From 4489797eed08091bdee9c7af717c09d25dfaadfc Mon Sep 17 00:00:00 2001
From: Constrat <56174894+Constrat@users.noreply.github.com>
Date: Wed, 20 Aug 2025 23:14:16 +0200
Subject: [PATCH] ci: split codeql (#13812)

* perf: codeql core

* perf: standardize caching for codeqlcore

* fix: correct cache keys

* perf: add codeql-js for website and workflows

* fix: typo

* fix: use bash instead of pwsh in ubuntu
---
 .../workflows/{codeql.yml => codeql-core.yml} | 56 ++++++++-------
 .github/workflows/codeql-js.yml               | 72 +++++++++++++++++++
 2 files changed, 102 insertions(+), 26 deletions(-)
 rename .github/workflows/{codeql.yml => codeql-core.yml} (66%)
 create mode 100644 .github/workflows/codeql-js.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql-core.yml
similarity index 66%
rename from .github/workflows/codeql.yml
rename to .github/workflows/codeql-core.yml
index 6a5c12b302..f0fef18ac5 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql-core.yml
@@ -1,4 +1,4 @@
-name: "CodeQL Advanced"
+name: "CodeQL MaaCore and MaaWpfGui Analysis"
 
 on:
   pull_request:
@@ -10,10 +10,11 @@ on:
       - "cmake/**"
       - "CMakeLists.txt"
       - "MAA.sln"
-      - ".github/workflows/ci.yml"
+      - ".github/workflows/codeql-core.yml"
       - "!**/*.md"
+      - "!**/*.xaml"
   schedule:
-    - cron: "45 11 * * *"
+    - cron: "45 11 * * *" # Runs daily at 11:45 UTC
   workflow_dispatch:
 
 permissions:
@@ -23,26 +24,6 @@ permissions:
   security-events: write
 
 jobs:
-  analyze-none:
-    name: Analyze CI and MaaWebsite
-    runs-on: windows-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          show-progress: false
-
-      - name: Setup CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: javascript-typescript,actions
-          build-mode: none
-
-      - name: Run CodeQL
-        uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:multi-none"
-
   analyze-manual:
     name: Analyze MaaCore and MaaWpfGui
     runs-on: windows-latest
@@ -52,12 +33,35 @@ jobs:
         with:
           show-progress: false
 
-      - name: Setup build environments
+      - name: Update submodules
+        run: git submodule update --init --depth 1 3rdparty/EmulatorExtras
+
+      - name: Cache .nuke/temp, ~/.nuget/packages
+        id: cache-nuget
+        uses: actions/cache@v4
+        with:
+          path: |
+            .nuke/temp
+            ~/.nuget/packages
+          key: ${{ runner.os }}-x64-${{ hashFiles('**/global.json', '**/*.csproj') }}
+
+      - name: Restore dependencies
+        if: steps.cache-nuget.outputs.cache-hit != 'true'
+        run: dotnet restore
+
+      - name: Cache MaaDeps
+        id: cache-maadeps
+        uses: actions/cache@v4
+        with:
+          path: |
+            ./MaaDeps
+          key: ${{ runner.os }}-x64-maadeps-${{ hashFiles('./maadeps-download.py') }}
+
+      - name: Bootstrap MaaDeps
+        if: steps.cache-maadeps.outputs.cache-hit != 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          git submodule update --init --depth 1 3rdparty/EmulatorExtras
-          dotnet restore
           python3 maadeps-download.py x64-windows
 
       - name: Create fake event file
diff --git a/.github/workflows/codeql-js.yml b/.github/workflows/codeql-js.yml
new file mode 100644
index 0000000000..0b2ded3629
--- /dev/null
+++ b/.github/workflows/codeql-js.yml
@@ -0,0 +1,72 @@
+name: "CodeQL Website and Workflows Analysis"
+
+on:
+  pull_request:
+    branches: ["dev"]
+    paths:
+      - "website/**"
+      - ".github/workflows/*.yml"
+      - ".github/*.yml"
+      - "!**/*.md"
+  schedule:
+    - cron: "00 12 * * *" # Runs daily at 12:00 UTC
+  workflow_dispatch:
+
+permissions:
+  actions: write
+  contents: read
+  security-events: write
+
+jobs:
+  analyze-website:
+    name: Analyze Website (JavaScript/TypeScript)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          show-progress: false
+
+      - name: Setup CodeQL for JavaScript/TypeScript
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+          build-mode: none
+
+      - name: Run CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:multi-none"
+
+      - name: Delete old caches
+        shell: bash
+        run: |
+          oldCaches=$(gh cache list --key codeql --order asc --json key | jq -r '.[] | .key' | head -n -1)
+          for cache in $oldCaches; do
+            if [ -n "$cache" ]; then
+              echo "Deleting cache: $cache"
+              gh cache delete "$cache" --confirm
+            fi
+          done
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  analyze-workflows:
+    name: Analyze GitHub Workflows
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          show-progress: false
+
+      - name: Setup CodeQL for GitHub Actions
+        uses: github/codeql-action/init@v3
+        with:
+          languages: actions
+          build-mode: none
+
+      - name: Run CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:multi-none"