QuickShell/.github/workflows/codeql.yml at master · tonythethompson/QuickShell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
name: CodeQL

on:
  push:
    branches:
      - main
      - master
    paths:
      - "**/*.cs"
      - "**/*.csproj"
      - "**/*.sln"
      - "QuickShell.Raycast/**"
      - ".github/workflows/codeql.yml"
      - ".github/codeql/**"
  pull_request:
    paths:
      - "**/*.cs"
      - "**/*.csproj"
      - "**/*.sln"
      - "QuickShell.Raycast/**"
      - ".github/workflows/codeql.yml"
      - ".github/codeql/**"
  schedule:
    - cron: "17 3 * * 0"
  workflow_dispatch:

permissions:
  actions: read
  contents: read
  security-events: write

concurrency:
  group: codeql-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      dotnet: ${{ steps.filter.outputs.dotnet }}
      raycast: ${{ steps.filter.outputs.raycast }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Detect changed areas
        uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            dotnet:
              - '**/*.cs'
              - '**/*.csproj'
              - '**/*.sln'
              - '.github/workflows/codeql.yml'
              - '.github/codeql/**'
            raycast:
              - 'QuickShell.Raycast/**'
              - '.github/workflows/codeql.yml'

  analyze-csharp:
    name: Analyze C# with CodeQL
    needs: changes
    if: |
      needs.changes.outputs.dotnet == 'true' ||
      github.event_name == 'pull_request' ||
      github.event_name == 'schedule' ||
      github.event_name == 'workflow_dispatch'
    runs-on: windows-latest
    timeout-minutes: 90

    env:
      DOTNET_NOLOGO: true
      DOTNET_CLI_TELEMETRY_OPTOUT: true
      NUGET_XMLDOC_MODE: skip

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: 10.0.x

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: csharp
          config-file: ./.github/codeql/codeql-config.yml

      - name: Restore solution
        run: dotnet restore QuickShell.sln --verbosity minimal
        shell: pwsh

      - name: Build solution
        run: dotnet build QuickShell.sln -c Release -p:Platform=x64 --no-restore --verbosity minimal
        shell: pwsh

      - name: Test core project
        run: dotnet test QuickShell.Core.Tests/QuickShell.Core.Tests.csproj -c Release -p:Platform=x64 --no-build --verbosity minimal
        shell: pwsh

      - name: Analyze
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:csharp"

  analyze-javascript:
    name: Analyze Raycast TypeScript with CodeQL
    needs: changes
    if: |
      needs.changes.outputs.raycast == 'true' ||
      github.event_name == 'pull_request' ||
      github.event_name == 'schedule' ||
      github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 45
    defaults:
      run:
        working-directory: QuickShell.Raycast

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version-file: QuickShell.Raycast/.nvmrc
          cache: npm
          cache-dependency-path: QuickShell.Raycast/package-lock.json

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript
          queries: security-and-quality

      - name: Install dependencies
        run: npm ci

      - name: Build extension
        run: npm run build

      - name: Analyze
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:javascript-typescript"