codeql.yml

# CodeQL code scanning. See STANDARD.md section 4.4.
name: CodeQL

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    # Weekly, so a newly published query pack finds existing code even when
    # nothing has been pushed. Offset off the hour to avoid the scheduling spike.
    - cron: '37 4 * * 1'

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  analyze:
    name: analyze
    runs-on: ubuntu-latest
    timeout-minutes: 30

    permissions:
      security-events: write   # required to upload results
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: csharp
          # build-mode: none analyses the C# source directly, without a build.
          # It is load-bearing, not a convenience, for two reasons:
          #
          # 1. paths-ignore (below) only takes effect in this mode. When CodeQL
          #    builds a compiled language, GitHub applies no path filter — every
          #    file the compiler sees is analysed, obj/ included — so under the
          #    explicit build this workflow used to run, paths-ignore was
          #    silently inert and the xUnit auto-generated entry point in obj/
          #    was analysed and flagged in every repo. Buildless extraction
          #    honours the filter, so the exclusion the standard mandates
          #    actually happens.
          #
          # 2. It reads the source across every target framework at once. These
          #    repos multi-target, and autobuild has picked a single TFM in the
          #    past, silently analysing half the code; the explicit build existed
          #    to guard against that. Buildless extraction reads the source
          #    itself, not one TFM's build output, so it covers all of it with no
          #    build step to get wrong.
          build-mode: none
          # security-and-quality is broader than the default security-extended;
          # these are small libraries, so the extra findings are affordable.
          queries: security-and-quality
          # Analyse source only. obj/ and bin/ hold generated and compiled
          # output — e.g. the xUnit auto-generated entry point — so findings
          # there are noise against code no human maintains. Effective only
          # under build-mode: none (above).
          #
          # query-filters excludes the two audit queries that fire on every
          # P/Invoke declaration and call site (cs/unmanaged-code,
          # cs/call-to-unmanaged-code). Native-backend packages (Keychain,
          # libsecret, DPAPI) exist to call unmanaged code, so these are pure
          # noise there and non-native repos have no P/Invoke for them to hit.
          # This excludes ONLY those two queries — every other
          # security-and-quality query still runs on the interop files, so no
          # real finding is lost (STANDARD.md 4.4).
          config: |
            paths-ignore:
              - "**/obj/**"
              - "**/bin/**"
            query-filters:
              - exclude:
                  id: cs/unmanaged-code
              - exclude:
                  id: cs/call-to-unmanaged-code

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:csharp"