codeql-verification.yml

name: CodeQL verification

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: api-explorer-codeql-${{ github.ref }}
  cancel-in-progress: false

jobs:
  analyze:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - name: Check out candidate
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # releases/v6 commit
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Verify candidate shape
        shell: bash
        run: |
          set -euo pipefail
          test -z "$(git status --porcelain)"
          git merge-base --is-ancestor 80270e0af984025b14afc61c0d0b0a4f08d968bf HEAD

      - name: Initialize CodeQL
        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          languages: javascript-typescript
          build-mode: none
          config: |
            queries:
              - uses: security-extended
            threat-models: local

      - name: Analyze without publishing temporary alerts
        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          category: /language:javascript-typescript
          upload: never
          output: codeql-results

      - name: Reject Critical and High findings
        shell: bash
        run: |
          set -euo pipefail
          python3 - <<'PY'
          import glob
          import json

          blocked = []
          unresolved = []
          total = 0
          for path in glob.glob('codeql-results/**/*.sarif', recursive=True):
              with open(path, encoding='utf-8') as stream:
                  sarif = json.load(stream)
              for run in sarif.get('runs', []):
                  rules = {rule.get('id'): rule for rule in run.get('tool', {}).get('driver', {}).get('rules', [])}
                  for extension in run.get('tool', {}).get('extensions', []):
                      rules.update({rule.get('id'): rule for rule in extension.get('rules', [])})
                  for result in run.get('results', []):
                      total += 1
                      rule_id = result.get('ruleId')
                      rule = rules.get(rule_id)
                      if rule is None:
                          unresolved.append((rule_id, 'missing rule metadata'))
                          continue
                      try:
                          score = float(rule.get('properties', {}).get('security-severity', '0'))
                      except (TypeError, ValueError):
                          unresolved.append((rule_id, 'invalid security severity'))
                          continue
                      if score >= 7.0:
                          location = result.get('locations', [{}])[0].get('physicalLocation', {})
                          blocked.append((rule_id, score, location.get('artifactLocation', {}).get('uri', 'unknown'), location.get('region', {}).get('startLine', 0)))
          print(f'codeql_total={total}')
          print(f'codeql_critical_high={len(blocked)}')
          print(f'codeql_unresolved_rule_metadata={len(unresolved)}')
          for finding in blocked:
              print(f'{finding[0]}\t{finding[1]}\t{finding[2]}:{finding[3]}')
          for finding in unresolved:
              print(f'{finding[0]}\t{finding[1]}')
          if blocked or unresolved:
              raise SystemExit(1)
          PY

      - name: Upload verification evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: api-explorer-codeql-${{ github.sha }}
          path: codeql-results/
          if-no-files-found: error
          retention-days: 30
          compression-level: 9