From af3be8400509d07a0a40dadfb46f60c4440c82ea Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli <redsun82@gihub.com>
Date: Fri, 25 Oct 2024 09:23:39 +0200
Subject: [PATCH 1/3] Rust: add codeql analysis workflow

---
 .github/workflows/rust-analysis.yml | 64 +++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 .github/workflows/rust-analysis.yml

diff --git a/.github/workflows/rust-analysis.yml b/.github/workflows/rust-analysis.yml
new file mode 100644
index 000000000000..04028ad594bc
--- /dev/null
+++ b/.github/workflows/rust-analysis.yml
@@ -0,0 +1,64 @@
+name: "Code scanning - Rust"
+
+on:
+  push:
+    branches:
+      - main
+      - 'rc/*'
+  pull_request:
+    branches:
+      - main
+      - 'rc/*'
+    paths:
+      - '**/*.rs'
+      - '**/Cargo.toml'
+      - '.github/codeql/codeql-config.yml'
+      - '.github/workflows/rust-analysis.yml'
+  schedule:
+    - cron: '0 9 * * 1'
+
+env:
+  CODEQL_ENABLE_EXPERIMENTAL_FEATURES: "true"
+
+jobs:
+  analyze:
+    strategy:
+      matrix:
+        language: [ 'rust' ]
+
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+      pull-requests: read
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Query latest nightly CodeQL bundle
+      shell: bash
+      id: codeql
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        REPO=dsp-testing/codeql-cli-nightlies
+        TAG=$(
+          gh release list -R $REPO -L1 --exclude-drafts --json tagName -q ".[] | .tagName"
+        )
+        echo "nightly_bundle=https://github.com/$REPO/releases/download/$TAG/codeql-bundle-linux64.tar.zst" \
+          | tee -a "$GITHUB_OUTPUT"
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@main
+      with:
+        tools: ${{ steps.codeql.outputs.nightly_bundle }}
+        languages: ${{ matrix.language }}
+        config-file: ./.github/codeql/codeql-config.yml
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@main
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@main

From dd4fe2a32b63cf7d9e9cca9b47faf431f58593e3 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli <redsun82@gihub.com>
Date: Mon, 28 Oct 2024 14:21:07 +0100
Subject: [PATCH 2/3] Rust: change analysis config

---
 .github/workflows/rust-analysis.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/rust-analysis.yml b/.github/workflows/rust-analysis.yml
index 04028ad594bc..fc0ed6b0adb8 100644
--- a/.github/workflows/rust-analysis.yml
+++ b/.github/workflows/rust-analysis.yml
@@ -55,7 +55,10 @@ jobs:
       with:
         tools: ${{ steps.codeql.outputs.nightly_bundle }}
         languages: ${{ matrix.language }}
-        config-file: ./.github/codeql/codeql-config.yml
+        config: |
+          disable-default-queries: true
+          queries:
+            - uses: security-and-quality
 
     - name: Autobuild
       uses: github/codeql-action/autobuild@main

From 5a84d290e66e25f617ccb676828692ef00cabc3c Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli <redsun82@gihub.com>
Date: Mon, 28 Oct 2024 14:32:53 +0100
Subject: [PATCH 3/3] Rust: ignore test directory

---
 .github/workflows/rust-analysis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/rust-analysis.yml b/.github/workflows/rust-analysis.yml
index fc0ed6b0adb8..ef8264d1c833 100644
--- a/.github/workflows/rust-analysis.yml
+++ b/.github/workflows/rust-analysis.yml
@@ -59,6 +59,8 @@ jobs:
           disable-default-queries: true
           queries:
             - uses: security-and-quality
+          paths-ignore:
+            - '/rust/ql/tests'
 
     - name: Autobuild
       uses: github/codeql-action/autobuild@main