# For most projects, this workflow file will not need changing; you simply need

# to commit it to your repository.

#

# You may wish to alter this file to override the set of languages analyzed,

# or to provide custom queries or build logic.

name: "CodeQL"

on:

push:

branches: [ "master", "development" ]

paths-ignore:

- '**/*.md'

- '**/*.txt'

- '.github/**'

- '**/.gitignore'

pull_request:

# The branches below must be a subset of the branches above

branches: [ "master", "development" ]

paths-ignore:

- '**/*.md'

- '**/*.txt'

- '.github/**'

- '**/.gitignore'

schedule:

- cron: '30 19 * * 0'

jobs:

analyze:

name: Analyze

runs-on: windows-latest

permissions:

actions: read

contents: read

security-events: write

strategy:

fail-fast: false

matrix:

language: [ 'cpp' ]

# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]

# Use only 'java' to analyze code written in Java, Kotlin or both

# Use only 'javascript' to analyze code written in JavaScript, TypeScript or both

# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

steps:

- name: Checkout repository

uses: actions/checkout@v7

- name: Summary - CodeQL analysis started

shell: pwsh

run: |

$refName = "${{ github.ref_name }}"

$headRef = "${{ github.head_ref }}"

$eventName = "${{ github.event_name }}"

$prNumber = $null

$actualBranchName = $refName

$branchLink = "https://github.com/${{ github.repository }}/tree/$refName"

$prLink = ""

$workflowLink = "https://github.com/${{ github.repository }}/blob/${{ github.sha }}/.github/workflows/codeql.yml"

$runLink = "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"

if ($refName -match '^(\d+)/(merge|head)$') {

$prNumber = $Matches[1]

# Use head_ref for the actual branch name if available

if ($headRef) {

$actualBranchName = $headRef

}

$branchLink = "https://github.com/${{ github.repository }}/tree/$actualBranchName"

$prLink = "https://github.com/${{ github.repository }}/pull/$prNumber"

} elseif ($eventName -eq "pull_request") {

# This is a pull request event

$prNumber = "${{ github.event.pull_request.number }}"

if ($headRef) {

$actualBranchName = $headRef

}

$branchLink = "https://github.com/${{ github.repository }}/tree/$actualBranchName"

$prLink = "https://github.com/${{ github.repository }}/pull/$prNumber"

}

$summary = @"

## 🔒 CodeQL Security Analysis - Workflow Summary

### Analysis Configuration

| Property | Value |

| --- | --- |

| Repository | [``${{ github.repository }}``](https://github.com/${{ github.repository }}) |

| Source Branch | [``$actualBranchName``]($branchLink) |

"@

if ($prNumber) {

$summary += "| Pull Request | [#$prNumber]($prLink) |`n"

}

$summary += @"

| Commit | [``${{ github.sha }}``](https://github.com/${{ github.repository }}/commit/${{ github.sha }}) |

| Workflow | [``${{ github.workflow }}``]($workflowLink) |

| Run | [``${{ github.run_id }}``]($runLink) |

| Language | [``${{ matrix.language }}``](https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/#languages-and-compilers) |

| Event | ``$eventName`` |

"@

$summary | Add-Content -Path $env:GITHUB_STEP_SUMMARY -Encoding utf8

# Initializes the CodeQL tools for scanning.

- name: Initialize CodeQL

uses: github/codeql-action/init@v4.37.4

with:

languages: ${{ matrix.language }}

# If you wish to specify custom queries, you can do so here or in a config file.

# By default, queries listed here will override any specified in a config file.

# Prefix the list here with "+" to use these queries and those in the config file.

# Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs

# queries: security-extended,security-and-quality

- name: Add MSBuild to PATH

uses: microsoft/setup-msbuild@v3

- name: Build Cmder Launcher

shell: pwsh

working-directory: scripts

run: .\build.ps1 -Compile -verbose

- name: Summary - Build status

if: success()

shell: pwsh

run: |

$summary = @"

### ✅ Build Completed

Cmder launcher built successfully for CodeQL analysis.

"@

$summary | Add-Content -Path $env:GITHUB_STEP_SUMMARY -Encoding utf8

- name: Perform CodeQL Analysis

uses: github/codeql-action/analyze@v4.37.4

with:

category: "/language:${{matrix.language}}"

- name: Summary - Analysis completed

if: success()

shell: pwsh

run: |

$summary = @"

### 🔍 CodeQL Analysis Results

✅ CodeQL security analysis completed successfully.

**Language analyzed:** ``${{ matrix.language }}``

> Check the Security tab for detailed findings and recommendations.

"@

$summary | Add-Content -Path $env:GITHUB_STEP_SUMMARY -Encoding utf8