sqm-autorate-rust/.github/workflows/rust-clippy.yml

name: Clippy SARIF

on:
  push:
    branches: [master]
  schedule:
    - cron: "17 12 * * 4"
  workflow_dispatch:

permissions:
  contents: read
  security-events: write
  actions: read

env:
  CARGO_TERM_COLOR: always

jobs:
  clippy-sarif:
    name: Clippy SARIF
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          components: clippy
          cache: false
      - name: Install SARIF tools
        run: cargo install --locked clippy-sarif sarif-fmt
      - name: Run Clippy and generate SARIF
        id: clippy
        shell: bash
        run: |
          set +e
          cargo clippy \
            --workspace \
            --all-targets \
            --all-features \
            --locked \
            --message-format=json \
            | clippy-sarif \
            | tee rust-clippy-results.sarif \
            | sarif-fmt
          clippy_status=${PIPESTATUS[0]}
          echo "exit_code=${clippy_status}" >> "$GITHUB_OUTPUT"
          exit 0
      - name: Upload Clippy SARIF
        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
        if: always()
        with:
          sarif_file: rust-clippy-results.sarif
          category: clippy
          wait-for-processing: true
      - name: Fail if Clippy failed
        if: steps.clippy.outputs.exit_code != '0'
        run: exit 1