codeql-analysis.yml

name: CodeQL Analysis

defaults:
  run:
    # bash --noprofile --norc -e(o) pipefail {0}
    shell: bash

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  workflow_dispatch:

concurrency:
  # github.event.pull_request.number || github.ref: pull request number or branch name if not a pull request
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  CHECK_PERMISSIONS: 0

permissions: {}

jobs:
  pre_job:
    name: Check for Duplicate Actions
    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: read
    # Map a step output to a job output
    outputs:
      should_skip: ${{ steps.check-duplicate-actions.outputs.should_skip }}
    steps:
      - id: check-permissions
        name: Check action permissions
        uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0.2-beta9
        if: env.CHECK_PERMISSIONS == '1'
      - id: check-duplicate-actions
        name: Check for duplicate actions
        uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1
        with:
          cancel_others: true
          skip_after_successful_duplicate: true
          concurrent_skipping: same_content_newer
  analyze:
    needs: pre_job
    if: needs.pre_job.outputs.should_skip != 'true'

    name: Analyze (${{ matrix.language }})
    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
    permissions:
      security-events: write # Required for all workflows
      contents: write # Need to push changes
      pull-requests: read # Need to check if PR
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: csharp
            build-mode: manual

    env:
      NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
      DOTNET_NOLOGO: true
      DOTNET_CLI_TELEMETRY_OPTOUT: true

    steps:
      - id: check-permissions
        name: Check action permissions
        uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0.2-beta9
        if: env.CHECK_PERMISSIONS == '1'
      - id: checkout-repo
        name: Checkout repo
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 2
          persist-credentials: true # Need for next step.
      - id: filter
        name: Check for changed files
        if: ${{ github.event_name != 'workflow_dispatch' }}
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        with:
          filters: .github/filter.yml

      - id: set-env
        name: Set environment variable
        run: |
          if [[ "${EVENT_NAME}" == "workflow_dispatch" ]] ||
             [[ "${IS_CODE}" == "true" ]] ||
             [[ "${IS_CODEQL}" == "true" ]]; then
            echo "ENABLED=1" >> $GITHUB_ENV
          else
            echo "ENABLED=0" >> $GITHUB_ENV
          fi
        env:
          EVENT_NAME: ${{ github.event_name }}
          IS_CODE: ${{ steps.filter.outputs.code }}
          IS_CODEQL: ${{ steps.filter.outputs.codeql }}

      # Initializes the CodeQL tools for scanning.
      - id: init-codeql
        name: Initialize CodeQL
        if: env.ENABLED == '1'
        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          dependency-caching: true
      - id: setup-dotnet
        name: Set up .NET
        if: matrix.build-mode == 'manual' && env.ENABLED == '1'
        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
        with:
          cache: true
          dotnet-version: 10.0.x
          cache-dependency-path: "**/packages.lock.json"

      - id: dotnet-restore
        name: Restore NuGet packages
        if: matrix.build-mode == 'manual' && env.ENABLED == '1'
        run: |
          if [[ "${PR_LOGIN}" == 'dependabot[bot]' ]]; then
            dotnet restore --force-evaluate && git add .
          else
            dotnet restore --locked-mode
          fi
        env:
          PR_LOGIN: ${{ github.event.pull_request.user.login }}

      - id: commit-changes
        name: Commit changes
        if: matrix.build-mode == 'manual' && env.ENABLED == '1'
        uses: qoomon/actions--create-commit@7102b1a8b3cb8716dc70dbeb6d774c375d779d2f # v1.2.5
        with:
          message: Committing changes to lock files [skip ci]
          allow-empty: false
          skip-empty: true

      - id: push-changes
        name: Push changes
        if: matrix.build-mode == 'manual' && env.ENABLED == '1' && steps.commit-changes.outputs.commit != null
        env:
          HEAD_REF: ${{ github.head_ref || github.ref_name }}
        run: git push origin HEAD:$HEAD_REF

      - id: pr-check
        name: Check if PR for current commit
        if: env.ENABLED == '1'
        uses: 8BitJonny/gh-get-current-pr@4056877062a1f3b624d5d4c2bedefa9cf51435c9 # 4.0.0
        with:
          # This will work no matter the trigger event and no matter if it is the first PR commit or not.
          sha: ${{ github.event.pull_request.head.sha }}
          # By default it returns PRs in any state.
          filterOutClosed: true
          # By default it returns PRs in any state.
          filterOutDraft: true

      - id: dotnet-restore-locked
        name: Restore NuGet packages (locked)
        # No PR found implies not Dependabot-related.
        if: env.ENABLED == '1' && steps.pr-check.outputs.pr_found == 'false'
        run: |
          dotnet restore --locked-mode

      - id: build
        name: Build
        if: matrix.build-mode == 'manual' && env.ENABLED == '1'
        run: dotnet build --configuration Release --no-restore --tl

      - id: codeql-analysis
        name: Perform CodeQL Analysis
        if: env.ENABLED == '1'
        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          # yamllint disable-line
          category: "/language:${{matrix.language}}"