linq2fb/.github/workflows/codeql.yml at master · similarweb/linq2fb · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
name: codeql

on:
    push:
        branches: [ main, master ]
    pull_request:
        branches: [ main, master ]
    schedule:
        - cron: '0 5 * * 1'   # Mondays 05:00 UTC
    workflow_dispatch:

jobs:
    analyze:
        runs-on: ubuntu-latest
        permissions:
            actions: read
            contents: read
            security-events: write   # required so results show up under "Code scanning alerts"
        steps:
            - name: Checkout
              uses: actions/checkout@v4
              with:
                  fetch-depth: 0

            - name: Init CodeQL
              uses: github/codeql-action/init@v3
              with:
                  languages: csharp
                  # you can add more langs if you later add JS, etc:
                  # languages: csharp,javascript

            - name: Autobuild
              uses: github/codeql-action/autobuild@v3

            # Run analysis, upload alerts to GitHub Security,
            # AND also save a SARIF locally so we can summarize.
            - name: Analyze
              id: analyze
              uses: github/codeql-action/analyze@v3
              with:
                  output: codeql-results.sarif

            # Upload SARIF as build artifact so you can download it from the run UI
            - name: Upload CodeQL SARIF
              uses: actions/upload-artifact@v4
              with:
                  name: codeql-sarif
                  path: codeql-results.sarif

            # Generate a human-readable summary in the job Summary tab
            - name: Summarise findings
              run: |
                  # Pick the first SARIF file generated by CodeQL (usually only one for C#)
                  SARIF_FILE=$(ls codeql-results.sarif/*.sarif | head -n1)

                  if [ -z "$SARIF_FILE" ]; then
                    echo "No SARIF file found, skipping summary." >> $GITHUB_STEP_SUMMARY
                    exit 0
                  fi

                  # Get total results; if missing/null, treat as 0
                  TOTAL=$(jq '(.runs[0].results // []) | length' "$SARIF_FILE")

                  # Build a "top rules" summary safely.
                  # If there are zero results, this will just be empty.
                  TOP_RULES=$(jq -r '
                    (.runs[0].results // [])
                    | group_by(.ruleId)
                    | sort_by(length) | reverse
                    | .[0:10]
                    | map([.[0].ruleId, (length|tostring)] | @tsv)
                    | .[]
                  ' "$SARIF_FILE")

                  {
                    echo "## CodeQL analysis"
                    echo ""
                    echo "**Total findings:** $TOTAL"
                    echo ""

                    if [ "$TOTAL" = "0" ]; then
                      echo "No potential security/code scanning issues were reported 🎉"
                    else
                      echo "Most frequent rule IDs (rule → hits):"
                      echo ""
                      echo '```text'
                      echo "$TOP_RULES"
                      echo '```'
                      echo ""
                      echo "_Full SARIF attached as artifact \`codeql-sarif\` and alerts uploaded to the repository's Security tab._"
                    fi
                  } >> $GITHUB_STEP_SUMMARY