CodeQL support (#2000)

.github/workflows/analyze.yml

@@ -0,0 +1,78 @@
+on:
+    workflow_call:
+      inputs:
+        project-path:
+          required: true
+          type: string
+        scheme:
+          type: string
+          default: MapboxMaps
+        destination:
+          type: string
+          default: generic/platform=iOS Simulator
+      secrets:
+        SDK_REGISTRY_TOKEN:
+          required: true
+
+jobs:
+    analyze:
+      name: Analyze
+      runs-on: ${{ matrix.executor }}
+      permissions:
+        actions: read
+        contents: read
+        security-events: write
+
+      strategy:
+        fail-fast: false
+        matrix:
+          language: ["javascript", "python", "ruby"]
+          executor: ["ubuntu-latest"]
+          include:
+            - language: "swift"
+              executor: "macos-latest"
+          # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+      steps:
+        - name: Checkout repository
+          uses: actions/checkout@v4
+
+        - name: Allow cloning public repositories from github.com via SSH
+          run: |
+            git config --global url.https://github.com/.insteadOf [email protected]:
+
+        - name: Inject tokens
+          if: matrix.language == 'swift'
+          run: |
+            echo "machine api.mapbox.com login mapbox password ${{ secrets.SDK_REGISTRY_TOKEN }}" >> ~/.netrc
+            chmod 0600 ~/.netrc
+
+            echo "test_token" > ~/.mapbox
+
+        # Initializes the CodeQL tools for scanning.
+        - name: Initialize CodeQL
+          uses: github/codeql-action/init@v3
+          with:
+            languages: ${{ matrix.language }}
+            # If you wish to specify custom queries, you can do so here or in a config file.
+            # By default, queries listed here will override any specified in a config file.
+            # Prefix the list here with "+" to use these queries and those in the config file.
+
+            # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+            # queries: security-extended,security-and-quality
+
+        - name: Build Examples
+          if: matrix.language == 'swift'
+          run: set -o pipefail && xcodebuild build -project '${{ inputs.project-path }}' -scheme ${{ inputs.scheme }} -destination '${{ inputs.destination }}'| tee xcodebuild.log | xcpretty
+
+        - name: Archive xcodebuild.log
+          uses: actions/upload-artifact@v4
+          if: matrix.language == 'swift'
+          with:
+            name: xcodebuild.log
+            path: xcodebuild.log
+
+        - name: Perform CodeQL Analysis
+          uses: github/codeql-action/analyze@v3
+          with:
+            category: "/language:${{matrix.language}}"

.github/workflows/codeql.yml

@@ -2,47 +2,15 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [main, publisher-production, release/*, lts/*]
+    branches: ['main', 'publisher-production', 'release/*', 'lts/*']
   pull_request:
-    branches: [main]
+    branches: ['main', 'publisher-production', 'release/*', 'lts/*']
   schedule:
-    - cron: "39 3 * * 0"
+    - cron: "16 20 * * 4"
 
 jobs:
   analyze:
-    name: Analyze
-    runs-on: macos-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ["swift"]
-
-    env:
-      SDK_REGISTRY_TOKEN: ${{ secrets.SDK_REGISTRY_TOKEN }}
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 1
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
-        with:
-          languages: ${{ matrix.language }}
-
-      - name: Prepare netrc
-        run: |
-          echo "machine api.mapbox.com login mapbox password $SDK_REGISTRY_TOKEN" >> ~/.netrc
-          chmod 0600 ~/.netrc
-      - name: Build
-        run: xcodebuild build -scheme MapboxMaps -destination 'generic/platform=iOS Simulator'
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
-        with:
-          category: "/language:${{matrix.language}}"
+    uses: ./.github/workflows/analyze.yml
+    with:
+      project-path: Apps/Examples/Examples.xcodeproj
+    secrets: inherit