codeql.yml

name: CodeQL

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
  schedule:
    # Weekly scan so newly published queries also cover unchanged code.
    - cron: "26 7 * * 1"

permissions:
  contents: read

env:
  CONFIGURATION: Release
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_NOLOGO: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  NUGET_CONFIG: NuGet.config
  NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
  SOLUTION: DbConnectionPlus.slnx

jobs:
  analyze:
    name: Analyze C#
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
      security-events: write

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: |
            8.0.x
            10.0.x
          dotnet-quality: ga

      - name: Cache NuGet packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ${{ env.NUGET_PACKAGES }}
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/*.props', '**/*.targets', '**/*.slnx', '.config/dotnet-tools.json') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      # A traced build rather than buildless extraction: it resolves call targets across the six shipping
      # projects and the adapter seam, which is where a real finding in this codebase would live.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          languages: csharp
          build-mode: manual

      - name: Restore
        run: dotnet restore ${{ env.SOLUTION }} --configfile ${{ env.NUGET_CONFIG }}

      # UseSharedCompilation=false is required for CodeQL's tracer to observe every compiler invocation; the
      # shared build server would hide them.
      - name: Build
        run: dotnet build ${{ env.SOLUTION }} --configuration ${{ env.CONFIGURATION }} --no-restore /p:UseSharedCompilation=false

      - name: Analyze
        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          category: "/language:csharp"