github-delivery/.github/workflows/codeql.yml at main · Wibias/github-delivery · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: CodeQL

on:
  push:
    branches:
      - main
  pull_request:
  schedule:
    - cron: "17 4 * * 3"

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  scope:
    name: Detect CodeQL scope
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      javascript: ${{ steps.scope.outputs.javascript }}
      csharp: ${{ steps.scope.outputs.csharp }}
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Node.js 24
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          package-manager-cache: false

      - name: Detect CodeQL scope
        id: scope
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          set -euo pipefail
          if [[ "${EVENT_NAME}" != "pull_request" ]]; then
            echo "javascript=true" >> "${GITHUB_OUTPUT}"
            echo "csharp=true" >> "${GITHUB_OUTPUT}"
            exit 0
          fi

          TRUSTED_SCOPE="${RUNNER_TEMP}/github-delivery-ci-scope-base.mjs"
          git show "${BASE_SHA}:scripts/ci-scope.mjs" > "${TRUSTED_SCOPE}"
          if git diff --name-only -z "${BASE_SHA}"...HEAD |
            node "${TRUSTED_SCOPE}" --mode codeql >> "${GITHUB_OUTPUT}"; then
            exit 0
          fi
          echo "::warning::Base CI scope classifier does not support CodeQL mode; fail-closed to running both analyses."
          echo "javascript=true" >> "${GITHUB_OUTPUT}"
          echo "csharp=true" >> "${GITHUB_OUTPUT}"

  analyze:
    name: CodeQL / Analyze (javascript-typescript)
    needs: scope
    if: always() && (needs.scope.result != 'success' || github.event_name != 'pull_request' || needs.scope.outputs.javascript == 'true')
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      packages: read
      security-events: write
    steps:
      - name: Fail closed when scope detection failed
        if: needs.scope.result != 'success'
        run: |
          echo "::error::Detect CodeQL scope did not complete successfully."
          exit 1

      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          languages: javascript-typescript

      - name: Autobuild
        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9

      - name: Analyze
        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          category: "/language:javascript-typescript"

  analyze-csharp:
    name: CodeQL / Analyze (csharp)
    needs: scope
    if: always() && (needs.scope.result != 'success' || github.event_name != 'pull_request' || needs.scope.outputs.csharp == 'true')
    runs-on: windows-latest
    timeout-minutes: 30
    permissions:
      contents: read
      packages: read
      security-events: write
    steps:
      - name: Fail closed when C# scope detection failed
        if: needs.scope.result != 'success'
        run: |
          echo "::error::Detect CodeQL scope did not complete successfully."
          exit 1

      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          global-json-file: global.json

      - name: Initialize CodeQL
        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          languages: csharp
          build-mode: manual

      - name: Build C# authority host
        shell: pwsh
        run: |
          $Project = 'authority-host/windows/GitHubDeliveryAuthority/GitHubDeliveryAuthority.csproj'
          dotnet restore $Project --locked-mode
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          dotnet build $Project --configuration Release --runtime win-x64 --no-restore
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Analyze
        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          category: "/language:csharp"