Split CodeQL actions

Signed-off-by: Victor Chang <[email protected]>

Author: mocsharp

.github/workflows/ci.yml

@@ -59,6 +59,51 @@ jobs:
           useConfigFile: true
           configFilePath: .github/.gitversion.yml
 
+  CodeQL-Analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'csharp' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
+
+    - uses: actions/setup-dotnet@v3
+      with:
+        dotnet-version: "6.0.x"
+
+    - name: Enable NuGet cache
+      uses: actions/[email protected]
+      with:
+        path: ~/.nuget/packages
+        key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-nuget
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+
+    - name: Restore dependencies
+      run: dotnet restore
+      working-directory: ./src
+
+    - name: Build Solution
+      run: dotnet build -c ${{ env.BUILD_CONFIG }} --nologo ${{ env.SOLUTION }}
+      working-directory: ./src
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+
   analyze:
     runs-on: ubuntu-latest
     permissions:
@@ -97,11 +142,6 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-nuget
 
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-
     - name: Nuget Vulnerabiilty Scan
       run: |
         dotnet list package --vulnerable 2>&1 | tee vulnerable.txt
@@ -124,9 +164,6 @@ jobs:
         sed -i "s/OSSINDEXAPI_USERNAME/$OSSINDEXAPI_USERNAME/g" NuGetDefense.json
         nugetdefense -p src/${{ env.SOLUTION }} --settings-file NuGetDefense.json
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
-
     - name: Secret detection
       uses: gitleaks/[email protected]