code_quality_pr.yml

name: Qodana (PR)

# Qodana needs QODANA_TOKEN to run the cloud linter, and GitHub withholds every
# secret from a `pull_request` run that originates from a fork. So this workflow
# uses `pull_request_target`, which runs in the trusted base-branch context and
# therefore does receive secrets.
#
# The trade-off is that the job checks out and analyses the contributor's
# untrusted code while a secret is in scope. Two things contain that:
#
#  1. QODANA_TOKEN is scoped to the "qodana-pr" GitHub Environment rather than
#     being a repo/org-wide secret, so no other repository or organization
#     secret is ever exposed to code checked out from a pull request, no matter
#     how the job steps are edited later.
#  2. The "qodana-pr" environment has required reviewers, so a maintainer must
#     approve each run before the contributor's code executes with the token.
#
# Keep both in place. Dropping the environment, or removing its reviewers, would
# hand QODANA_TOKEN to arbitrary fork code without human review.
on:
  pull_request_target:

permissions:
  checks: write
  contents: read
  pull-requests: write

jobs:
  qodana-scan:
    name: Qodana Scan
    runs-on: windows-latest
    environment: qodana-pr
    steps:
      # `pull_request_target` defaults to the base branch, so check out the PR
      # head explicitly. refs/pull/<n>/head lives in this repository and points
      # at the contributor's commit, which works for forks too.
      - uses: actions/checkout@v7
        with:
          ref: refs/pull/${{ github.event.pull_request.number }}/head
          allow-unsafe-pr-checkout: true
          fetch-depth: 0

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2026.2
        with:
          upload-result: true
          args: --baseline qodana.sarif.json --linter qodana-dotnet --within-docker false
          pr-mode: true
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}