GHA

.github/workflows/codeql.yml

@@ -3,10 +3,12 @@ name: CodeQL
 on:
   push:
     paths:
-      - 'tools/cmdata/**'
+      - 'tools/**'
+      - 'src/**'
   pull_request:
     paths:
-      - 'tools/cmdata/**'
+      - 'tools/**'
+      - 'src/**'
   schedule:
     - cron: '0 4 * * 1'
 
@@ -20,10 +22,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: c-cpp
         # Disable default queries that expect Python/JS; use the standard C++ suite.
@@ -36,7 +38,7 @@ jobs:
 
     - name: Cache GROMACS installation
       id: cache-gromacs
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: /usr/local/gromacs
         key: gromacs-release-2025-${{ steps.gmx-hash.outputs.hash }}
@@ -57,6 +59,23 @@ jobs:
         make
 
     - name: Perform CodeQL analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
       with:
         category: c-cpp
+
+  analyze-python:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: python
+        queries: security-and-quality
+
+    - name: Perform CodeQL analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: python