analysis.yml

# Two scanners nothing else here covers.
#
# CodeQL reads the code as a graph and asks questions a linter cannot: whether a
# value from outside reaches something that trusts it, whether a path exists that
# leaves state half-written. Very little of that applies to a processor model,
# which takes integers and returns integers. What does apply is the firmware
# loader and the manifest reader, which are the only places in the project that
# open a file somebody else supplied.
#
# Scorecard reads the repository rather than the code: whether the workflows pin
# what they run, whether branches are protected, whether a release is signed. It
# is the check that notices the project drifting away from its own standards
# rather than the code drifting away from correct.
name: Analysis

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "41 6 * * 1"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: analysis-${{ github.ref }}
  cancel-in-progress: true

jobs:
  codeql:
    name: CodeQL
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read
      security-events: write
    steps:
      - uses: actions/checkout@v7

      - uses: github/codeql-action/init@v4
        with:
          languages: python
          # Beyond the default set: the extended queries cover paths the default
          # ones consider too noisy for most projects. A file reader that decides
          # whether to trust its input is exactly the case they are noisy about.
          queries: security-extended,security-and-quality

      - uses: github/codeql-action/analyze@v4
        with:
          category: "/language:python"

  scorecard:
    name: Scorecard
    runs-on: ubuntu-latest
    # A pull request from a fork cannot be given the token this needs, and running
    # it there would fail for a reason that has nothing to do with the change.
    if: github.event_name != 'pull_request'
    permissions:
      contents: read
      actions: read
      security-events: write
      id-token: write
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: ossf/scorecard-action@v2.4.4
        with:
          results_file: results.sarif
          results_format: sarif
          # Publishes the score so the badge in the README reflects something
          # anybody can re-derive rather than a number this repository asserts.
          publish_results: true

      - uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: results.sarif