web-xforge/.github/workflows/codeql.yml at 6e057b57d2a222a570beffe4da424806331f5bb3 · sillsdev/web-xforge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
name: "CodeQL"
permissions: {}

on:
  push:
    branches: ["master", "develop", "sf-live", "sf-qa"]
  pull_request:
  merge_group:
  schedule:
    - cron: "34 18 * * 2"

jobs:
  analyze-javascript:
    name: Analyze JavaScript
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: javascript
          config-file: ./.github/codeql/codeql-javascript-config.yml
          dependency-caching: true

      - name: Autobuild
        uses: github/codeql-action/autobuild@v4

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4

  analyze-csharp:
    name: Analyze C#
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      matrix:
        dotnet_version: ["8.0.x"]
        node_version: ["22.13.0"]
        npm_version: ["10.9.2"]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: "Deps: .NET"
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{matrix.dotnet_version}}
          cache: true
          cache-dependency-path: src/SIL.XForge.Scripture/packages.lock.json

      - name: Use Node.js ${{ matrix.node_version }}
        uses: actions/setup-node@v5
        with:
          node-version: ${{ matrix.node_version }}
          cache: "npm"
          cache-dependency-path: |
            src/SIL.XForge.Scripture/ClientApp/package-lock.json
            src/RealtimeServer/package-lock.json

      - name: Upgrade npm
        run: npm install -g npm@${{matrix.npm_version}}

      # Install NPM dependencies. This is an attempt to fix errors building TypeScript that occur in the Autobuild step.
      # They might be caused by NPM dependencies not being successfully installed before trying to build. If this
      # doesn't prevent those errors, we should remove this step.
      # Another possible approach would be to create a C# build config that does not build the realtime server at all,
      # which would result in faster analysis and remove this failure mode.
      - name: Install realtime-server dependencies
        run: cd src/RealtimeServer && (npm ci || (sleep 3m && npm ci))

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: csharp
          queries: security-and-quality
          dependency-caching: true

      - name: Autobuild
        uses: github/codeql-action/autobuild@v4

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          upload: False
          output: sarif-results

      - name: filter-sarif
        uses: advanced-security/filter-sarif@v1
        with:
          patterns: |
            -**/*Tests.cs:cs/hardcoded-credentials
          input: sarif-results/csharp.sarif
          output: sarif-results/csharp.sarif

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: sarif-results/csharp.sarif

  analyze-python:
    name: Analyze Python
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: python
          queries: security-and-quality
          dependency-caching: true

      - name: Autobuild
        uses: github/codeql-action/autobuild@v4

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4