web-xforge/.github/workflows/codeql.yml at master · sillsdev/web-xforge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
name: "CodeQL"
permissions: {}

on:
  push:
    branches: ["master", "develop", "sf-live", "sf-qa"]
  pull_request:
  merge_group:
  schedule:
    - cron: "34 18 * * 2"

jobs:
  analyze-javascript:
    name: Analyze JavaScript
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
        with:
          languages: javascript
          config-file: ./.github/codeql/codeql-javascript-config.yml
          dependency-caching: true

      - name: Autobuild
        uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1

  analyze-csharp:
    name: Analyze C#
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      matrix:
        dotnet_version: ["10.0.x"]
        node_version: ["22.13.0"]
        npm_version: ["11.11.0"]
        pnpm_version: ["11.10.0"]

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: "Deps: .NET"
        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          dotnet-version: ${{matrix.dotnet_version}}
          cache: true
          cache-dependency-path: src/SIL.XForge.Scripture/packages.lock.json

      - name: "Deps: pnpm"
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: ${{matrix.pnpm_version}}

      - name: Use Node.js ${{matrix.node_version}}
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: ${{matrix.node_version}}
          cache: "pnpm"
          cache-dependency-path: |
            src/SIL.XForge.Scripture/ClientApp/pnpm-lock.yaml
            src/RealtimeServer/pnpm-lock.yaml

      - name: Upgrade npm
        run: npm install --global npm@${{matrix.npm_version}}

      # Install PNPM dependencies. This is an attempt to fix errors building TypeScript that occur in the Autobuild step.
      # They might be caused by PNPM dependencies not being successfully installed before trying to build. If this
      # doesn't prevent those errors, we should remove this step.
      # Another possible approach would be to create a C# build config that does not build the realtime server at all,
      # which would result in faster analysis and remove this failure mode.
      - name: Install realtime-server dependencies
        run: cd src/RealtimeServer && (pnpm ci || (sleep 3m && pnpm ci))

      - name: Initialize CodeQL
        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
        with:
          languages: csharp
          queries: security-and-quality
          dependency-caching: true

      - name: Autobuild
        uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
        with:
          upload: False
          output: sarif-results

      - name: filter-sarif
        uses: advanced-security/filter-sarif@bc96d9fb9338c5b48cc440b1b4d0a350b26a20db # v1.0.0
        with:
          patterns: |
            -**/*Tests.cs:cs/hardcoded-credentials
          input: sarif-results/csharp.sarif
          output: sarif-results/csharp.sarif

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
        with:
          sarif_file: sarif-results/csharp.sarif

  analyze-python:
    name: Analyze Python
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
        with:
          languages: python
          queries: security-and-quality
          dependency-caching: true

      - name: Autobuild
        uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1