ImageOptimizer/.github/workflows/codeql.yml at master · madskristensen/ImageOptimizer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "CodeQL Analysis"

on:
  pull_request:
    branches: [ "master" ]
  schedule:
    - cron: '30 1 * * 0'  # Weekly on Sunday at 01:30 UTC

jobs:
  check-commits:
    name: Check for new commits
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule'
    permissions:
      actions: read
      contents: read
    outputs:
      has_new_commits: ${{ steps.check.outputs.has_new_commits }}
    steps:
      - name: Check for commits since last successful run
        id: check
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          last_run=$(gh api "repos/${{ github.repository }}/actions/workflows/codeql.yml/runs?status=success&per_page=1" \
            --jq '.workflow_runs[0].updated_at')

          if [ -z "$last_run" ] || [ "$last_run" = "null" ]; then
            echo "No previous successful run found, proceeding with analysis"
            echo "has_new_commits=true" >> "$GITHUB_OUTPUT"
          else
            commit_count=$(gh api "repos/${{ github.repository }}/commits?sha=master&since=$last_run" --jq 'length')
            if [ "$commit_count" -gt "0" ]; then
              echo "Found $commit_count new commit(s) since last successful run ($last_run)"
              echo "has_new_commits=true" >> "$GITHUB_OUTPUT"
            else
              echo "No new commits to master since last successful run ($last_run), skipping analysis"
              echo "has_new_commits=false" >> "$GITHUB_OUTPUT"
            fi
          fi

  analyze:
    name: Analyze (csharp)
    runs-on: windows-latest
    needs: [check-commits]
    if: |
      always() &&
      (github.event_name == 'pull_request' ||
       (github.event_name == 'schedule' && needs.check-commits.outputs.has_new_commits == 'true'))
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: csharp

    - name: Setup .NET build dependencies
      uses: timheuer/bootstrap-dotnet@v1
      with:
        nuget: 'false'
        sdk: 'false'
        msbuild: 'true'

    - name: Cache NuGet packages
      uses: actions/cache@v4
      with:
        path: ~/.nuget/packages
        key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.slnx', '**/*.sln', '**/*.csproj', '**/packages.config', '**/packages.lock.json', '**/nuget.config') }}
        restore-keys: |
          ${{ runner.os }}-nuget-

    - name: Restore NuGet packages
      run: msbuild /v:m /t:restore

    - name: Build
      run: msbuild /v:m

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:csharp"