step-dotnet-codeql.yml

on:
  workflow_call:
    inputs:
      dotnet-logging:
        required: false
        type: string
        default: quiet
      dotnet-version:
        required: false
        type: string
        default: 8.x
      dotnet-quality:
        required: false
        type: string
        default: ga
      runs-on:
        required: false
        type: string
        default: ubuntu-latest
      solution:
        required: true
        type: string
    secrets:
      FETCH_TOKEN:
        required: false

defaults:
  run:
    shell: pwsh

jobs:
  codeql:
    name: Run CodeQL
    runs-on: ${{ inputs.runs-on || 'ubuntu-latest' }}
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4.2.2
      with:
        fetch-depth: 0
        submodules: recursive
        token: ${{ secrets.FETCH_TOKEN || github.token }}

    - name: Install .NET ${{ inputs.dotnet-version }}
      uses: actions/setup-dotnet@v4.1.0
      with:
        dotnet-version: ${{ inputs.dotnet-version }}
        dotnet-quality: ${{ inputs.dotnet-quality }}

    - name: Restore dependencies
      run: dotnet restore ${{ inputs.solution }}

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: csharp
        queries: security-extended

    - name: Autobuild
      id: autobuild
      uses: github/codeql-action/autobuild@v3.26.5

    - name: Build .NET (error case)
      if: steps.autobuild.outcome != 'success'
      run: dotnet build ${{ inputs.solution }} -c Release

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3.26.5
      with:
        category: "/language:csharp"