scan.yml

name: "CodeQL Analysis"

on:
  workflow_dispatch:
  schedule:
    - cron: '00 16 * * 1'

permissions:
  actions: read
  contents: read
  security-events: write

jobs:
  analyze_driver:
    runs-on: windows-latest
    strategy:
      fail-fast: false
    steps:
      - uses: actions/checkout@v4
      - name: Install Nuget Packages
        run: nuget restore .\packages.config -PackagesDirectory .\packages\
      - name: Build Tools
        shell: cmd
        working-directory: ${{github.workspace}}
        run: build\build_tools.cmd
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: cpp
          packs: microsoft/windows-drivers
      - name: Build Driver
        shell: cmd
        working-directory: ${{github.workspace}}
        run: build\build_zdriver.cmd
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:cpp"
          output: sarif-results
          upload: failure-only
      - name: Filter CodeQL Results
        uses: advanced-security/filter-sarif@v1
        with:
          # Exclude Microsoft and third party sources
          patterns: -packages/**/*
          input: sarif-results/cpp.sarif
          output: sarif-results/cpp.sarif
      - name: Upload CodeQL Results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: sarif-results/cpp.sarif