name: Code Analysis

on:
  push:         # Triggers on push events to any branch
  pull_request: # Triggers on pull request events targeting any branch
  workflow_dispatch: # Allows manual triggering of the workflow

permissions:
  pull-requests: read  # Allows SonarCloud to decorate PRs with analysis results

jobs:
  SonarCloud-Analysis:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET 8.0 SDK
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: '8.0.x'

      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@v2.2.0
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >
            -Dsonar.projectKey=mihakralj_QuanTAlib
            -Dsonar.organization=mihakralj
          projectBaseDir: .

  SecurityCodeScan:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - uses: nuget/setup-nuget@v1
      - uses: microsoft/setup-msbuild@v1

      - name: Setup .NET 8.0 SDK
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: '8.0.x'

      - name: Set up projects for analysis
        uses: security-code-scan/security-code-scan-add-action@v1

      - name: Restore dependencies
        run: dotnet restore

      - name: Build
        run: dotnet build --no-restore

      - name: Convert SARIF for uploading to GitHub
        uses: security-code-scan/security-code-scan-results-action@v1

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3