codeql.yml

name: "CodeQL & Pylint"

on:
    push:
        branches: [ "master" ]
        paths:
            - ".github/workflows/codeql.yml"
            - "api/*.py"
    pull_request:
        branches: [ "master" ]

jobs:
    codeql:
        if: github.actor != 'dependabot[bot]' || github.actor != 'protected-auto-commits[bot]'
        name: Analyze Python
        runs-on: ubuntu-latest
        permissions:
            actions: read
            contents: read
            security-events: write

        steps:
          - name: Checkout repository
            uses: actions/checkout@v4

          - name: Initialize CodeQL
            uses: github/codeql-action/init@v3
            with:
                languages: python
                queries: +security-extended

          - name: Autobuild
            uses: github/codeql-action/autobuild@v3

          - name: Perform CodeQL Analysis
            uses: github/codeql-action/analyze@v3
            with:
                category: "/language:python"
                output: codeql-report.sarif

          - name: Upload CodeQL Results
            if: always()
            uses: actions/upload-artifact@v4
            with:
                name: codeql-results
                path: codeql-report.sarif

    pylint:
        name: Pylint
        runs-on: ubuntu-latest
        needs: codeql
        steps:
          - name: GitHub App Token
            uses: actions/create-github-app-token@v1
            id: app-token
            with:
                app-id: ${{ secrets.APP_ID }}
                private-key: ${{ secrets.APP_PRIVATE_KEY }}

          - name: Checkout Code
            uses: actions/checkout@v4
            with:
                token: ${{ steps.app-token.outputs.token }}

          - name: Set up Python
            uses: actions/setup-python@v5
            with:
                python-version: "3.x"
                cache: "pip"

          - name: Cache Dependencies
            uses: actions/cache@v4
            with:
                path: ~/.cache/pip
                key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
                restore-keys: |
                    ${{ runner.os }}-pip-

          - name: Install Dependencies
            run: |
                python -m pip install --upgrade pip
                pip install pylint

          - name: Run Pylint
            id: run-pylint
            run: |
                pylint api tests > pylint-report.txt || true

          - name: Generate Pylint Badge
            if: github.ref == 'refs/heads/master'
            env:
                GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
            run: |
                score=$(grep -oP 'Your code has been rated at \K[0-9]+\.[0-9]+' pylint-report.txt)
                if [ -z "$score" ]; then
                    score="0.0"
                fi
                color="red"
                if (( $(echo "$score >= 9" | bc -l) )); then
                    color="brightgreen"
                elif (( $(echo "$score >= 7" | bc -l) )); then
                    color="yellow"
                elif (( $(echo "$score >= 5" | bc -l) )); then
                    color="orange"
                fi
                badge="![Pylint](https://img.shields.io/badge/Pylint-$score-$color?logo=python)"
                sed -i 's|!\[pylint\](.*)|'"$badge"'|' README.md
                git config --global user.email "action@github.com"
                git config --global user.name "GitHub Action"
                git remote set-url origin https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/${{ github.repository }}.git
                git add README.md
                git commit -m "Update Pylint Badge"
                git push origin HEAD:master