52.yml

name: CodeQL Lint (Go, No Security Alerts)

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read

jobs:
  codeql-lint:
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          languages: go
          packs: skip-mev/cosmos-52-ql

      - name: Build (Make Install)
        run: |
          make install

      - name: Analyze with CodeQL (no upload)
        uses: github/codeql-action/analyze@v3
        id: analyze
        with:
          upload: never              
          output: ../codeql-results.sarif

      - name: Install jq
        uses: dcarbone/install-jq-action@v3.0.1
      - name: Annotate code with findings
        run: |
          set -eoux pipefail

          cat ${{ steps.analyze.outputs.sarif-output }}

          issues=$(jq -r '
            .runs[].results[] |
            . as $r |
            ($r.locations[0].physicalLocation.artifactLocation.uri | select(. != null)) as $file |
            ($r.locations[0].physicalLocation.region.startLine | select(. != null)) as $line |
            ($r.message.text | gsub("[\r\n]"; " ")) as $msg |
            [$file, $line, $msg] | @tsv
          ' ${{ steps.analyze.outputs.sarif-output }} )

          while IFS=$'\t' read -r file line msg; do
            file="${file#file://}"
            echo "::warning file=$file,line=$line::$msg"
          done <<< "$issues"