codeql-analysis.yml

name: CodeQL
'on':
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
  schedule:
    - cron: 48 18 * * 6
  workflow_dispatch: null
jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    concurrency: ${{ github.workflow }}-${{ matrix.language }}-${{ github.ref }}
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language:
          - ruby
          - javascript
    steps:
      - name: Run Code Scanning
        uses: department-of-veterans-affairs/codeql-tools/codeql-analysis@main
        with:
          language: ${{ matrix.language }}
          config-file: ./.github/codeql/config.yml

  assign-failure-label:
    if: github.event_name == 'pull_request' && failure() && !contains(github.event.pull_request.labels.*.name, 'codeql-failure')
    needs: [analyze]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Add Failure label
        uses: actions-ecosystem/action-add-labels@v1
        with:
          number: ${{ github.event.pull_request.number }}
          labels: |
            codeql-failure

  remove-failure-label:
    if: github.event_name == 'pull_request' && success() && contains(github.event.pull_request.labels.*.name, 'codeql-failure')
    needs: [analyze]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Remove Failure label
        uses: actions-ecosystem/action-remove-labels@v1
        with:
          number: ${{ github.event.pull_request.number }}
          labels: |
            codeql-failure