CI: Use single run for all CodeQL language runs

.github/labeler.yml

@@ -2,121 +2,120 @@
 libraries:
   - changed-files:
       - any-glob-to-any-file:
-          - lib/**/*
-          - include/grass/*
-          - include/grass/**/*
-          - python/**/*
+          - lib/**
+          - include/grass/**
+          - python/**
 module:
   - changed-files:
       - any-glob-to-any-file:
-          - db/**/*
-          - display/**/*
-          - general/**/*
-          - imagery/**/*
-          - misc/**/*
-          - ps/**/*
-          - raster/**/*
-          - raster3d/**/*
-          - scripts/**/*
-          - temporal/**/*
-          - vector/**/*
+          - db/**
+          - display/**
+          - general/**
+          - imagery/**
+          - misc/**
+          - ps/**
+          - raster/**
+          - raster3d/**
+          - scripts/**
+          - temporal/**
+          - vector/**
 
 # Module categories
 database:
   - changed-files:
       - any-glob-to-any-file:
-          - db/**/*
-          - lib/db/**/*
+          - db/**
+          - lib/db/**
           - scripts/db.*/**
+          - '**.sql'
 display:
   - changed-files:
       - any-glob-to-any-file:
-          - display/**/*
-          - lib/display/**/*
+          - display/**
+          - lib/display/**
           - scripts/d.*/**
 general:
   - changed-files:
       - any-glob-to-any-file:
-          - general/**/*
+          - general/**
           - scripts/g.*/**
 GUI:
   - changed-files:
       - any-glob-to-any-file:
-          - gui/**/*
+          - gui/**
 imagery:
   - changed-files:
       - any-glob-to-any-file:
-          - imagery/**/*
-          - lib/imagery/**/*
+          - imagery/**
+          - lib/imagery/**
           - scripts/i.*/**
 misc:
   - changed-files:
       - any-glob-to-any-file:
-          - misc/**/*
+          - misc/**
           - scripts/m.*/**
 raster:
   - changed-files:
       - any-glob-to-any-file:
-          - raster/**/*
-          - lib/raster/**/*
+          - raster/**
+          - lib/raster/**
           - scripts/r.*/**
 raster3d:
   - changed-files:
       - any-glob-to-any-file:
-          - raster3d/**/*
-          - lib/raster3d/**/*
+          - raster3d/**
+          - lib/raster3d/**
           - scripts/r3.*/**
 temporal:
   - changed-files:
       - any-glob-to-any-file:
-          - temporal/**/*
-          - lib/temporal/**/*
+          - temporal/**
+          - lib/temporal/**
           - scripts/t.*/**
 vector:
   - changed-files:
       - any-glob-to-any-file:
-          - vector/**/*
-          - lib/vector/**/*
+          - vector/**
+          - lib/vector/**
           - scripts/v.*/**
 
 # Build, packaging, or OS related
 CI:
   - changed-files:
       - any-glob-to-any-file:
-          - .github/**/*
-          - .travis/**/*
+          - .github/**
+          - .travis/**
           - binder/**
           - .travis.yml
           - renovate.json
           - .pre-commit-config.yaml
 Windows:
   - changed-files:
       - any-glob-to-any-file:
-          - mswindows/**/*
+          - mswindows/**
 macOS:
   - changed-files:
       - any-glob-to-any-file:
-          - macosx/**/*
+          - macosx/**
 Linux:
   - changed-files:
       - any-glob-to-any-file:
-          - singularity/**/*
+          - singularity/**
           - rpm/** 
 docker:
   - changed-files:
       - any-glob-to-any-file:
-          - docker/**/*
+          - docker/**
           - '**/*Dockerfile*'
           - '**/*dockerfile*'
-          - '*Dockerfile*'
-          - '*dockerfile*'
           - .dockerignore
 
 docs:
+- all:
   - changed-files:
       - any-glob-to-any-file:
-          - doc/**/*
-          - man/**/*
+          - doc/**
+          - man/**
           - '**/*.md'
           - '**/*.rst'
           - '**/*.html'
@@ -129,22 +128,21 @@ docs:
           - NEWS
           - TODO
       - all-globs-to-all-files:
-          - '!doc/development/rfc/*'
+          - '!doc/development/rfc/**'
 RFC:
   - changed-files:
       - any-glob-to-any-file: 
-          - doc/development/rfc/*
+          - doc/development/rfc/**
 translation:
   - changed-files:
-      - any-glob-to-any-file: locale/**/*
+      - any-glob-to-any-file: locale/**
 
 # based on file types
 Python:
   - changed-files:
       - any-glob-to-any-file: 
         - '**/*.py'
         - '**/pyproject.toml'
-        - 'pyproject.toml'
 C:
   - changed-files:
       - any-glob-to-any-file: '**/*.c'

.github/workflows/codeql-analysis.yml

@@ -16,49 +16,72 @@ on:
     # Check every Saturday at 18:36
     - cron: 36 18 * * 6
 
+permissions: {}
+
 jobs:
   analyze:
-    name: ${{ matrix.language }}
+    name: Analyze
     runs-on: ubuntu-22.04
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
 
     strategy:
       fail-fast: false
       matrix:
-        # C is included in cpp, no separate C language available on CodeQL
         language:
-          - cpp
+          - c-cpp
           - python
 
+    concurrency:
+      group: ${{ github.workflow }}-${{
+        github.event_name == 'pull_request' &&
+        github.head_ref || github.sha }}-${{ matrix.language }}
+      cancel-in-progress: true
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+      - name: Set up Python
+        uses: actions/setup-python@v5
         with:
-          languages: ${{ matrix.language }}
-          config-file: ./.github/codeql/codeql-config.yml
-
-      - name: Get dependencies
+          python-version: '3.x'
+      - name: Install non-Python dependencies
+        if: ${{ matrix.language == 'c-cpp' }}
         run: |
           sudo apt-get update -y
           sudo apt-get install -y wget git gawk findutils
           xargs -a <(awk '! /^ *(#|$)/' ".github/workflows/apt.txt") -r -- \
               sudo apt-get install -y --no-install-recommends --no-install-suggests
 
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          config-file: ./.github/codeql/codeql-config.yml
+          setup-python-dependencies: false
+
       - name: Create installation directory
         run: |
-          mkdir $HOME/install
+          mkdir "${HOME}/install"
 
       - name: Set LD_LIBRARY_PATH for compilation
         run: |
-          echo "LD_LIBRARY_PATH=$HOME/install/lib" >> $GITHUB_ENV
+          echo "LD_LIBRARY_PATH=${HOME}/install/lib" >> $GITHUB_ENV
+
+      - name: Set number of cores for compilation
+        run: |
+          echo "MAKEFLAGS=-j$(nproc)" >> $GITHUB_ENV
 
       - name: Build
+        if: ${{ matrix.language == 'c-cpp' }}
         env:
           CFLAGS: -std=gnu11
           CXXFLAGS: -std=c++11
-        run: .github/workflows/build_ubuntu-22.04.sh $HOME/install
+        run: .github/workflows/build_ubuntu-22.04.sh "${HOME}/install"
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{matrix.language}}"