chore(deps): Bump actions/cache in the github-actions-dependencies gr… #262
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL Security Analysis | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| branches: [ main, develop ] | |
| schedule: | |
| - cron: '0 6 * * 1' # Every Monday at 6:00 AM UTC | |
| workflow_dispatch: | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| env: | |
| DOTNET_VERSION: '10.0.x' | |
| DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true | |
| DOTNET_CLI_TELEMETRY_OPTOUT: true | |
| jobs: | |
| analyze: | |
| name: Analyze Code | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 360 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'csharp' ] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: ${{ env.DOTNET_VERSION }} | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # Security-focused suite only. The code-quality suite (security-and-quality) | |
| # emits non-security style/maintainability rules (e.g. cs/useless-upcast, | |
| # cs/missed-ternary-operator) that are not security findings. | |
| queries: security-extended | |
| config: | | |
| paths-ignore: | |
| - '**/obj/**' | |
| - '**/bin/**' | |
| - '**/*.Designer.cs' | |
| - '**/Migrations/**' | |
| - name: Restore dependencies | |
| run: dotnet restore PokManager.sln | |
| - name: Build solution | |
| run: dotnet build PokManager.sln --configuration Release --no-restore | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{matrix.language}}" | |
| dependency-scanning: | |
| name: Dependency Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: ${{ env.DOTNET_VERSION }} | |
| - name: Restore dependencies | |
| run: dotnet restore PokManager.sln | |
| - name: Run dependency scan | |
| run: | | |
| echo "Scanning for vulnerable dependencies..." | |
| dotnet list package --vulnerable --include-transitive 2>&1 | tee vulnerable-packages.txt | |
| if grep -q "has the following vulnerable packages" vulnerable-packages.txt; then | |
| echo "::warning::Vulnerable packages detected. Please review vulnerable-packages.txt" | |
| else | |
| echo "No vulnerable packages detected." | |
| fi | |
| - name: Upload vulnerability report | |
| uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: vulnerability-report | |
| path: vulnerable-packages.txt | |
| retention-days: 30 | |
| security-summary: | |
| name: Security Summary | |
| needs: [analyze, dependency-scanning] | |
| runs-on: ubuntu-latest | |
| if: always() | |
| steps: | |
| - name: Check security status | |
| run: | | |
| echo "CodeQL Analysis: ${{ needs.analyze.result }}" | |
| echo "Dependency Scanning: ${{ needs.dependency-scanning.result }}" | |
| if [ "${{ needs.analyze.result }}" == "success" ] && \ | |
| [ "${{ needs.dependency-scanning.result }}" == "success" ]; then | |
| echo "All security scans passed!" | |
| exit 0 | |
| else | |
| echo "Some security scans failed. Please review the results." | |
| exit 1 | |
| fi |