codeql.yml

# CodeQL code scanning.
#
# This exists as a workflow rather than as GitHub's default setup for one reason: Swift must be built explicitly.
# XcodeGen's committed project is prepared before CodeQL tracing begins so Homebrew never runs under Rosetta.
#
# Requires GitHub's default setup to be turned OFF for this repository (Settings › Code security › Code
# scanning), because the two configurations cannot both be active.
name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    # Weekly, so a new query release finds old code. Wednesday early UTC: no contention with release runs.
    - cron: "17 4 * * 3"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  classify:
    name: classify
    runs-on: ubuntu-24.04
    outputs:
      app: ${{ steps.route.outputs.app || 'true' }}
      python: ${{ steps.route.outputs.python || 'true' }}
      actions: ${{ steps.route.outputs.actions || 'true' }}
    steps:
      - id: checkout
        if: github.event_name == 'push' || github.event_name == 'pull_request'
        continue-on-error: true
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
        with:
          # Code scanning reports against the PR head, so classify that exact commit rather than the merge ref.
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0

      - id: what
        name: Classify the exact change
        if: steps.checkout.outcome == 'success'
        continue-on-error: true
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail
          python3 -I scripts/classify_changes.py \
            --repo . --base "$BASE_SHA" --head "$HEAD_SHA" --github-output "$GITHUB_OUTPUT" \
            > "$RUNNER_TEMP/codeql-classification.json"
          cat "$RUNNER_TEMP/codeql-classification.json"

      - id: route
        name: Route language analysis fail closed
        if: always()
        env:
          EVENT_NAME: ${{ github.event_name }}
          CHECKOUT_OUTCOME: ${{ steps.checkout.outcome }}
          CLASSIFIER_OUTCOME: ${{ steps.what.outcome }}
          APP_ROUTE: ${{ steps.what.outputs.app }}
          PYTHON_ROUTE: ${{ steps.what.outputs.python }}
          ACTIONS_ROUTE: ${{ steps.what.outputs.actions }}
        run: |
          set -euo pipefail
          if [[ "$EVENT_NAME" == schedule || "$EVENT_NAME" == workflow_dispatch ]]; then
            app=true
            python=true
            actions=true
          elif [[ "$CHECKOUT_OUTCOME" == success && "$CLASSIFIER_OUTCOME" == success &&
                  "$APP_ROUTE" =~ ^(true|false)$ && "$PYTHON_ROUTE" =~ ^(true|false)$ &&
                  "$ACTIONS_ROUTE" =~ ^(true|false)$ ]]; then
            app=$APP_ROUTE
            python=$PYTHON_ROUTE
            actions=$ACTIONS_ROUTE
          else
            echo "::warning::CodeQL classification failed; routing every language."
            app=true
            python=true
            actions=true
          fi
          echo "app=$app" >> "$GITHUB_OUTPUT"
          echo "python=$python" >> "$GITHUB_OUTPUT"
          echo "actions=$actions" >> "$GITHUB_OUTPUT"

  analyze-swift:
    name: analyze (swift)
    needs: classify
    if: always() && needs.classify.outputs.app == 'true'
    runs-on: macos-15
    timeout-minutes: 60
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      # Everything that is not compilation happens before init. Once init runs, CodeQL tracing preloads an x86_64
      # library through DYLD_INSERT_LIBRARIES, putting child processes under Rosetta where ARM Homebrew refuses work.
      - name: Prepare the project
        run: |
          set -euo pipefail
          sudo xcode-select -s "$(ls -d /Applications/Xcode*.app | sort -V | tail -1)"
          xcodebuild -version
          xcodebuild -project Flowlight.xcodeproj -list >/dev/null

      - uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4
        with:
          languages: swift
          build-mode: manual
          queries: security-extended

      - name: Build for analysis
        run: |
          set -euo pipefail
          xcodebuild clean build \
            -project Flowlight.xcodeproj \
            -scheme Flowlight \
            -destination 'platform=macOS' \
            CODE_SIGN_IDENTITY=- CODE_SIGN_STYLE=Manual DEVELOPMENT_TEAM= CODE_SIGN_ENTITLEMENTS=

      - uses: github/codeql-action/analyze@7999b86c43a865dc79d8923397f35af22de63401 # v4
        with:
          category: /language:swift

  analyze-python:
    name: analyze (python)
    needs: classify
    if: always() && needs.classify.outputs.python == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4
        with:
          languages: python
          build-mode: none
          queries: security-extended

      - uses: github/codeql-action/analyze@7999b86c43a865dc79d8923397f35af22de63401 # v4
        with:
          category: /language:python

  analyze-actions:
    name: analyze (actions)
    needs: classify
    if: always() && needs.classify.outputs.actions == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4
        with:
          languages: actions
          build-mode: none
          queries: security-extended

      - uses: github/codeql-action/analyze@7999b86c43a865dc79d8923397f35af22de63401 # v4
        with:
          category: /language:actions

  gate:
    name: CodeQL / gate
    if: always()
    needs: [classify, analyze-swift, analyze-python, analyze-actions]
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Require successful classification and every routed language
        env:
          CLASSIFY_RESULT: ${{ needs.classify.result }}
          SWIFT_ROUTE: ${{ needs.classify.outputs.app }}
          PYTHON_ROUTE: ${{ needs.classify.outputs.python }}
          ACTIONS_ROUTE: ${{ needs.classify.outputs.actions }}
          SWIFT_RESULT: ${{ needs.analyze-swift.result }}
          PYTHON_RESULT: ${{ needs.analyze-python.result }}
          ACTIONS_RESULT: ${{ needs.analyze-actions.result }}
        run: scripts/check-codeql-gate.sh