From f6db08aa59347437228c14e772dcd190babb94a2 Mon Sep 17 00:00:00 2001
From: pinkushin <pinkushin@verizon.net>
Date: Tue, 8 Sep 2026 21:04:14 -0400
Subject: [PATCH] ci: add CodeQL scanning for C#

Every other C# repo in this workspace (TcgDex.CSharpSdk, PokemonBattleJournal,
Tf2DemoSalvage) already runs this; WindowsDriverCore was the one gap despite
already having secret scanning and Dependabot alerts on. No reason it was
skipped is recorded anywhere - looks like an oversight rather than a decision.

windows-latest rather than TcgDex.CSharpSdk's ubuntu-latest: this repository's
automation layer is raw IUIAutomation COM and every project targets
net10.0-windows, so it can only build where ci.yml already builds it. Full
solution build (WindowsDriverCore.slnx) rather than a single project, because
unlike TcgDex.CSharpSdk's one library multi-targeted three times, this
repository's projects are genuinely different code and no single one stands in
for the rest.

No paths-ignore or query-filters yet. TcgDex.CSharpSdk's config excludes a
System.Text.Json source-generator noise pattern, added only after a first real
scan measured 212 alerts and traced all of them to generated code - there is no
evidence yet that WindowsDriverCore has the same or any other noise pattern, so
nothing is excluded until a real run says otherwise.

Action versions looked up rather than copied from memory:
checkout v7.0.1, setup-dotnet v6.0.0, codeql-action v4.37.9 (2026-09-08).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 72 ++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..ee6bc8f
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,72 @@
+name: CodeQL
+
+# CodeQL does interprocedural taint analysis - it follows a value from where it
+# enters the program to where it is used. That is complementary to
+# TreatWarningsAsErrors and the analyzers ci.yml already gates on, which match
+# known-dangerous shapes at a single call site rather than tracing a value
+# across calls.
+#
+# windows-latest, not ubuntu-latest like TcgDex.CSharpSdk's version of this
+# workflow: this repository's automation layer is raw IUIAutomation COM and
+# every project targets net10.0-windows, so it can only build where ci.yml
+# already builds it.
+#
+# Free for public repositories.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly, Tuesday 04:23 UTC - a different day and an off-hour minute from
+    # ci.yml and mutation.yml, so a scheduled security scan never queues
+    # behind either of them.
+    - cron: "23 4 * * 2"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  DOTNET_NOLOGO: true
+  DOTNET_CLI_TELEMETRY_OPTOUT: true
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
+
+jobs:
+  analyze:
+    name: Analyze C#
+    runs-on: windows-latest
+
+    permissions:
+      # Required to upload results to the Security tab.
+      security-events: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Initialise CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: csharp
+          queries: security-and-quality
+
+      # The whole solution, matching ci.yml's own build step: unlike
+      # TcgDex.CSharpSdk, WindowsDriverCore's projects are genuinely different
+      # code rather than one library multi-targeted three times, so there is
+      # no single project that stands in for the rest.
+      - name: Restore
+        run: dotnet restore WindowsDriverCore.slnx
+
+      - name: Build
+        run: dotnet build WindowsDriverCore.slnx --no-restore --configuration Release
+
+      - name: Analyse
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:csharp"