name: Clippy SARIF

on:
  push:
    branches:
      - main
  schedule:
    - cron: "17 12 * * 4"
  workflow_dispatch:

permissions:
  contents: read
  security-events: write
  actions: read

env:
  CARGO_TERM_COLOR: always

jobs:
  clippy-sarif:
    name: Clippy SARIF
    runs-on: ubuntu-latest
    timeout-minutes: 25

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          components: clippy
          cache-key: clippy-sarif

      - name: Install SARIF tools
        run: |
          cargo install --locked clippy-sarif sarif-fmt

      - name: Run Clippy and generate SARIF
        id: clippy
        shell: bash
        run: |
          set +e

          cargo clippy \
            --workspace \
            --all-targets \
            --all-features \
            --locked \
            --message-format=json \
            | clippy-sarif \
            | tee rust-clippy-results.sarif \
            | sarif-fmt

          clippy_status=${PIPESTATUS[0]}
          echo "exit_code=${clippy_status}" >> "$GITHUB_OUTPUT"

          exit 0

      - name: Upload Clippy SARIF
        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
        if: always()
        with:
          sarif_file: rust-clippy-results.sarif
          category: clippy
          wait-for-processing: true

      - name: Fail if Clippy failed
        if: steps.clippy.outputs.exit_code != '0'
        run: exit 1