codeql.yml

#    Copyright (c) 2023 Contributors to the Eclipse Foundation
#
#    See the NOTICE file(s) distributed with this work for additional
#    information regarding copyright ownership.
#
#    This program and the accompanying materials are made available under the
#    terms of the Apache License, Version 2.0 which is available at
#    https://www.apache.org/licenses/LICENSE-2.0.
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.
#
#  SPDX-License-Identifier: Apache-2.0

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "[BE][SECURITY] CodeQL"

on:
  push:
    branches: main
    paths-ignore:
      - '**/*.md'
      - '**/*.txt'
  pull_request:
    branches: main
    paths-ignore:
      - '**/*.md'
      - '**/*.txt'
      - '.husky/**'
      - 'cypress/**'
      - 'charts/**'
      - 'dev/**'
      - 'docs/**'
      - 'tx-backend/ci/**'
      - 'tx-backend/collection/**'
      - 'tx-backend/openapi/**'
      - 'README.md'
      - 'CHANGELOG.md'
  schedule:
    - cron: '0 1 * * 1-5' # At 01:00 on every day-of-week from Monday through Friday.

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'java', 'javascript' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
        # Learn more about CodeQL language support at https://git.io/codeql-language-support

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
          # By default, queries listed here will override any specified in a config file.
          # Prefix the list here with "+" to use these queries and those in the config file.
          # queries: ./path/to/local/query, your-org/your-repo/queries@main
          # The queries security-extended and security-and-quality are built into CodeQL.
          config-file: ./.github/codeql/codeql-config.yml
          queries: +security-and-quality,security-extended

      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
      # If this step fails, then you should remove it and run the build manually (see below)
      # - name: Autobuild
      #   uses: github/codeql-action/autobuild@v3

      - name: Install frontend dependencies
        if: ${{ matrix.language == 'javascript' }}
        run: |
          cd frontend
          npm install

      - name: Build frontend
        if: ${{ matrix.language == 'javascript' }}
        run: |
          cd frontend
          npm run build:prod
        env:
          baseHrefPlaceholder: placeholder

      # ℹ️ Command-line programs to run using the OS shell.
      # 📚 https://git.io/JvXDl

      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
      #    and modify them (or add more) to build your code if your project
      #    uses a compiled language

      - name: Set up JDK 17
        if: ${{ matrix.language == 'java' }}
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Cache maven packages
        if: ${{ matrix.language == 'java' }}
        uses: actions/cache@v3
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2

      - name: Build Package
        if: ${{ matrix.language == 'java' }}
        run: |
          mvn clean package -pl tx-models,tx-backend --batch-mode -DskipTests

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3