codeql.yml

name: CodeQL

# GitHub-native semantic security scanning for the C# code. Runs on
# every push + PR to main, plus a weekly schedule so newly-disclosed
# CodeQL rules catch existing code. Findings appear under the repo
# Security tab. Complements the dependency CVE scan that pre-push
# and CI already run.
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Mondays at 06:00 UTC.
    - cron: '0 6 * * 1'

permissions:
  actions: read
  contents: read
  security-events: write

jobs:
  analyze:
    name: Analyze C#
    runs-on: windows-latest
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v6

      # The UI assembly references ACT.exe, so we need to fetch ACT
      # for CodeQL's autobuild step to succeed across the whole sln.
      - name: Fetch ACT for build reference
        shell: pwsh
        run: |
          $url = "https://github.com/EQAditu/AdvancedCombatTracker/releases/latest/download/ACTv3.zip"
          Invoke-WebRequest -Uri $url -OutFile ACTv3.zip -UseBasicParsing
          Expand-Archive -Path ACTv3.zip -DestinationPath C:\ACT -Force
          if (-not (Test-Path "C:\ACT\Advanced Combat Tracker.exe")) {
            throw "ACT exe not found in extracted zip"
          }
          "ACT_INSTALL_DIR=C:\ACT" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v5
        with:
          global-json-file: global.json

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: csharp
          # security-extended = the broader security ruleset without
          # the quality/style noise (missed-LINQ, catch-of-all-exceptions,
          # virtual-call-in-constructor, etc.). We intentionally catch
          # general Exception in several defensive paths to keep ACT
          # from crashing on plugin errors, and the WinForms-style
          # property-set-in-constructor in SettingsPanel is idiomatic.
          queries: security-extended

      - name: Build
        run: dotnet build EQ2Lexicon.ACTPlugin.sln -c Release

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:csharp