__analysis-kinds.yml

# Warning: This file is generated automatically, and should not be modified.
# Instead, please modify the template in the pr-checks directory and run:
#     pr-checks/sync.sh
# to regenerate this file.

name: PR Check - Analysis kinds
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  GO111MODULE: auto
on:
  push:
    branches:
      - main
      - releases/v*
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
      - ready_for_review
  merge_group:
    types:
      - checks_requested
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
    inputs: {}
  workflow_call:
    inputs: {}
defaults:
  run:
    shell: bash
concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
  group: analysis-kinds-${{github.ref}}
jobs:
  should-run-analysis-kinds:
    name: Decide whether to run this check
    timeout-minutes: 10
    runs-on: ubuntu-slim
    if: github.triggering_actor != 'dependabot[bot]'
    outputs:
      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
    steps:
      - name: Run check if this is not a PR
        id: event-type-check
        if: github.event_name != 'pull_request'
        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
      - name: Check out repository
        if: github.event_name == 'pull_request'
        uses: actions/checkout@v6
      - name: Determine changed files
        id: changed-files
        if: github.event_name == 'pull_request'
        uses: ./.github/actions/changed-files
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          exclude: '["README.md"]'
      - name: Run check because of changed files
        id: changed-files-check
        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
  analysis-kinds:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            version: linked
            analysis-kinds: code-scanning
          - os: ubuntu-latest
            version: linked
            analysis-kinds: code-quality
          - os: ubuntu-latest
            version: linked
            analysis-kinds: code-scanning,code-quality
          - os: ubuntu-latest
            version: linked
            analysis-kinds: risk-assessment
          - os: ubuntu-latest
            version: nightly-latest
            analysis-kinds: code-scanning
          - os: ubuntu-latest
            version: nightly-latest
            analysis-kinds: code-quality
          - os: ubuntu-latest
            version: nightly-latest
            analysis-kinds: code-scanning,code-quality
          - os: ubuntu-latest
            version: nightly-latest
            analysis-kinds: risk-assessment
    name: Analysis kinds
    needs:
      - should-run-analysis-kinds
    if: needs.should-run-analysis-kinds.outputs.run-check == 'true'
    permissions:
      contents: read
      security-events: read
    timeout-minutes: 45
    runs-on: ${{ matrix.os }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v6
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
        with:
          version: ${{ matrix.version }}
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - uses: ./../action/init
        with:
          languages: javascript
          analysis-kinds: ${{ matrix.analysis-kinds }}
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - uses: ./../action/analyze
        with:
          output: '${{ runner.temp }}/results'
          upload-database: false
          post-processed-sarif-path: '${{ runner.temp }}/post-processed'

      - name: Upload SARIF files
        uses: actions/upload-artifact@v6
        with:
          name: |
            analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
          path: '${{ runner.temp }}/results/*.sarif'
          retention-days: 7

      - name: Upload post-processed SARIF
        uses: actions/upload-artifact@v6
        with:
          name: |
            post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
          path: '${{ runner.temp }}/post-processed'
          retention-days: 7
          if-no-files-found: error

      - name: Check quality query does not appear in security SARIF
        if: contains(matrix.analysis-kinds, 'code-scanning')
        uses: actions/github-script@v8
        env:
          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
          EXPECT_PRESENT: 'false'
        with:
          script: ${{ env.CHECK_SCRIPT }}
      - name: Check quality query appears in quality SARIF
        if: contains(matrix.analysis-kinds, 'code-quality')
        uses: actions/github-script@v8
        env:
          SARIF_PATH: '${{ runner.temp }}/results/javascript.quality.sarif'
          EXPECT_PRESENT: 'true'
        with:
          script: ${{ env.CHECK_SCRIPT }}
    env:
      CODEQL_ACTION_RISK_ASSESSMENT_ID: 1
      CHECK_SCRIPT: |
        const fs = require('fs');

        const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
        const expectPresent = JSON.parse(process.env['EXPECT_PRESENT']);
        const run = sarif.runs[0];
        const extensions = run.tool.extensions;

        if (extensions === undefined) {
          core.setFailed('`extensions` property not found in the SARIF run property bag.');
        }

        // ID of a query we want to check the presence for
        const targetId = 'js/regex/always-matches';
        const found = extensions.find(extension => extension.rules && extension.rules.find(rule => rule.id === targetId));

        if (found && expectPresent) {
          console.log(`Found rule with id '${targetId}'.`);
        } else if (!found && !expectPresent) {
          console.log(`Rule with id '${targetId}' was not found.`);
        } else {
          core.setFailed(`${ found ? "Found" : "Didn't find" } rule ${targetId}`);
        }
      CODEQL_ACTION_TEST_MODE: true
  skip-analysis-kinds:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            version: linked
            analysis-kinds: code-scanning
          - os: ubuntu-latest
            version: linked
            analysis-kinds: code-quality
          - os: ubuntu-latest
            version: linked
            analysis-kinds: code-scanning,code-quality
          - os: ubuntu-latest
            version: linked
            analysis-kinds: risk-assessment
          - os: ubuntu-latest
            version: nightly-latest
            analysis-kinds: code-scanning
          - os: ubuntu-latest
            version: nightly-latest
            analysis-kinds: code-quality
          - os: ubuntu-latest
            version: nightly-latest
            analysis-kinds: code-scanning,code-quality
          - os: ubuntu-latest
            version: nightly-latest
            analysis-kinds: risk-assessment
    name: Analysis kinds
    needs:
      - should-run-analysis-kinds
    if: needs.should-run-analysis-kinds.outputs.run-check != 'true'
    timeout-minutes: 5
    runs-on: ubuntu-slim
    steps:
      - name: Success
        run: exit 0