CodeQL #41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| push: | |
| branches: | |
| - main | |
| schedule: | |
| # Weekly scan so newly published queries also cover unchanged code. | |
| - cron: "26 7 * * 1" | |
| permissions: | |
| contents: read | |
| env: | |
| CONFIGURATION: Release | |
| DOTNET_CLI_TELEMETRY_OPTOUT: true | |
| DOTNET_NOLOGO: true | |
| DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true | |
| NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages | |
| NUGET_CONFIG: NuGet.config | |
| SOLUTION: ResXLocalization.slnx | |
| jobs: | |
| analyze: | |
| name: Analyze C# | |
| # Windows so the full solution — including the Windows-only WPF projects — compiles for | |
| # real. A traced build resolves call targets and generated source (XAML *.g.cs, source | |
| # generators) that buildless extraction cannot, keeping the analysis quality metrics | |
| # above their thresholds. | |
| runs-on: windows-latest | |
| timeout-minutes: 45 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 | |
| with: | |
| dotnet-version: | | |
| 8.0.x | |
| 10.0.x | |
| dotnet-quality: ga | |
| - name: Cache NuGet packages | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 | |
| with: | |
| path: ${{ env.NUGET_PACKAGES }} | |
| key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/*.props', '**/*.targets', '**/*.slnx', '.config/dotnet-tools.json') }} | |
| restore-keys: | | |
| ${{ runner.os }}-nuget- | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 | |
| with: | |
| languages: csharp | |
| build-mode: manual | |
| - name: Restore | |
| run: dotnet restore ${{ env.SOLUTION }} --configfile ${{ env.NUGET_CONFIG }} | |
| # UseSharedCompilation=false is required for CodeQL's tracer to observe every compiler | |
| # invocation; the shared build server would hide them. | |
| - name: Build | |
| run: dotnet build ${{ env.SOLUTION }} --configuration ${{ env.CONFIGURATION }} --no-restore /p:UseSharedCompilation=false | |
| - name: Analyze | |
| uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 | |
| with: | |
| category: "/language:csharp" |