codeql.yml

name: CodeQL

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]
  schedule:
    # Weekly, because most findings arrive as new queries against unchanged code
    # rather than as new code.
    - cron: '41 5 * * 1'
  workflow_dispatch:

permissions:
  contents: read
  actions: read
  security-events: write

jobs:
  analyse:
    # WinForms and GDI+ mean the project only builds on Windows, and CodeQL for C#
    # analyses what the compiler actually produced.
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-dotnet@v6
        with:
          dotnet-version: '9.0.x'

      - uses: github/codeql-action/init@v4
        with:
          languages: csharp
          build-mode: manual
          # security-extended, not security-and-quality. The quality queries produced sixty
          # standing findings and not one of them carried a security severity: P/Invoke notes
          # in a P/Invoke file, Path.Combine notes, missing xmldoc, and casts the language
          # actually requires. A tab that always shows sixty items is a tab you stop opening,
          # which is how the one real finding gets missed. Compiler warnings cover style.
          queries: security-extended

      # Explicit rather than autobuild: the solution has three projects and one of them
      # only exists to drive the built executable, so leaving the choice to a heuristic
      # invites analysing the wrong thing.
      - name: Build
        run: dotnet build RateTray.sln --configuration Release

      - uses: github/codeql-action/analyze@v4
        with:
          category: /language:csharp