code-analysis-built-module.yml

name: Code analysis (built module)

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

# cSpell: ignore codeql SARIF
jobs:
  pssa:
    name: PSScriptAnalyzer
    runs-on: windows-latest
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      #actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install GitVersion
        shell: powershell
        run: |
          dotnet tool install --global GitVersion.Tool
      - name: Run GitVersion
        shell: powershell
        run: |
          dotnet-gitversion | ConvertFrom-Json
      - name: Build Module
        shell: powershell
        run: |
          Write-Information -MessageData 'Module is being built.' -InformationAction 'Continue'
          .\build.ps1 -ResolveDependency -Tasks 'build'
      - name: Run PSScriptAnalyzer
        shell: powershell
        run: |
          Write-Information -MessageData 'Prepare the test pipeline.' -InformationAction 'Continue'
          .\build.ps1 -Tasks 'noop'

          Write-Information -MessageData 'Import module ConvertToSARIF into the session.' -InformationAction 'Continue'
          Import-Module -Name 'ConvertToSARIF' -Force

          Write-Information -MessageData 'Import module PSScriptAnalyzer into the session.' -InformationAction 'Continue'
          Import-Module -Name 'PSScriptAnalyzer' -Force

          $filesToScan = Get-ChildItem -Path './output/builtModule/PSResourceGet.Bootstrap/**/PSResourceGet.Bootstrap.psm1' -File
          Write-Information -MessageData ("Will scan the file:`t{0}." -f $filesToScan.FullName) -InformationAction 'Continue'

          Write-Information -MessageData 'Running PSScriptAnalyzer on built module.' -InformationAction 'Continue'
          $pssaError = $filesToScan |
              Invoke-ScriptAnalyzer -Settings './.vscode/analyzersettings.psd1'

          Write-Information -MessageData 'Converting PSScriptAnalyzer result to SARIF.' -InformationAction 'Continue'
          $pssaError |
            ConvertTo-SARIF -FilePath 'results.sarif'

          Write-Information -MessageData 'Analyzing done.' -InformationAction 'Continue'
      - name: Upload SARIF results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif