Bump the pkg-updates group with 1 update (#513) #1215
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL Analysis | |
| defaults: | |
| run: | |
| # bash --noprofile --norc -e(o) pipefail {0} | |
| shell: bash | |
| on: | |
| push: | |
| branches: [master] | |
| paths: | |
| - 'src/**' | |
| - 'tests/**' | |
| - '.github/workflows/codeql-analysis.yml' | |
| - '**/*.cs' | |
| - '**/*.csproj' | |
| - '**/Directory.*.props' | |
| - '**/*.slnx?' | |
| - '**/packages.lock.json' | |
| pull_request: | |
| branches: [master] | |
| paths: | |
| - 'src/**' | |
| - 'tests/**' | |
| - '.github/workflows/codeql-analysis.yml' | |
| - '**/*.cs' | |
| - '**/*.csproj' | |
| - '**/Directory.*.props' | |
| - '**/*.slnx?' | |
| - '**/packages.lock.json' | |
| workflow_dispatch: | |
| concurrency: | |
| # github.event.pull_request.number || github.ref: pull request number or branch name if not a pull request | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CHECK_PERMISSIONS: 0 | |
| permissions: {} | |
| jobs: | |
| pre_job: | |
| name: Check for Duplicate Actions | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| actions: write | |
| contents: read | |
| outputs: | |
| should_skip: ${{ steps.check-duplicate-actions.outputs.should_skip }} | |
| steps: | |
| - id: check-permissions | |
| name: Check action permissions | |
| uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0.2-beta9 | |
| if: env.CHECK_PERMISSIONS == '1' | |
| - id: check-duplicate-actions | |
| name: Check for duplicate actions | |
| uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1 | |
| with: | |
| cancel_others: true | |
| skip_after_successful_duplicate: true | |
| concurrent_skipping: same_content_newer | |
| analyze: | |
| needs: pre_job | |
| if: needs.pre_job.outputs.should_skip != 'true' | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} | |
| timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }} | |
| permissions: | |
| security-events: write # Required for all workflows | |
| contents: write # Need to push changes | |
| pull-requests: read # Need to check if PR | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: csharp | |
| build-mode: manual | |
| env: | |
| NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages | |
| DOTNET_NOLOGO: true | |
| DOTNET_CLI_TELEMETRY_OPTOUT: true | |
| steps: | |
| - id: check-permissions | |
| name: Check action permissions | |
| uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0.2-beta9 | |
| if: env.CHECK_PERMISSIONS == '1' | |
| - id: checkout-repo | |
| name: Checkout repo | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 2 | |
| persist-credentials: true # Need for next step. | |
| - id: init-codeql | |
| name: Initialize CodeQL | |
| uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| dependency-caching: true | |
| - id: setup-dotnet | |
| name: Set up .NET | |
| if: matrix.build-mode == 'manual' | |
| uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 | |
| with: | |
| cache: true | |
| dotnet-version: 10.0.x | |
| cache-dependency-path: "**/packages.lock.json" | |
| - id: dotnet-restore | |
| name: Restore NuGet packages | |
| if: matrix.build-mode == 'manual' | |
| run: | | |
| if [[ "${PR_LOGIN}" == "dependabot[bot]" ]]; then | |
| dotnet restore --force-evaluate && git add . | |
| else | |
| dotnet restore --locked-mode | |
| fi | |
| env: | |
| PR_LOGIN: ${{ github.event.pull_request.user.login || '' }} | |
| - id: commit-changes | |
| name: Commit changes | |
| if: matrix.build-mode == 'manual' | |
| uses: qoomon/actions--create-commit@7102b1a8b3cb8716dc70dbeb6d774c375d779d2f # v1.2.5 | |
| with: | |
| message: Committing changes to lock files [skip ci] | |
| allow-empty: false | |
| skip-empty: true | |
| - id: push-changes | |
| name: Push changes | |
| if: matrix.build-mode == 'manual' && steps.commit-changes.outputs.commit != null | |
| env: | |
| HEAD_REF: ${{ github.head_ref || github.ref_name }} | |
| run: git push origin HEAD:$HEAD_REF | |
| - id: pr-check | |
| name: Check if PR for current commit | |
| uses: 8BitJonny/gh-get-current-pr@4056877062a1f3b624d5d4c2bedefa9cf51435c9 # 4.0.0 | |
| with: | |
| # This will work no matter the trigger event and no matter if it is the first PR commit or not. | |
| sha: ${{ github.event.pull_request.head.sha }} | |
| # By default it returns PRs in any state. | |
| filterOutClosed: true | |
| # By default it returns PRs in any state. | |
| filterOutDraft: true | |
| - id: dotnet-restore-locked | |
| name: Restore NuGet packages (locked) | |
| # No PR found implies not Dependabot-related. | |
| if: steps.pr-check.outputs.pr_found == 'false' | |
| run: | | |
| dotnet restore --locked-mode | |
| - id: build | |
| name: Build | |
| if: matrix.build-mode == 'manual' | |
| run: dotnet build --configuration Release --no-restore --tl | |
| - id: codeql-analysis | |
| name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | |
| with: | |
| # yamllint disable-line | |
| category: "/language:${{matrix.language}}" |