Merge pull request #34 from 0xarchit/feature/codeql-advanced

feat: Implement Advanced CodeQL Security Analysis with Native Rust Support

Author: 0xarchit

.github/workflows/codeql.yml

@@ -0,0 +1,97 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '8 5 * * 0'
+
+permissions:
+  security-events: write
+  contents: read
+  pull-requests: read
+  actions: read
+  packages: read
+
+jobs:
+  detect-changes:
+    name: Detect Changed Languages
+    runs-on: ubuntu-latest
+    outputs:
+      languages: ${{ steps.set-languages.outputs.languages }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      - name: Filter Paths
+        id: filter
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
+        with:
+          filters: |
+            rust:
+              - 'src/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - '**/*.rs'
+            actions:
+              - '.github/workflows/**'
+
+      - name: Set Language Matrix
+        id: set-languages
+        run: |
+          langs=()
+          
+          if [[ "${{ github.event_name }}" == "schedule" || "${{ steps.filter.outputs.rust }}" == "true" ]]; then
+            langs+=('"rust"')
+          fi
+          
+          if [[ "${{ github.event_name }}" == "schedule" || "${{ steps.filter.outputs.actions }}" == "true" ]]; then
+            langs+=('"actions"')
+          fi
+          
+          json_array="[$(IFS=,; echo "${langs[*]}")]"
+          echo "languages=$json_array" >> $GITHUB_OUTPUT
+
+  analyze:
+    name: Analyze
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.languages != '[]' }}
+    runs-on: windows-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ${{ fromJSON(needs.detect-changes.outputs.languages) }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended,security-and-quality
+          config: |
+            threat-models: remote
+
+      - name: Install Rust Toolchain
+        if: matrix.language == 'rust'
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
+
+      - name: Build Production Code
+        if: matrix.language == 'rust'
+        run: |
+          $env:RUSTFLAGS="-C link-arg=/OPT:REF -C link-arg=/OPT:ICF"
+          cargo build --release
+
+      - name: Autobuild
+        if: matrix.language != 'rust'
+        uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7
+        with:
+          category: "/language:${{matrix.language}}"

.github/workflows/release.yml

@@ -13,19 +13,18 @@ jobs:
       contents: write
 
     steps:
-
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
 
       - name: Install WiX
         run: dotnet tool install --global wix
 
       - name: Install WiX Extensions
         run: |
-          wix eula accept wix7
+          wix eula accept
           wix extension add -g WixToolset.UI.wixext
           wix extension add -g WixToolset.Util.wixext
 
@@ -39,7 +38,7 @@ jobs:
           wix build wix/main.wxs -ext WixToolset.UI.wixext -ext WixToolset.Util.wixext -o target/release/PauseCat_Installer.msi
 
       - name: Upload Release Artifacts
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191
         with:
           files: |
             target/release/PauseCat_Installer.msi