From b797ba71f48bfe886e7cc6b11b57c66c4488672b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 23 Oct 2025 23:53:12 +0000
Subject: [PATCH 1/3] Initial plan


From 048627c31d4b8c0f2e877a70cfe65313dfc2edca Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 23 Oct 2025 23:56:38 +0000
Subject: [PATCH 2/3] ci: skip CodeQL on forked PRs and set workflow
 permissions

Co-authored-by: SynTechRev <235390103+SynTechRev@users.noreply.github.com>
---
 .github/workflows/codeql.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8173966..542442a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -2,6 +2,7 @@ name: CodeQL Security Analysis
 
 # Top-level permissions required by CodeQL and checkout
 permissions:
+  actions: read
   contents: read
   security-events: write
 
@@ -17,6 +18,8 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    # Skip CodeQL analysis on forked PRs to avoid "Resource not accessible by integration" errors
+    if: github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository
     
     strategy:
       fail-fast: false

From 304cf8096a815006b159735de8df2ed13d9ac276 Mon Sep 17 00:00:00 2001
From: SynTechRev <syntechrev@gmail.com>
Date: Thu, 23 Oct 2025 21:13:50 -0700
Subject: [PATCH 3/3] Refactor CodeQL workflow for improved structure

---
 .github/workflows/codeql.yml | 54 ++++++++++++------------------------
 1 file changed, 17 insertions(+), 37 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 542442a..10cd779 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,66 +1,46 @@
-name: CodeQL Security Analysis
+name: "CodeQL Security Analysis"
+
+on:
+  push:
+    branches: [ main ]
+  # Use pull_request_target to run in the base repo context (allows required permissions)
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+  schedule:
+    - cron: '0 3 * * 0' # weekly on Sunday at 03:00 UTC
 
-# Top-level permissions required by CodeQL and checkout
 permissions:
   actions: read
   contents: read
   security-events: write
 
-on:
-  # Use pull_request_target so the workflow runs in the base repo context
-  # with access to secrets and permissions needed for CodeQL analysis
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-  push:
-    branches: [main]
-
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
-    # Skip CodeQL analysis on forked PRs to avoid "Resource not accessible by integration" errors
-    if: github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository
-    
+    permissions:
+      security-events: write
+
     strategy:
       fail-fast: false
       matrix:
         language: ['python']
-    
+
     steps:
-      # SECURITY NOTE: pull_request_target runs in the base repository context
-      # and has access to repository secrets. This checkout uses the base ref
-      # to ensure we analyze trusted code, not potentially malicious PR code.
-      # 
-      # For maintainers: To analyze PR head code (not recommended for untrusted PRs),
-      # you would need a second checkout step like:
-      # - name: Checkout PR head (for analysis only, no secrets)
-      #   uses: actions/checkout@v4
-      #   with:
-      #     repository: ${{ github.event.pull_request.head.repo.full_name }}
-      #     ref: ${{ github.event.pull_request.head.sha }}
-      #     fetch-depth: 0
-      #     persist-credentials: false
-      # 
-      # WARNING: Never run untrusted PR code with elevated privileges or secrets!
-      
       - name: Checkout repository (base repo context)
         uses: actions/checkout@v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
           persist-credentials: false
-      
+
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
-          # Autobuild for Python is usually sufficient
-          # If you need custom build steps, replace autobuild with them
-      
+
       - name: Autobuild
         uses: github/codeql-action/autobuild@v3
-      
+
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:${{ matrix.language }}"