       uses: actions/checkout@v3
 
-    # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v3
-      # Override language selection by uncommenting this and choosing your languages
-      # with:
-      #   languages: go, javascript, csharp, python, cpp, java
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
+      with:
+        config-file: ./.github/codeql/codeql-config.yml
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v3