review.yml

# Mobb/CodeQL Fixer on pull requests
# This workflow defines the needed steps to run CodeQL on every pull request and pass the results to Mobb Fixer.
# This example utilizes CodeQL with JavaScript. For other languages, change the CodeQL language settings below.
#
# Secrets in use:
# MOBB_API_TOKEN - your mobb user credentials (autumatially set if you forked this repo via the Mobb app)
# GITHUB_TOKEN - automatically set by GitHub

name: "Mobb/CodeQL"

on:
  pull_request:
    branches: ["*"]

jobs:
  scan-and-fix:
    name: Scan with CodeQL and fix with Mobb
    runs-on: 'ubuntu-latest'
    timeout-minutes: 360
    permissions:
      pull-requests: write
      statuses: write

    strategy:
      fail-fast: false
      matrix:
        language: ["javascript-typescript"]
        # CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
        codeql_output_filename: ["javascript.sarif"]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: ${{ matrix.language }}

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v2
        with:
          category: "/language:${{ matrix.language }}"
          output: results

      - name: Run Mobb on the findings and get fixes
        if: always()
        uses: ./review
        with:
          report-file: results/${{ matrix.codeql_output_filename }}
          api-key: ${{ secrets.MOBB_API_TOKEN }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          scanner: codeql