SIGNIA/.github/workflows/codeql.yml at main · SIGNIAINDEX/SIGNIA · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: CodeQL

on:
  push:
    branches: ["main", "SIGNIAINDEX-upload-1"]
  pull_request:
    branches: ["main"]
  schedule:
    - cron: "0 3 * * 1"
  workflow_dispatch:

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

permissions:
  actions: read
  contents: read
  security-events: write

env:
  NODE_VERSION: "20"
  PNPM_VERSION: "9"

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        language: ["javascript-typescript"]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: security-extended

      # -------------------------------------------
      # JS/TS Setup & Build
      # -------------------------------------------

      # Fix 1: Install pnpm before Node setup
      - name: Setup pnpm (JS/TS only)
        if: ${{ matrix.language == 'javascript-typescript' }}
        uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node (JS/TS only)
        if: ${{ matrix.language == 'javascript-typescript' }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          # Note: cache: "pnpm" removed to avoid "lock file not found" error during initial run

      - name: Install JS dependencies (JS/TS only)
        if: ${{ matrix.language == 'javascript-typescript' }}
        run: |
          set -euo pipefail
          # Install dependencies and generate lockfile if missing
          if [ -f package.json ]; then
            pnpm install
          fi
          # Handle monorepo subdirectories
          if [ -f console/web/package.json ]; then
            (cd console/web && pnpm install)
          fi
          if [ -f console/interface/package.json ]; then
            (cd console/interface && pnpm install)
          fi
          if [ -f sdk/ts/package.json ]; then
            (cd sdk/ts && pnpm install)
          fi

      - name: Build JS/TS (JS/TS only)
        if: ${{ matrix.language == 'javascript-typescript' }}
        run: |
          set -euo pipefail
          # Execute build scripts if they exist
          if [ -f package.json ] && pnpm -s run | grep -q "^build"; then
            pnpm run build
          fi
          if [ -f console/web/package.json ] && (cd console/web && pnpm -s run | grep -q "^build"); then
            (cd console/web && pnpm run build)
          fi
          if [ -f console/interface/package.json ] && (cd console/interface && pnpm -s run | grep -q "^build"); then
            (cd console/interface && pnpm run build)
          fi
          if [ -f sdk/ts/package.json ] && (cd sdk/ts && pnpm -s run | grep -q "^build"); then
            (cd sdk/ts && pnpm run build)
          fi

      # -------------------------------------------
      # Rust Setup & Build
      # -------------------------------------------

      - name: Install Rust toolchain (Rust only)
        if: ${{ matrix.language == 'rust' }}
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo (Rust only)
        if: ${{ matrix.language == 'rust' }}
        uses: Swatinem/rust-cache@v2
        with:
          cache-on-failure: true

      - name: Build Rust (Rust only)
        if: ${{ matrix.language == 'rust' }}
        run: |
          set -euo pipefail
          # Fix 2: Removed --locked to allow CI to update/generate Cargo.lock if needed
          cargo build --release --manifest-path crates/signia-core/Cargo.toml
          cargo build --release --manifest-path crates/signia-plugins/Cargo.toml
          cargo build --release --manifest-path crates/signia-store/Cargo.toml
          cargo build --release --manifest-path crates/signia-api/Cargo.toml
          cargo build --release --manifest-path crates/signia-cli/Cargo.toml
          cargo build --release --manifest-path crates/signia-solana-client/Cargo.toml

          if [ -f programs/signia-registry/Cargo.toml ]; then
            cargo build --release --manifest-path programs/signia-registry/Cargo.toml
          fi

      - name: Autobuild
        uses: github/codeql-action/autobuild@v3

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"