codeql.yml

name: CodeQL Analysis

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    # No merge_group trigger on purpose: CodeQL isn't a required merge-queue
    # check, and the queue deletes its temporary gh-readonly-queue ref the
    # moment an entry merges. CodeQL would analyze that ref and then 404 on the
    # SARIF upload ("ref ... not found") — a noisy red X that gates nothing.
    # pull_request already gates PRs and push:main scans the merged result, so
    # scanning the ephemeral merge-queue ref adds no coverage.
  workflow_dispatch:
  schedule:
    - cron: "0 6 * * 1"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  DOTNET_NOLOGO: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  ContinuousIntegrationBuild: true
  SourceRevisionId: ${{ github.sha }}

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      actions: read
      contents: read
      pull-requests: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: actions
            build-mode: none
            query-suite: security-extended
          - language: csharp
            build-mode: manual
            query-suite: security-extended
          - language: ruby
            build-mode: none
            query-suite: security-extended

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup .NET
        if: matrix.language == 'csharp'
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: "10.0.x"
          cache: true
          cache-dependency-path: |
            **/*.csproj
            Directory.Packages.props
            global.json

      - name: Restore dependencies
        if: matrix.language == 'csharp'
        run: dotnet restore

      - name: Initialize CodeQL
        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          queries: ${{ matrix.query-suite }}

      # Release compiles every C# project in the solution. Package behavior is
      # covered by CI's package-validation matrix and does not need a second
      # full LocalFeed compilation inside the CodeQL trace.
      - name: Build C# solution once
        if: matrix.language == 'csharp'
        run: dotnet build --configuration Release --no-restore

      - name: Perform CodeQL Analysis
        id: analyze
        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          category: "/language:${{ matrix.language }}"
          output: codeql-results

      - name: Enforce CodeQL warning threshold
        shell: bash
        env:
          SARIF_DIRECTORY: ${{ steps.analyze.outputs.sarif-output }}
        run: |
          mapfile -t sarif_files < <(find "$SARIF_DIRECTORY" -type f -name '*.sarif' -print)
          if [[ ${#sarif_files[@]} -eq 0 ]]; then
            echo "::error::CodeQL did not produce a SARIF file in $SARIF_DIRECTORY"
            exit 1
          fi

          alert_count=$(jq -s '[
            .[]
            | .runs[] as $run
            | $run.results[]? as $result
            | ($result.level
                // ([
                  ($run.tool.driver.rules[]?),
                  ($run.tool.extensions[]?.rules[]?)
                  | select(.id == $result.ruleId)
                  | .defaultConfiguration.level
                ][0])
                // "warning") as $level
            | select($level == "error" or $level == "warning")
          ] | length' "${sarif_files[@]}")

          if [[ "$alert_count" -gt 0 ]]; then
            echo "::error::CodeQL found $alert_count error/warning alert(s)."
            exit 1
          fi

          echo "CodeQL found no error/warning alerts."