codeql-analysis.yml

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  push:
    branches: [ main ]
    paths:
      - '.github/workflows/codeql-analysis.yml'
      - 'scripts/*.py'
      - 'archive/c/c/*.c'
      - 'archive/c/c-plus-plus/*.cpp'
      - 'archive/c/c-sharp/*.cs'
      - 'archive/g/go/*.go'
      - 'archive/j/java/*.java'
      - 'archive/j/javascript/*.js'
      - 'archive/k/kotlin/*.kt'
      - 'archive/p/python/*.py'
      - 'archive/r/ruby/*.rb'
      - 'archive/s/swift/*.swift'
      - 'archive/t/typescript/*.ts'
  pull_request:
    branches: 
      - 'main'
    paths:
      - '.github/workflows/codeql-analysis.yml'
      - 'scripts/*.py'
      - 'archive/c/c/*.c'
      - 'archive/c/c-plus-plus/*.cpp'
      - 'archive/c/c-sharp/*.cs'
      - 'archive/g/go/*.go'
      - 'archive/j/java/*.java'
      - 'archive/j/javascript/*.js'
      - 'archive/k/kotlin/*.kt'
      - 'archive/p/python/*.py'
      - 'archive/r/ruby/*.rb'
      - 'archive/s/swift/*.swift'
      - 'archive/t/typescript/*.ts'
  schedule:
    # Run every Thursday at 4:53 UTC (randomly chosen)
    - cron: '53 4 * * 6'
  
jobs:
  # We need this job to check if changed files should trigger analysis
  changed-files:
    name: "Changed Files"
    runs-on: ubuntu-latest

    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
      changed-files: ${{ steps.changed-files.outputs.all_changed_files }}
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 2

    - name: Get changed code files
      id: changed-files
      uses: tj-actions/changed-files@v45

    - name: List all relevant changed files
      if: steps.changed-files.outputs.any_changed == 'true'
      env:
        ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
      run: |
        for file in ${ALL_CHANGED_FILES}; do
          echo "$file was changed"
        done

    # Reference: https://stackoverflow.com/questions/65384420/how-do-i-make-a-github-action-matrix-element-conditional
    - name: Get CodeQL Languages
      id: set-matrix
      run: |
        matrix=$(python scripts/get_codeql_languages.py --event ${{ github.event_name}} ${{ steps.changed-files.outputs.all_changed_files }})
        echo "${matrix}"
        echo "matrix={\"include\": ${matrix}}" >> $GITHUB_OUTPUT

  analyze:
    name: Analyze
    needs: changed-files
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.changed-files.outputs.matrix) }}
        # Learn more:
        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed

    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        fetch-depth: 2

    - name: Install Java 23
      if: ${{ matrix.language == 'java' }}
      uses: actions/setup-java@v4
      with:
        distribution: 'oracle'
        java-version: '23'

    - name: Install C# compiler
      if: ${{ matrix.language == 'c#' }}
      run: sudo apt-get update && sudo apt-get install -y mono-mcs

    - name: Remove ignored paths
      if: ${{ github.event_name == 'pull_request' }}
      run: rm -f ${{ matrix.paths-ignore }}

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: "3.11"

    - name: Run Poetry Image
      uses: abatilo/actions-poetry@v3
      with:
        poetry-version: "1.8.5"
        
    - name: Install Dependencies
      run: poetry install
        
    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
      if: ${{ matrix.build-mode != 'manual' }}
      uses: github/codeql-action/autobuild@v3

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl

    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
    #    and modify them (or add more) to build your code if your project
    #    uses a compiled language

    - name: Manual build
      if: ${{ matrix.build-mode == 'manual' }}
      run: poetry run python scripts/build_codeql_language.py ${{ matrix.language }} ${{ matrix.paths }}

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3