module.codeql.yml

name: "CodeQL"

on:
  workflow_dispatch:
    ## Input: Runner to use
    inputs:
      runner:
        description: "Runner"
        type: string
        default: "ubuntu-latest"
        required: false

    ## Secrets: API Key
    secrets:
      BUILDLESS_APIKEY:
        description: "Buildless API Key"
        required: true

  workflow_call:
    inputs:
      runner:
        description: "Runner"
        type: string
        default: "ubuntu-latest"
        required: false
    secrets:
      BUILDLESS_APIKEY:
        description: "Buildless API Key"
        required: true

  schedule:
    - cron: "33 9 * * 0"

permissions:
  contents: read

jobs:
  analyze:
    name: CodeQL
    continue-on-error: true
    runs-on: ${{ inputs.runner }}
    timeout-minutes: 360
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 # v2.5.0
        with:
          egress-policy: audit

      - name: "Setup: Checkout"
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
      - name: "Setup: JDK 19"
        uses: buildjet/setup-java@3b5edd4799eb848d92664003cb1e6f74db868f19 # v3
        with:
          distribution: "adopt-hotspot"
          java-version: "19"
      - name: "Setup: Initialize CodeQL"
        uses: github/codeql-action/init@0ba4244466797eb048eb91a6cd43d5c03ca8bd05 # v2
        with:
          languages: java
      - name: "Build: Plugin"
        uses: gradle/gradle-build-action@a4cf152f482c7ca97ef56ead29bf08bcd953284c # v2
        id: gradlebuild
        continue-on-error: true
        env:
          CI: true
          BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
          CACHE_ENDPOINT: ${{ vars.CACHE_ENDPOINT_GRADLE || 'https://gradle.less.build/cache/generic/' }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          cache-read-only: false
          arguments: |
            build
            -x test
            -x check
      - name: "Analsis: CodeQL"
        uses: github/codeql-action/analyze@0ba4244466797eb048eb91a6cd43d5c03ca8bd05 # v2
        continue-on-error: true
        with:
          category: "/language:java"