codeql-analysis.yml

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
name: "CodeQL"

on:
  push:
    branches: [develop]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [develop]
  schedule:
    - cron: '0 15 * * 6'
  workflow_dispatch:

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-24.04

    strategy:
      fail-fast: false
      matrix:
        # Override automatic language detection by changing the below list
        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
        language: ['csharp']
        # Learn more...
        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection

    steps:
    - name: Checkout repository
      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
      with:
        fetch-depth: 0

    - name: Install dotnet
      uses: actions/setup-dotnet@2016bd2012dba4e32de620c46fe006a3ac9f0602 # v5
      with:
        # codecov needs 2.1
        # unittests needs 3.1
        # gitversion needs 5.0
        dotnet-version: |
          2.1.x
          3.1.x
          5.0.x
          6.0.x
          7.0.x
          8.0.x

    - name: Cache Tools
      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
      with:
        path: tools
        key: ${{ runner.os }}-tools-${{ hashFiles('recipe.cake') }}

    - name: Install mono
      if: runner.os == 'Linux'
      # check https://www.mono-project.com/download/stable/#download-lin
      run: |
        sudo apt install ca-certificates gnupg
        sudo gpg --homedir /tmp --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/mono-official-archive-keyring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF
        sudo chmod +r /usr/share/keyrings/mono-official-archive-keyring.gpg
        echo "deb [signed-by=/usr/share/keyrings/mono-official-archive-keyring.gpg] https://download.mono-project.com/repo/ubuntu stable-focal main" | sudo tee /etc/apt/sources.list.d/mono-official-stable.list
        sudo apt update
        sudo apt install -y mono-complete
        mono --version

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    - name: Build project
      uses: cake-build/cake-action@d218f1133bb74a1df0b08c89cfd8fc100c09e1a0 # v3
      with:
        script-path: recipe.cake
        target: DotNet-Build
        cake-version: tool-manifest
      env:
        COMPlus_DbgEnableMiniDump: 1
        COMPlus_DbgMiniDumpType: 1
        COMPlus_DbgMiniDumpName: BuildArtifacts/coredump.dmp

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4

    - name: Upload CoreDump
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
      if: failure()
      with:
        if-no-files-found: warn
        name: CoreDump
        path: BuildArtifacts/coredump.dmp