improve workflow permissions (#1) #1

	# SPDX-License-Identifier: Apache-2.0
	# Licensed to the Ed-Fi Alliance under one or more agreements.
	# The Ed-Fi Alliance licenses this file to you under the Apache License, Version 2.0.
	# See the LICENSE and NOTICES files in the project root for more information.

	name: CodeQL Security Scan

	on:
	pull_request:
	branches:
	- main
	paths:
	- 'src/**'
	push:
	branches:
	- main

	jobs:
	analyze:
	name: Analyze Code
	runs-on: ubuntu-latest
	env:
	SRC_DIR: src/edfi-paging-test
	permissions:
	actions: read
	contents: read
	security-events: write

	strategy:
	fail-fast: false

	steps:
	- name: Checkout code
	uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2

	- name: Install Poetry
	run: pipx install poetry

	- name: Install Python 3.9
	uses: actions/setup-python@98f2ad02fd48d057ee3b4d4f66525b231c3e52b6 # v3.1.2
	with:
	python-version: "3.9.x"
	cache: "poetry"

	- name: Install dependencies
	run: poetry env use "3.9" && poetry install
	working-directory: ${{ env.SRC_DIR }}

	- name: Initialize CodeQL
	uses: github/codeql-action/init@1fae5bf71b0ecdc7d0a2ef0d0c28409d99693966 # v2.9.2
	with:
	languages: "python"
	setup-python-dependencies: false

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@1fae5bf71b0ecdc7d0a2ef0d0c28409d99693966 # v2.9.2

Provide feedback