name: "github"

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  schedule:
    - cron: "35 23 * * 4"

permissions:
  contents: "read"

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    # Runner size impacts CodeQL analysis time. To learn more, please see:
    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
    #   - https://gh.io/supported-runners-and-hardware-resources
    #   - https://gh.io/using-larger-runners (GitHub.com only)
    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
    runs-on: "runs-on=${{ github.run_id }}/runner=8cpu-linux-x64/extras=s3-cache"
    permissions:
      security-events: "write"
      contents: "read"

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: actions
            build-mode: none
          - language: go
            build-mode: manual
          - language: javascript-typescript
            build-mode: none
        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
        # Use `c-cpp` to analyze code written in C, C++ or both
        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          submodules: recursive
      - uses: "runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0" # v2

      - if: matrix.language == 'go'
        uses: "./.github/actions/setup"
        with:
          node: "false"
      - if: matrix.language == 'go'
        name: "Prepare Go sources"
        shell: bash
        run: |
          mkdir -p apps/console/dist apps/trust/dist packages/emails/dist
          echo dev-server > apps/console/dist/index.html
          echo dev-server > apps/trust/dist/index.html
          echo dev-server > packages/emails/dist/placeholder
          pids=()
          go generate ./pkg/server/api/connect/v1 & pids+=($!)
          go generate ./pkg/server/api/console/v1 & pids+=($!)
          go generate ./pkg/server/api/trust/v1 & pids+=($!)
          go generate ./pkg/server/api/mcp/v1 & pids+=($!)
          for pid in "${pids[@]}"; do wait "$pid"; done

      - name: Initialize CodeQL
        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}

      - if: matrix.language == 'go'
        name: "Build Go"
        shell: bash
        run: go build ./...

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4
        with:
          category: "/language:${{matrix.language}}"