postgresql-sharp-mcp/.github/workflows/codeql.yml at main · codegiveness/postgresql-sharp-mcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
name: CodeQL
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '23 3 * * 2'
permissions:
  contents: read
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  analyze:
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      security-events: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: csharp
            build-mode: manual
          - language: actions
            build-mode: none
    env:
      RestoreLockedMode: 'true'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        if: matrix.language == 'csharp'
        with:
          dotnet-version: '10.0.x'
      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          tools: linked # CodeQL bundle 2.27.1, identical across all revisions/languages.
          queries: security-extended
      - name: Build real solution including compiler-generated code
        if: matrix.language == 'csharp'
        run: dotnet build postgresql-sharp-mcp.slnx --configuration Release -p:RestoreLockedMode=true
      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          output: artifacts/codeql
          category: /language:${{ matrix.language }}
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always()
        with:
          name: codeql-trusted-${{ matrix.language }}
          path: artifacts/codeql/*.sarif
          if-no-files-found: error
          retention-days: 14
  pull-request-scans:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    # Real C# builds run only with a read-only token, no publishing secrets or uploads.
    permissions:
      contents: read
    env:
      RestoreLockedMode: 'true'
    strategy:
      fail-fast: false
      matrix:
        language: [csharp, actions]
        revision: [baseline, candidate]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ matrix.revision == 'baseline' && github.event.pull_request.base.sha || github.sha }}
          persist-credentials: false
      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        if: matrix.language == 'csharp'
        with:
          dotnet-version: '10.0.x'
      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.language == 'csharp' && 'manual' || 'none' }}
          tools: linked
          queries: security-extended
      - name: Build scanned revision including compiler-generated code
        if: matrix.language == 'csharp'
        run: dotnet build postgresql-sharp-mcp.slnx --configuration Release -p:RestoreLockedMode=true
      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          upload: never
          upload-database: false
          output: artifacts/codeql
          category: /language:${{ matrix.language }}
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always()
        with:
          name: codeql-${{ matrix.revision }}-${{ matrix.language }}
          path: artifacts/codeql/*.sarif
          if-no-files-found: error
          retention-days: 14
  pull-request-analysis:
    if: always() && github.event_name == 'pull_request'
    needs: pull-request-scans
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    env:
      RestoreLockedMode: 'true'
    steps:
      # Use the trusted base verifier; reviewers must still inspect workflow changes.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          persist-credentials: false
      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: '10.0.x'
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: codeql-baseline-csharp
          path: artifacts/baseline/csharp
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: codeql-candidate-csharp
          path: artifacts/candidate/csharp
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: codeql-baseline-actions
          path: artifacts/baseline/actions
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: codeql-candidate-actions
          path: artifacts/candidate/actions
      - name: Require all scan jobs to succeed
        env:
          SCAN_RESULT: ${{ needs.pull-request-scans.result }}
        run: test "$SCAN_RESULT" = success
      - name: Reject new high-severity findings
        run: >-
          dotnet run --project tools/PostgreSqlMcp.Verify --configuration Release
          -- sarif --baseline artifacts/baseline --candidate artifacts/candidate
  pull-request-upload:
    # Publishes the already-produced candidate SARIF so the PR head gets a code-scanning
    # check run. Same-repository PRs only; fork tokens cannot write security events.
    # This job never builds or executes PR code; the scan jobs above stay read-only.
    if: >-
      github.event_name == 'pull_request' &&
      github.event.pull_request.head.repo.full_name == github.repository
    needs: pull-request-scans
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      security-events: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        language: [csharp, actions]
    steps:
      # Source files only, for SARIF location and fingerprint resolution; nothing is run.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: codeql-candidate-${{ matrix.language }}
          path: ${{ runner.temp }}/codeql-candidate
      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          sarif_file: ${{ runner.temp }}/codeql-candidate
          category: /language:${{ matrix.language }}