name: Security Scan

on:
  push:
    branches: [ main, develop ]

permissions:
  contents: read

jobs:
  codeql:
    name: CodeQL Security Analysis
    uses: ./.github/workflows/codeql-analysis.yml
    permissions:
      contents: read
      security-events: write  # Required for SARIF upload to Security tab
      actions: read