_codeql.yml

name: "CodeQL"

on:
  workflow_call:
    inputs:
      configuration:
        description: 'The build configuration'
        default: Release
        type: string
      dotnet-target:
        description: 'The target .NET version'
        required: true
        type: string
      artifact-name:
        description: 'The artifact name'
        required: true
        type: string

jobs:
  analyze:
    name: Analyze
    # Runner size impacts CodeQL analysis time. To learn more, please see:
    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
    #   - https://gh.io/supported-runners-and-hardware-resources
    #   - https://gh.io/using-larger-runners
    runs-on: 'ubuntu-latest'
    timeout-minutes: 360
    permissions:
      actions: read
      contents: read
      security-events: write
    env:
      DOTNET_TARGET: ${{ inputs.dotnet-target }}
      CONFIGURATION: ${{ inputs.configuration }}

    # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
    strategy:
      fail-fast: false
      matrix:
        language: [ 'csharp' ]

    steps:
    - name: Download artifact from build job
      id: artifacts
      uses: actions/download-artifact@v4
      with:
        name: ${{ inputs.artifact-name }}
        path: ${{ inputs.artifact-name }}

    # https://github.com/actions/setup-dotnet
    - name: Get .NET externals
      uses: actions/setup-dotnet@v4

    # Initialize the CodeQL tools for scanning. Prefix the query list with "+" to use these queries and those in the config file.
    # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        queries: security-extended,security-and-quality

    # List project files in the folder, then build each one. Double quotes around the `$project` variable ensures that paths with spaces are handled correctly.
    - name: Build all projects in the solution
      shell: pwsh
      run: |
        Get-ChildItem -Path . -Filter "*.csproj" -File -Recurse | ForEach-Object {
          dotnet build $_.FullName --configuration $ENV:CONFIGURATION --framework $ENV:DOTNET_TARGET
        }

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{matrix.language}}"