code-analysis.yml

name: Code analysis

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

jobs:
  pssa:
    name: Script Analyzer
    runs-on: windows-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout code
        uses: actions/checkout@v3

      - name: PowerShell Module Cache
        uses: potatoqualitee/psmodulecache@v6.2
        with:
          modules-to-cache: PSScriptAnalyzer, ConvertToSARIF, Az.Network

      # Not using microsoft/psscriptanalyzer-action@v1.0 because we're missing psm1 in src + need to exclude generated ps1xml
      - name: Run PSScriptAnalyzer
        shell: pwsh
        run: |
          Import-Module ConvertToSARIF -Force
          Get-ChildItem -Path . -Filter *.ps* -Recurse -File |
          Invoke-ScriptAnalyzer |
          ConvertTo-SARIF -FilePath results.sarif
      # Upload the SARIF file generated in the previous step
      - name: Upload SARIF results file
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif