codeql-analysis.yaml

# THIS CODE WAS AUTOGENERATED. DO NOT MODIFY THIS FILE DIRECTLY
# THE SOURCE CODE LIVES IN A DIFFERENT REPOSITORY:
#   - centralized-templates
# FILE STEWARD: @pleo-io/security

name: CodeQL Analysis

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

env:
  language_Kotlin: "java"
  language_Java: "java"
  language_Go: "go"
  language_Python: "python"
  language_JavaScript: "javascript"
  language_TypeScript: "javascript"
  WORKING_LANGUAGE: ""

jobs:
  analyze-java:
    name: Analyze ${{ github.event.repository.language }}
    continue-on-error: true
    runs-on: codeql-runner
    timeout-minutes: 30
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
      - name: Set Working Language
        run: echo "WORKING_LANGUAGE=${{env[format('language_{0}', github.event.repository.language)]}}" >> "$GITHUB_ENV"
      # Set up a JDK environment for building, testing and releasing.
      - name: Set up JDK 17
        uses: actions/setup-java@v3.13.0
        if: ${{ env.WORKING_LANGUAGE == 'java' }}
        with:
          java-version: 17
          distribution: temurin

      # Allow caching Gradle executions to further speed up CI/CD steps invoking Gradle.
      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2.10.0
        if: ${{ env.WORKING_LANGUAGE == 'java' }}
        with:
          gradle-executable: ./gradlew
          gradle-version: wrapper
          cache-read-only: true

      # Set up a Node environment for JS/TS/Node client generation.
      - name: Set up Node 20
        uses: actions/setup-node@v4
        if: ${{ env.WORKING_LANGUAGE == 'javascript' }}
        with:
          node-version: 20

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: ${{ github.event.repository.language }}
          ram: 4096
          queries: security-and-quality
          tools: latest

      - name: Gradle Build
        run: ./gradlew classes testClasses --stacktrace -Dorg.gradle.jvmargs=-Xmx4g -Dorg.gradle.parallel=true
        if: ${{ env.WORKING_LANGUAGE == 'java' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GH_REGISTRY_GRADLE_TOKEN }}
          GRADLE_READ_KEY: ${{ secrets.GH_REGISTRY_GRADLE_TOKEN }}
          JOB_RUNR_REPO_PASSWORD: ${{ secrets.JOB_RUNR_REPO_PASSWORD }}

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2
        with:
          ram: 4096