name: CodeQL

concurrency:
    group: CodeQL-${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true

permissions:
    actions: read
    contents: write
    security-events: write

on:
    workflow_dispatch:
    push:
        branches: [$Branch$]
    pull_request:
        branches: [$Branch$]
    workflow_call:

jobs:
    CodeQL:
        runs-on: ubuntu-latest

        env:
            ADBLOCK: true
            ASTRO_TELEMETRY_DISABLED: 1
            AUTOMATEDLAB_TELEMETRY_OPTOUT: 1
            AZURE_CORE_COLLECT_TELEMETRY: 0
            CHOOSENIM_NO_ANALYTICS: 1
            DIEZ_DO_NOT_TRACK: 1
            DO_NOT_TRACK: 1
            DOTNET_CLI_TELEMETRY_OPTOUT: 1
            DOTNET_INTERACTIVE_CLI_TELEMETRY_OPTOUT: 1
            ET_NO_TELEMETRY: 1
            GATSBY_TELEMETRY_DISABLED: 1
            GATSBY_TELEMETRY_OPT_OUT: 1
            GATSBY_TELEMETRY_OPTOUT: 1
            GRIT_TELEMETRY_DISABLED: 1
            HASURA_GRAPHQL_ENABLE_TELEMETRY: false
            HINT_TELEMETRY: off
            HOMEBREW_NO_ANALYTICS: 1
            INFLUXD_REPORTING_DISABLED: true
            ITERATIVE_DO_NOT_TRACK: 1
            NEXT_TELEMETRY_DEBUG: 1
            NEXT_TELEMETRY_DISABLED: 1
            NG_CLI_ANALYTICS: false
            NUXT_TELEMETRY_DISABLED: 1
            PIN_DO_NOT_TRACK: 1
            POWERSHELL_TELEMETRY_OPTOUT: 1
            SAM_CLI_TELEMETRY: 0
            STNOUPGRADE: 1
            STRIPE_CLI_TELEMETRY_OPTOUT: 1
            TELEMETRY_DISABLED: 1
            TERRAFORM_TELEMETRY: 0
            VCPKG_DISABLE_METRICS: 1

        timeout-minutes: 360

        strategy:
            fail-fast: false

            matrix:
                language: ["javascript"]
                node-version: [18]

        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

            - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
              with:
                  languages: ${{ matrix.language }}

            - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
              with:
                  version: 9.0.3
                  run_install: |
                      - recursive: true
                        args: [
                          --link-workspace-packages=true,
                          --lockfile-only,
                          --prefer-frozen-lockfile=false,
                          --shamefully-hoist=false,
                          --shared-workspace-lockfile=true,
                          --strict-peer-dependencies=false,
                          --unsafe-perm=true
                        ]

            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version: ${{ matrix.node-version }}
                  cache: "pnpm"
                  cache-dependency-path: ./pnpm-lock.yaml

            - run: pnpm install
              working-directory: .

            - run: pnpm run prepublishOnly
              working-directory: .

            - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
              with:
                  category: "/language:${{matrix.language}}"