codeql.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
---
name: "CodeQL"

on:  # yamllint disable-line rule:truthy
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Run weekly on Sunday at 07:13 UTC. Off-peak hour chosen so the job
    # doesn't collide with Monday-morning CI surges.
    - cron: "13 7 * * 0"

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # Which analyses can find anything new. On a pull request, `python`
  # runs only when a `.py` file changed and `actions` only when
  # something under `.github/` did; this workflow changing runs both.
  # A push to `main` and the weekly schedule always run both, so the
  # default branch's analysis — what pull requests are compared
  # against — never goes stale. CodeQL is not a required check
  # (`.asf.yaml`), so a skipped analysis blocks nothing.
  languages:
    name: select-languages
    runs-on: ubuntu-slim
    permissions:
      contents: read
    outputs:
      languages: ${{ steps.pick.outputs.languages }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
          # Full history so the pull-request diff below has the merge base.
          fetch-depth: 0
      - id: pick
        env:
          EVENT: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          if [ "${EVENT}" != "pull_request" ]; then
            echo 'languages=["python","actions"]' >> "${GITHUB_OUTPUT}"
            exit 0
          fi
          changed="${RUNNER_TEMP}/changed-files.txt"
          git diff --name-only "${BASE_SHA}...${HEAD_SHA}" > "${changed}"
          picked=()
          if grep -qx '\.github/workflows/codeql\.yml' "${changed}"; then
            picked=(python actions)
          else
            grep -q '\.py$' "${changed}" && picked+=(python)
            grep -q '^\.github/' "${changed}" && picked+=(actions)
          fi
          json=$(printf '%s\n' "${picked[@]}" | python3 -c 'import json,sys; print(json.dumps([l for l in sys.stdin.read().split() if l]))')
          echo "languages=${json}" >> "${GITHUB_OUTPUT}"
          echo "CodeQL analyses for this pull request: ${json}"

  analyze:
    name: "Analyze (${{ matrix.language }})"
    # The Python analysis is ~8 minutes on `ubuntu-slim` (1 vCPU, 5 GB,
    # killed at 15 minutes): ~2 minutes extracting and ~4 running
    # queries, both multi-threaded, so the cores pay, and the tree only
    # grows towards that kill. It runs on `ubuntu-latest` (4 vCPUs). The
    # Actions analysis is ~2 minutes and stays on `ubuntu-slim`.
    # `ubuntu-latest` has no 15-minute kill, so `timeout-minutes` keeps an
    # explicit ceiling instead of the 6-hour default (as in pre-commit.yml).
    runs-on: ${{ matrix.language == 'python' && 'ubuntu-latest' || 'ubuntu-slim' }}
    timeout-minutes: 30
    needs: languages
    # An empty matrix would fail the job rather than skip it.
    if: ${{ needs.languages.outputs.languages != '[]' }}
    permissions:
      # Writing security-events is required for CodeQL to upload results to
      # the repository's "Security" tab. The rest stay read-only.
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        # `python` covers the hand-written tools under `tools/`. `actions`
        # is CodeQL's GitHub-Actions analyser — it inspects the workflow
        # YAML in `.github/workflows/` for taint flows, secret exposure,
        # and other CI-side vulnerabilities. It complements `zizmor.yml`
        # (lint-style ruleset) with the deeper data-flow analysis.
        # Which of the two run is decided by the `languages` job above.
        language: ${{ fromJSON(needs.languages.outputs.languages) }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
        with:
          languages: ${{ matrix.language }}
          # Neither the Python tools (stdlib-only / single OAuth dep, no
          # untrusted network input at runtime) nor the workflow YAML
          # warrants `security-extended`; the default
          # `security-and-quality` suite is sufficient for both.
          queries: security-and-quality
          # `plugins/*/tools/` holds generated copies of `tools/*` packaged into
          # the plugins (the `copies` maps in tools/dev/check-family-plugins.py,
          # which also verifies them byte-for-byte). The sources are scanned;
          # scanning the copies only re-raises every source alert at a second
          # path, including ones already triaged there.
          config: |
            paths-ignore:
              - plugins/*/tools/**

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
        with:
          category: "/language:${{ matrix.language }}"