codeql-analysis.yml

name: "CodeQL Analysis"

on:
  push:
    branches: [ "main" ]
  # No base-branch filter — see the note in ci.yml. CodeQL is a security gate;
  # a stacked PR must not be able to skip it by targeting a non-main base.
  pull_request:
  schedule:
    - cron: '0 6 * * 1'

permissions:
  contents: read
  security-events: write
  actions: read


# Supersede superseded work instead of stacking it. Without this, every push
# to a PR branch queued a brand-new full run alongside the ones it obsoleted;
# with ~30 workflows and dozens of open PRs the Actions queue could not drain.
#
# PR runs are keyed by PR number and cancel their predecessors -- that is where
# all the queue pressure comes from, since every `push:` trigger here is already
# filtered to main. Non-PR runs (push, schedule) are keyed by commit SHA so they
# land in singleton groups: keying them on github.ref would collide every merge
# to main into one group, and GitHub cancels the *pending* run in a group, so a
# burst of merges would silently drop the middle commits' verdicts.
concurrency:
  group: codeql-analysis-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}

jobs:
  analyze:
    name: "Security Scan - ${{ matrix.language }}"
    runs-on: ubuntu-latest
    timeout-minutes: 360
    
    strategy:
      fail-fast: false
      matrix:
        language: [ 'javascript', 'python' ]
    
    steps:
    - name: Checkout repository
      uses: actions/checkout@v7
      with:
        fetch-depth: 0
    
    - name: Cache dependencies (Python)
      if: matrix.language == 'python'
      uses: actions/cache@v6
      with:
        path: ~/.cache/pip
        key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt') }}
    
    - name: Cache dependencies (Node)
      if: matrix.language == 'javascript'
      uses: actions/cache@v6
      with:
        # Cache the npm download cache, not node_modules: this is an npm
        # workspaces repo, so deps hoist to the root and apps/web/node_modules
        # is mostly symlinks. ~/.npm matches the rest of CI (setup-node cache).
        path: ~/.npm
        key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
    
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: ${{ matrix.language }}
        config-file: ./.github/codeql/codeql-config.yml
    
    - name: Autobuild
      uses: github/codeql-action/autobuild@v4
    
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4
      with:
        category: "/language:${{matrix.language}}"
        wait-for-processing: true

# Dependency / supply-chain scanning is handled by dedicated workflows:
#   - dependency-review.yml  (PR-time review of new dependencies)
#   - security.yml           (npm audit, safety, bandit, trivy)
# The previous OWASP dependency-check job was removed: it was pinned to an
# unstable @main ref and pointed at paths that no longer exist (frontend/,
# src/mcp-bridge.py), so it produced no usable SARIF.