chore: Bump the testing group with 2 updates #33
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL Security Analysis | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| branches: [ main, develop ] | |
| schedule: | |
| - cron: '0 6 * * 1' # Every Monday at 6:00 AM UTC | |
| workflow_dispatch: | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| env: | |
| DOTNET_VERSION: '10.0.x' | |
| DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true | |
| DOTNET_CLI_TELEMETRY_OPTOUT: true | |
| jobs: | |
| analyze: | |
| name: Analyze Code | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 360 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'csharp' ] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: ${{ env.DOTNET_VERSION }} | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-extended,security-and-quality | |
| config: | | |
| paths-ignore: | |
| - '**/obj/**' | |
| - '**/bin/**' | |
| - '**/*.Designer.cs' | |
| - '**/Migrations/**' | |
| - name: Restore dependencies | |
| run: dotnet restore PokManager.sln | |
| - name: Build solution | |
| run: dotnet build PokManager.sln --configuration Release --no-restore | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{matrix.language}}" | |
| dependency-scanning: | |
| name: Dependency Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: ${{ env.DOTNET_VERSION }} | |
| - name: Restore dependencies | |
| run: dotnet restore PokManager.sln | |
| - name: Run dependency scan | |
| run: | | |
| echo "Scanning for vulnerable dependencies..." | |
| dotnet list package --vulnerable --include-transitive 2>&1 | tee vulnerable-packages.txt | |
| if grep -q "has the following vulnerable packages" vulnerable-packages.txt; then | |
| echo "::warning::Vulnerable packages detected. Please review vulnerable-packages.txt" | |
| else | |
| echo "No vulnerable packages detected." | |
| fi | |
| - name: Upload vulnerability report | |
| uses: actions/upload-artifact@v6 | |
| if: always() | |
| with: | |
| name: vulnerability-report | |
| path: vulnerable-packages.txt | |
| retention-days: 30 | |
| security-summary: | |
| name: Security Summary | |
| needs: [analyze, dependency-scanning] | |
| runs-on: ubuntu-latest | |
| if: always() | |
| steps: | |
| - name: Check security status | |
| run: | | |
| echo "CodeQL Analysis: ${{ needs.analyze.result }}" | |
| echo "Dependency Scanning: ${{ needs.dependency-scanning.result }}" | |
| if [ "${{ needs.analyze.result }}" == "success" ] && \ | |
| [ "${{ needs.dependency-scanning.result }}" == "success" ]; then | |
| echo "All security scans passed!" | |
| exit 0 | |
| else | |
| echo "Some security scans failed. Please review the results." | |
| exit 1 | |
| fi |