codeql.yml

name: CodeQL SAST

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "23 9 * * 3"
  workflow_dispatch:

env:
  BUILD_CONFIG: release
  DOTNET_VERSION: 8
  DOTNET_INSTALL_DIR: "~/.dotnet"

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
        with:
          submodules: true

      - name: Cache dotnet
        id: cache-dotnet
        uses: actions/cache@v3
        with:
          path: ${{ env.DOTNET_INSTALL_DIR }}
          key: ${{ runner.os }}-dotnet-${{ env.DOTNET_VERSION }}
          restore-keys: ${{ runner.os }}-dotnet-${{ env.DOTNET_VERSION }}

      - name: Set up .NET
        if: ${{ steps.cache-dotnet.outputs.cache-hit != 'true' }}
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Initialize CodeQL
        uses: github/codeql-action/init@5618c9fc1e675841ca52c1c6b1304f5255a905a0 # v2.19.0
        with:
          languages: csharp

      - name: Cache nuget
        uses: actions/cache@v3
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }}
          restore-keys: |
            ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }}
      - name: Build Paprika
        run: |
          dotnet restore src/Paprika.sln
          dotnet build src/Paprika.sln -c ${{ env.BUILD_CONFIG }} -v d
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@5618c9fc1e675841ca52c1c6b1304f5255a905a0 # v2.19.0