MaaAssistantArknights/.github/workflows/codeql-core.yml

name: "CodeQL MaaCore and MaaWpfGui Analysis"

on:
  pull_request:
    branches: ["dev"]
    paths:
      - "3rdparty/include/**"
      - "include/**"
      - "src/**"
      - "cmake/**"
      - "CMakeLists.txt"
      - ".github/workflows/codeql-core.yml"
      - "!**/*.md"
      - "!**/*.xaml"
  schedule:
    - cron: "45 11 * * *" # Runs daily at 11:45 UTC
  workflow_dispatch:

permissions:
  actions: write
  contents: read
  packages: read
  security-events: write

jobs:
  analyze-manual:
    name: Analyze MaaCore and MaaWpfGui
    runs-on: windows-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          show-progress: false

      - name: Update submodules
        run: git submodule update --init --depth 1 3rdparty/EmulatorExtras

      - name: Cache .nuke/temp, ~/.nuget/packages
        id: cache-nuget
        uses: actions/cache@v4
        with:
          path: |
            .nuke/temp
            ~/.nuget/packages
          key: ${{ runner.os }}-x64-${{ hashFiles('**/global.json', '**/*.csproj') }}

      - name: Restore dependencies
        if: steps.cache-nuget.outputs.cache-hit != 'true'
        run: dotnet restore

      - name: Cache MaaDeps
        id: cache-maadeps
        uses: actions/cache@v4
        with:
          path: |
            ./MaaDeps
          key: ${{ runner.os }}-x64-maadeps-${{ hashFiles('./tools/maadeps-download.py') }}

      - name: Bootstrap MaaDeps
        if: steps.cache-maadeps.outputs.cache-hit != 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          python3 tools/maadeps-download.py x64-windows

      - name: Create fake event file
        shell: bash
        run: cp -v "$GITHUB_EVENT_PATH" ./event.json

      - name: Setup CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: c-cpp,csharp
          build-mode: manual

      - name: Build MAA
        shell: pwsh
        run: |
          $env:GITHUB_WORKFLOW = 'dev-build-win'
          $env:GITHUB_EVENT_PATH = "$pwd\\event.json"
          $env:GITHUB_REF = "refs/heads/not_master"
          $env:MAA_BUILDER_MAA_VERSION = 'v0.0.1'
          ./build.cmd DevBuild
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run CodeQL
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:multi-manual"

      - name: Delete old caches
        shell: pwsh
        run: |
          $oldCaches = gh cache list --key codeql --order asc --json key | ConvertFrom-Json | Select-Object -SkipLast 1
            foreach ($cache in $oldCaches) {
              if ($cache.key) {
                Write-Host "Deleting cache: $($cache.key)"
                gh cache delete $cache.key
              }
            }
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}