codeql.yml

name: "CodeQL Security Scan"

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]  # #5104: a draft starts only the cheap audits
    branches: [main]
    # #5132: on a PR only when engine code, a dependency pin or a workflow changes; the schedule below is the backstop
    # for everything else (tests, docs, site, corpora).
    paths:
      - "gitgalaxy/**"
      - ".github/**"
      - "pyproject.toml"
      - "ci/requirements/**"
      - "templates/requirements/**"
      - "requirements*.txt"
      - "action.yml"
      - "tests/tools/codeql_new_alerts.py"  # the report step reads it
  schedule:
    - cron: '0 12 * * *'  # daily: a weekly scan let alerts land in batches, days after the PR that added them

permissions:
  contents: read

concurrency:
  # One run per workflow per PR (or per ref outside a PR). Without this, a PR
  # that picks up several labels in one `gh pr create` starts a separate,
  # IDENTICAL run per label event on the same SHA (measured 2026-09-09: four
  # Full Suite Gate runs and five rosetta-audit runs for one commit), and a
  # re-push leaves the superseded run occupying the queue. cancel-in-progress
  # is scoped to pull_request on purpose -- the push/schedule/tag runs are the
  # ones that commit (docs, history charts, releases), and cancelling one
  # mid-write is how you get a half-written commit.
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  analyze:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}  # #5104: draft PRs skip heavy CI
    name: Analyze
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: ['python']

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        env:
          CODEQL_ACTION_DIFF_INFORMED_QUERIES: "false"  # a PR's analysis held no results at all (#6719: 0, main 405)
        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          languages: ${{ matrix.language }}
          queries: security-extended,security-and-quality

      - name: Perform CodeQL Analysis
        env:
          CODEQL_ACTION_DIFF_INFORMED_QUERIES: "false"
        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          category: "/language:${{matrix.language}}"
          output: codeql-results

      # A new error or warning fails Analyze, and ci-gate holds the PR. Notes and proven-false rules are only reported.
      - name: Report the results this PR adds
        if: ${{ github.event_name == 'pull_request' }}
        env:
          GH_TOKEN: ${{ github.token }}
          PR: ${{ github.event.pull_request.number }}
          REPO: ${{ github.repository }}
        run: |
          id=$(gh api "repos/$REPO/code-scanning/analyses?ref=refs/heads/main&tool_name=CodeQL&per_page=1" --jq '.[0].id') || exit 0
          gh api "repos/$REPO/code-scanning/analyses/$id" -H "Accept: application/sarif+json" > main.sarif || exit 0
          mapfile -t files < <(gh api --paginate "repos/$REPO/pulls/$PR/files" --jq '.[].filename' || true)
          python3 tests/tools/codeql_new_alerts.py --sarif codeql-results --baseline main.sarif \
            --summary "$GITHUB_STEP_SUMMARY" --enforce --files "${files[@]}"