codeql.yml

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  push:
    branches: [ "main" ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ "main" ]
  schedule:
    - cron: '28 20 * * 1'

env:
  DOTNET_GENERATE_ASPNET_CERTIFICATE: false
  DOTNET_NOLOGO: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
        language: [ 'csharp', 'javascript-typescript' ]

    steps:
    - name: 🛡️ Harden Runner
      uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
      with:
        disable-sudo: true
        egress-policy: block
        allowed-endpoints: >
          *.azureedge.net:443
          *.digicert.com:80
          *.github.com:443
          *.ws.symantec.com:80
          aka.ms:443
          github.com:443
          api.nuget.org:443
          builds.dotnet.microsoft.com:443
          cdn.fwupd.org:443
          ci.dot.net:443
          dc.services.visualstudio.com:443
          objects.githubusercontent.com:443
          registry.npmjs.org:443
          s.symcb.com:80
          s.symcd.com:80
          www.microsoft.com:80

    - name: 🛒 Checkout repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0

    - name: 🧰 Setup .NET
      uses: actions/setup-dotnet@3951f0dfe7a07e2313ec93c75700083e2005cbab # v4.3.0
      with:
        dotnet-version: |
          6.x
          8.x
        global-json-file: global.json
      if: matrix.language == 'csharp'

    - name: 🗃️ Setup NuGet cache
      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
      with:
        path: ~/.nuget/packages
        key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
        restore-keys: ${{ runner.os }}-nuget-
      if: matrix.language == 'csharp'

    - name: 🧰 Setup Node
      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
      with:
        node-version: 20
        cache: npm
        cache-dependency-path: docs/package-lock.json
      if: matrix.language == 'javascript-typescript'

    # Initializes the CodeQL tools for scanning.
    - name: 🛠️ Initialize CodeQL
      uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.

        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
        # queries: security-extended,security-and-quality

    - name: 📥 Restore dependencies
      run: dotnet restore --locked-mode
      if: matrix.language == 'csharp'

    - name: 🏗️ Build
      run: dotnet build --no-restore -c Release
      if: matrix.language == 'csharp'

    - name: 📥 Install dependencies
      run: npm ci
      working-directory: docs
      if: matrix.language == 'javascript-typescript'

    - name: 🏗️ Build with VitePress
      run: npm run docs:build
      working-directory: docs
      if: matrix.language == 'javascript-typescript'

    - name: 🔍 Perform CodeQL Analysis
      uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
      with:
        category: "/language:${{matrix.language}}"