callable.code-analysis.codeql.yml

name: CodeQL Analysis

on:
    workflow_call:

jobs:
    analyze:
        name: CodeQL Analysis
        # Runner size impacts CodeQL analysis time. To learn more, please see:
        #   - https://gh.io/recommended-hardware-resources-for-running-codeql
        #   - https://gh.io/supported-runners-and-hardware-resources
        #   - https://gh.io/using-larger-runners
        # Consider using larger runners for possible analysis time improvements.
        runs-on: ubuntu-latest
        timeout-minutes: 360
        permissions:
            actions: read
            contents: read
            security-events: write

        steps:
            -   name: Checkout repository
                uses: actions/checkout@v4

            # Initializes the CodeQL tools for scanning.
            -   name: Initialize CodeQL
                uses: github/codeql-action/init@v3
                with:
                    languages: java
                    # If you wish to specify custom queries, you can do so here or in a config file.
                    # By default, queries listed here will override any specified in a config file.
                    # Prefix the list here with "+" to use these queries and those in the config file.

                    # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
                    # queries: security-extended,security-and-quality
                    queries: security-extended,security-and-quality

            -   uses: actions/setup-java@v4
                with:
                    distribution: 'corretto'
                    java-version: '21'
            -   uses: gradle/actions/wrapper-validation@v3
            -   name: Setup Gradle
                uses: gradle/actions/setup-gradle@v3.3.2
                with:
                    cache-read-only: true
            -   name: Run build with Gradle Wrapper
                #        run: |
                #          ./gradlew build -x intTest --no-daemon
                #          # ignore ./.gradle folder for analysis
                #          rm -Rf .gradle
                run: |
                    ./gradlew build --no-daemon
                    # ignore ./.gradle folder for analysis
                    rm -Rf .gradle

            -   name: Perform CodeQL Analysis
                uses: github/codeql-action/analyze@v3
                with:
                    category: "/language:${{matrix.language}}"