codeql.yml

name: codeql

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]
  schedule:
    # Mondays at 06:00 UTC. Catches drift in third-party advisories
    # against checked-in code without waiting for a PR.
    - cron: "0 6 * * 1"
  workflow_dispatch:

permissions:
  actions: read
  contents: read
  # Required for codeql-action/analyze to upload SARIF results that
  # the `code_quality` ruleset rule reads.
  security-events: write

jobs:
  # Pre-flight: detect whether the tree currently has any languages
  # CodeQL can analyse. The repo opened before code landed, and this
  # guard still keeps the workflow valid if language directories are
  # temporarily absent in a future branch. Without it,
  # `codeql-action/init` fails on "no supported languages found",
  # which blocks merges via the `code_quality` ruleset rule.
  detect-languages:
    runs-on: ubuntu-latest
    outputs:
      languages: ${{ steps.detect.outputs.languages }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - id: detect
        name: Detect supported languages present in the tree
        run: |
          set -euo pipefail
          langs=()
          if [ -d python ] && [ -n "$(find python -name '*.py' -print -quit 2>/dev/null)" ]; then
            langs+=("python")
          fi
          if [ -d go ] && [ -n "$(find go -name '*.go' -print -quit 2>/dev/null)" ]; then
            langs+=("go")
          fi
          if [ ${#langs[@]} -eq 0 ]; then
            echo "No supported languages detected — analyze job will skip."
            echo 'languages=[]' >> "$GITHUB_OUTPUT"
          else
            printf 'Detected:'; printf ' %s' "${langs[@]}"; printf '\n'
            json=$(printf '%s\n' "${langs[@]}" | python3 -c 'import json,sys; print(json.dumps([l.strip() for l in sys.stdin if l.strip()]))')
            echo "languages=$json" >> "$GITHUB_OUTPUT"
          fi

  analyze:
    name: Analyze (${{ matrix.language }})
    needs: detect-languages
    if: needs.detect-languages.outputs.languages != '[]'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        language: ${{ fromJSON(needs.detect-languages.outputs.languages) }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      # Pin to the commit SHA per the same discipline as the other
      # workflows; comment shows the human-readable version.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
        with:
          languages: ${{ matrix.language }}
          # `security-and-quality` is the broadest pack — covers
          # CWE-tagged security alerts plus general quality issues.
          # The ruleset's `severity: all` matches this scope. Switch
          # to `security-extended` if quality-only noise becomes a
          # signal-to-noise problem after Phase 1.
          queries: security-and-quality

      - name: Autobuild
        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
        with:
          category: "/language:${{ matrix.language }}"

  codeql:
    name: codeql
    if: ${{ always() }}
    needs:
      - detect-languages
      - analyze
    runs-on: ubuntu-latest
    steps:
      - name: Require language detection and applicable analyses
        env:
          DETECT: ${{ needs['detect-languages'].result }}
          LANGUAGES: ${{ needs['detect-languages'].outputs.languages }}
          ANALYZE: ${{ needs.analyze.result }}
        run: |
          set -euo pipefail
          if [ "$DETECT" != "success" ]; then
            echo "::error::Language detection concluded $DETECT"
            exit 1
          fi
          if [ "$LANGUAGES" != "[]" ] && [ "$ANALYZE" != "success" ]; then
            echo "::error::CodeQL analysis concluded $ANALYZE"
            exit 1
          fi