codeql-analysis.yml

name: 'CodeQL'

on:
  push:
    branches:
      - develop
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [develop]
  schedule:
    - cron: '23 19 * * 4'

jobs:
  filter:
    name: Detect Changes
    permissions:
      pull-requests: read
    outputs:
      should-run-go: ${{ steps.changes.outputs.go-changes == 'true' || steps.changes.outputs.workflow-changes == 'true' || github.event == 'schedule' }}
      should-run-js: ${{ steps.changes.outputs.js-changes == 'true' || steps.changes.outputs.workflow-changes == 'true' || github.event == 'schedule' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the repo
        uses: actions/checkout@v4.2.1
        with:
          persist-credentials: false
          repository: smartcontractkit/chainlink
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          filters: |
            go-changes:
              - '**/*.go'
              - '**/go.mod'
              - '**/go.sum'
            js-changes:
              - '**/package.json'
              - '**/pnpm-lock.yaml'
              - '**/*.js'
              - '**/*.ts'
            workflow-changes:
              - '.github/workflows/codeql-analysis.yml'

  analyze:
    needs: filter
    name: Analyze ${{ matrix.type.language }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        type:
          - language: 'go'
            should-run: ${{ needs.filter.outputs.should-run-go }}
          - language: 'javascript'
            should-run: ${{ needs.filter.outputs.should-run-js }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4.2.1
        with:
          persist-credentials: false

      - name: Set up Go
        if: ${{ matrix.type.language == 'go' && matrix.type.should-run == 'true' }}
        uses: ./.github/actions/setup-go
        with:
          go-version-file: 'go.mod'
          only-modules: 'true'

      - name: Touching core/web/assets/index.html
        if: ${{ matrix.type.language == 'go' && matrix.type.should-run == 'true' }}
        run: mkdir -p core/web/assets && touch core/web/assets/index.html

      - name: Initialize CodeQL
        if: ${{ matrix.type.should-run == 'true' }}
        uses: github/codeql-action/init@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # codeql-bundle-v2.16.1
        with:
          languages: ${{ matrix.type.language }}

      - name: Perform CodeQL Analysis
        if: ${{ matrix.type.should-run == 'true' }}
        uses: github/codeql-action/analyze@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # codeql-bundle-v2.16.1