codeql.yml

name: codeql

on:
  push:
    branches: [main]
    paths-ignore: ["docs/**"]
  pull_request:
    branches: [main]
    paths-ignore: ["docs/**"]
  schedule:
    # Weekly re-scan so newly-published CodeQL queries run against main even
    # during quiet periods. Monday 07:00 UTC.
    - cron: "0 7 * * 1"
  workflow_dispatch: # manual run (e.g. to validate the swift scan on a branch)

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # GitHub Actions workflow analysis — cheap (Linux, no build). Runs on every
  # trigger, PRs included, so workflow-injection issues are caught pre-merge.
  actions:
    name: Analyze (actions)
    runs-on: ubuntu-latest
    permissions:
      security-events: write # upload SARIF results to code scanning
      actions: read # required to read workflow runs on private repos
      contents: read # checkout
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
        with:
          languages: actions
          build-mode: none

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
        with:
          category: "/language:actions"

  # Swift analysis — expensive (a full macOS build). Skipped on PRs: check.yml
  # already gates every PR with a macOS build, so running a second one here just
  # to trace it doubles the per-PR cost. Instead it runs on push to main, the
  # weekly schedule, and manual dispatch — so main + the schedule still scan all
  # the Swift code, just off the PR critical path.
  swift:
    name: Analyze (swift)
    if: github.event_name != 'pull_request'
    runs-on: macos-26
    timeout-minutes: 60
    env:
      DERIVED: ${{ github.workspace }}/DerivedData-codeql
    permissions:
      security-events: write
      actions: read
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Cache the resolved SwiftPM checkouts so we don't re-clone the SDKs'
      # full git history on every run. Keyed on the pinned Package.resolved, so a
      # dependency bump busts the cache. restore-keys lets an older cache seed a
      # partial hit when the pins change.
      - name: Cache SwiftPM checkouts
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ${{ env.DERIVED }}/SourcePackages
          key: spm-${{ runner.os }}-${{ hashFiles('App/Blurt/Blurt.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved') }}
          restore-keys: |
            spm-${{ runner.os }}-

      # Resolve dependencies BEFORE codeql init, so the git clones run natively
      # (arm64) and untraced. CodeQL's Swift tracer runs the build as an x86_64
      # (Rosetta) process, which makes dependency resolution — the slow part —
      # crawl. CodeQL only needs to trace the compile, not the resolve, so we do
      # the resolve here into the shared DerivedData path the build reuses.
      - name: Resolve packages (native, untraced)
        working-directory: App/Blurt
        run: |
          xcodebuild \
            -project Blurt.xcodeproj \
            -scheme Blurt \
            -derivedDataPath "$DERIVED" \
            -resolvePackageDependencies

      # The iPhone app's project is generated, not committed (see check.yml's
      # ios-build), so generate it before tracing starts. It has no remote
      # packages to resolve — only the local engine.
      - name: Generate the iPhone app's project (untraced)
        working-directory: App/BlurtiOS
        run: |
          brew install xcodegen
          xcodegen generate --quiet

      - name: Initialize CodeQL
        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
        with:
          languages: swift
          build-mode: manual

      # build-mode: manual — build the committed Blurt.xcodeproj directly (no
      # xcodegen: it's checked in and drift-checked by the `check` workflow).
      # Generic destination (no arch pin) so the build produces a universal binary
      # (arm64 + x86_64). CI runners are arm64 only, so the x86_64 slice is not
      # tested here — community testing / manual verification on Intel hardware.
      # -derivedDataPath reuses the packages resolved above. Codesigning is off:
      # the Developer ID cert only lives on the maintainer's machine.
      - name: Build Swift
        working-directory: App/Blurt
        run: |
          xcodebuild \
            -project Blurt.xcodeproj \
            -scheme Blurt \
            -configuration Debug \
            -destination 'generic/platform=macOS' \
            -derivedDataPath "$DERIVED" \
            CODE_SIGN_IDENTITY="-" \
            CODE_SIGNING_REQUIRED=NO \
            CODE_SIGNING_ALLOWED=NO \
            build

      # The iPhone app, its keyboard and BlurtiOSCore, traced in the same
      # database: CodeQL analyses whatever the job compiles between init and
      # analyze, so the Mac build alone would leave App/BlurtiOS unscanned.
      # Simulator, signing off — nothing here needs a device or a team. One
      # architecture: CodeQL extracts every compile, and a second slice would
      # compile and extract every file again for nothing new.
      - name: Build Swift (iPhone)
        working-directory: App/BlurtiOS
        run: |
          xcodebuild \
            -project BlurtiOS.xcodeproj \
            -scheme BlurtiOS \
            -configuration Debug \
            -destination 'generic/platform=iOS Simulator' \
            -derivedDataPath "$DERIVED-ios" \
            ARCHS=arm64 ONLY_ACTIVE_ARCH=YES \
            CODE_SIGN_IDENTITY="-" \
            CODE_SIGNING_REQUIRED=NO \
            CODE_SIGNING_ALLOWED=NO \
            build

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
        with:
          category: "/language:swift"