codeql.yml

# Advanced CodeQL setup for Evidentia.
#
# Replaces GitHub's default CodeQL setup with an advanced workflow so a
# config-file can load a local Models-as-Data data extension
# (.github/codeql/path-injection-barriers.model.yml) plus own the
# paths-ignore filter. NOTE: py/path-injection does NOT yet consume MaD
# barrierModel (verified 2026-07-08), so that FP class is dismissal-managed
# today and the model is a forward-looking hook — see codeql-config.yml for
# the full history (and why the earlier `.qll` sanitizer pack never loaded).
#
# Default setup must be disabled in repo Settings -> Code security
# and analysis BEFORE this workflow takes over. While both are
# enabled they overlap; only one will produce the canonical alert
# stream.
#
# References:
# - https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning
# - https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-python/
# - https://github.com/github/codeql-action

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # Merge queue: a required check must run on merge_group or the queue stalls.
  merge_group:
  schedule:
    # Weekly re-scan to catch query-suite updates that surface new
    # alerts without a code change. Mondays 12:00 UTC.
    - cron: '0 12 * * 1'

# Top-level permissions are read-only-by-default; the analyze job
# elevates to security-events: write at job scope only (closes the
# OpenSSF Scorecard Token-Permissions alert that flagged top-level
# write scope as too broad).
permissions:
  contents: read

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read

    strategy:
      fail-fast: false
      matrix:
        language: [python, javascript-typescript, actions]

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
        with:
          languages: ${{ matrix.language }}
          config-file: ./.github/codeql/codeql-config.yml
          # security-extended adds the same query suite as default
          # setup; security-and-quality is broader but noisier.
          queries: security-extended

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
        with:
          category: "/language:${{ matrix.language }}"