name: CodeQL Scan

on:
  push:
    branches: [ "master" ]
    paths-ignore:
      - '**/*.md'
      - '**/*.gitignore'
      - '**/*.gitattributes'
  pull_request:
    branches: [ "master" ]
  schedule:
    - cron: '15 5 * * 5'

permissions:  # added using https://github.com/step-security/secure-workflows
  contents: read

env:
  DOTNET_NOLOGO: true                     # Disable the .NET logo in the console output
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true # Disable the .NET first time experience to skip caching NuGet packages and speed up the build
  DOTNET_CLI_TELEMETRY_OPTOUT: true       # Disable sending .NET CLI telemetry to Microsoft

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'csharp' ]

    steps:
    
    - name: Harden Runner
      uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34
      with:
        egress-policy: block
        allowed-endpoints: >
          api.github.com:443
          api.nuget.org:443
          dotnetbuilds.azureedge.net:443
          dotnetcli.azureedge.net:443
          dotnetcli.blob.core.windows.net:443
          github.com:443
          uploads.github.com:443

    - name: Checkout repository
      uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8

    - name: Initialize CodeQL
      uses: github/codeql-action/init@cc7986c02bac29104a72998e67239bb5ee2ee110
      with:
        languages: ${{ matrix.language }}
        # queries: security-extended,security-and-quality # https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs

    - name: Setup .Net
      uses: actions/setup-dotnet@4d4a70f4a5b2a5a5329f13be4ac933f2c9206ac0
      with:
        dotnet-version: 6.0.x

    - name: Restore Dependencies
      run: dotnet restore src/CodeCoverageSummary.sln

    - name: Build CodeCoverageSummary
      run: dotnet build src/CodeCoverageSummary.sln --configuration Release --no-restore /p:UseSharedCompilation=false

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@cc7986c02bac29104a72998e67239bb5ee2ee110