name: codeql
on:
  workflow_dispatch:

  push:
    branches:
      - master

jobs:
  codeql:
    name: codeql
    runs-on: ["codearts-hosted", "ubuntu-latest", "x64", "large"]
    needs: []
    steps:
      - name: checkout
        uses: checkout
        with:
          token: ${{ secrets.ROBOT_TOKEN }}

      - name: setup-node
        uses: setup-node
        with:
          node-version: 20

      - name: codeql-analysis
        identifier: codeql
        uses: codeql-action
        with:
          language: "javascript"
          query-suite: security-and-quality
          report-path: ./codeql-report.md
          output-path: ./
          ram: 4096
          threads: 0
          verbose: "true"

      - name: upload sarif to openlibing
        uses: openlibing-upload-sarif
        with:
          sarif_file: ./codeql-results-javascript.sarif
          obs_ak: ${{ secrets.OPENLIBING_OBS_AK }}
          obs_sk: ${{ secrets.OPENLIBING_OBS_SK }}
          apig_app_key: ${{ secrets.OPENLIBING_APIG_KEY }}
          apig_app_secret: ${{ secrets.OPENLIBING_APIG_SECRET }}