AutopilotMonitor/.github/workflows/codeql.yml at main · okieselbach/AutopilotMonitor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: CodeQL

# Documentation-only changes and private-submodule gitlink bumps (internal/, infra/,
# .claude/commands) cannot affect what CodeQL analyzes (C# and TypeScript), so they
# are filtered out rather than spending ~10 minutes to re-report an unchanged result.
# A gitlink bump reports the bare path ('internal', no trailing slash), which
# 'internal/**' does NOT match — both forms are listed. A commit that touches docs
# AND code still runs: GitHub skips only when EVERY changed path matches the filter.
# Same list as ci.yml except that each file leaves itself out; keep them in step.
on:
  push:
    branches: [main]
    paths-ignore:
      - 'internal'
      - 'internal/**'
      - 'infra'
      - 'infra/**'
      - '.claude/**'
      - '.gitmodules'
      - 'zizmor.yml'
      - '**/*.md'
      - 'LICENSE'
      - '.github/ISSUE_TEMPLATE/**'
      - '.github/FUNDING.yml'
      - '.github/dependabot.yml'
      - '.github/assets/**'
      - '.github/scripts/**'
      # Every other workflow: none of them changes the C# or TypeScript CodeQL analyzes.
      # paths-ignore cannot negate, so they are listed one by one; codeql.yml itself and
      # .github/codeql/ stay out of the list. A new workflow file is opt-in — add it here too.
      - '.github/workflows/action-pins.yml'
      - '.github/workflows/bootstrap-script-gates.yml'
      - '.github/workflows/build-agent.yml'
      - '.github/workflows/build-msi.yml'
      - '.github/workflows/ci.yml'
      - '.github/workflows/combine-rules.yml'
      - '.github/workflows/deploy-backend.yml'
      - '.github/workflows/deploy-mcp.yml'
      - '.github/workflows/deploy-web.yml'
      - '.github/workflows/indexnow-notify.yml'
      - '.github/workflows/pester.yml'
      - '.github/workflows/publish-scripts.yml'
  pull_request:
    branches: [main]
    paths-ignore:
      - 'internal'
      - 'internal/**'
      - 'infra'
      - 'infra/**'
      - '.claude/**'
      - '.gitmodules'
      - 'zizmor.yml'
      - '**/*.md'
      - 'LICENSE'
      - '.github/ISSUE_TEMPLATE/**'
      - '.github/FUNDING.yml'
      - '.github/dependabot.yml'
      - '.github/assets/**'
      - '.github/scripts/**'
      # Every other workflow: none of them changes the C# or TypeScript CodeQL analyzes.
      # paths-ignore cannot negate, so they are listed one by one; codeql.yml itself and
      # .github/codeql/ stay out of the list. A new workflow file is opt-in — add it here too.
      - '.github/workflows/action-pins.yml'
      - '.github/workflows/bootstrap-script-gates.yml'
      - '.github/workflows/build-agent.yml'
      - '.github/workflows/build-msi.yml'
      - '.github/workflows/ci.yml'
      - '.github/workflows/combine-rules.yml'
      - '.github/workflows/deploy-backend.yml'
      - '.github/workflows/deploy-mcp.yml'
      - '.github/workflows/deploy-web.yml'
      - '.github/workflows/indexnow-notify.yml'
      - '.github/workflows/pester.yml'
      - '.github/workflows/publish-scripts.yml'
  schedule:
    # Weekly, so advisories published after a merge still surface. Deliberately
    # unfiltered — it re-analyzes the whole tree regardless of what changed, which
    # is also the backstop if the filters above ever skip too much.
    - cron: '17 3 * * 1'

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze ${{ matrix.language }}
    runs-on: ${{ matrix.runner }}
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
          # csharp needs the net48 agent projects to build, so Windows.
          - language: csharp
            runner: windows-latest
            build-mode: manual
          - language: javascript-typescript
            runner: ubuntu-latest
            build-mode: none

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        if: matrix.language == 'csharp'
        with:
          dotnet-version: '10.0.x'

      - name: Initialize CodeQL
        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          config-file: .github/codeql/codeql-config.yml

      - name: Build
        if: matrix.build-mode == 'manual'
        run: dotnet build AutopilotMonitor.sln --configuration Release

      - name: Analyze
        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          category: /language:${{ matrix.language }}