codeql.yml

name: "CodeQL & Pylint"

on:
    push:
        branches: master
        paths:
            - ".github/workflows/codeql.yml"
            - "api/*.py"
    pull_request:
        branches: master

jobs:
    codeql:
        if: |
            github.actor != 'dependabot[bot]' &&
            github.actor != 'github-actions[bot]' &&
            github.actor != 'protected-auto-commits[bot]'
        name: CodeQL
        runs-on: ubuntu-latest
        permissions:
            actions: read
            contents: read
            security-events: write

        steps:
          - name: Checkout Repo
            uses: actions/checkout@v4

          - name: Initialize CodeQL
            uses: github/codeql-action/init@v3
            with:
                languages: python
                queries: +security-extended

          - name: Autobuild
            uses: github/codeql-action/autobuild@v3

          - name: Perform CodeQL Analysis
            uses: github/codeql-action/analyze@v3
            with:
                category: "/language:python"
                output: codeql-report.sarif

          - name: Upload CodeQL Results
            if: always()
            uses: actions/upload-artifact@v4
            with:
                name: codeql-results
                path: codeql-report.sarif

    pylint:
        name: Pylint
        runs-on: ubuntu-latest
        needs: codeql
        steps:
          - name: GitHub App Token
            uses: actions/create-github-app-token@v1
            id: app-token
            with:
                app-id: ${{ secrets.GH_APP_ID }}
                private-key: ${{ secrets.GH_PRIVATE_KEY }}

          - name: Checkout Code
            uses: actions/checkout@v4
            with:
                token: ${{ steps.app-token.outputs.token }}

          - name: Set up Python
            uses: actions/setup-python@v5
            with:
                python-version: "3.x"
                cache: "pip"

          - name: Cache Dependencies
            uses: actions/cache@v4
            with:
                path: ~/.cache/pip
                key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
                restore-keys: |
                    ${{ runner.os }}-pip-

          - name: Run Pylint and Generate Badge
            id: run-pylint
            run: |
                python -m pip install --upgrade pip
                pip install -r requirements.txt
                pylint_output=$(pylint --recursive=y api tests || true)
                echo "$pylint_output"

                score=$(echo "$pylint_output" | grep -oP 'Your code has been rated at \K[0-9]+\.[0-9]+' || echo "0.0")
                color="red"
                if (( $(echo "$score == 10" | bc -l) )); then
                    color="brightgreen"
                elif (( $(echo "$score >= 9" | bc -l) )); then
                    color="darkgreen"
                elif (( $(echo "$score >= 8" | bc -l) )); then
                    color="orange"
                elif (( $(echo "$score >= 7" | bc -l) )); then
                    color="lightred"
                elif (( $(echo "$score >= 6" | bc -l) )); then
                    color="red"
                fi

                badge="![Pylint](https://img.shields.io/badge/Pylint-$score-$color?logo=python)"
                echo "PYLINT_BADGE=$badge" >> $GITHUB_OUTPUT

          - name: Update README with Pylint Badge
            if: github.ref == 'refs/heads/master'
            env:
                GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
            run: |
                sed -i 's|!\[Pylint\](.*)|${{ steps.run-pylint.outputs.PYLINT_BADGE }}|' README.md
                git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
                git config --global user.name "github-actions[bot]"
                git add README.md
                git commit -m "chore: Update Pylint Badge" || echo "No changes to commit"
                git pull --rebase origin master
                git push origin HEAD:master