codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '45 7 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: go
            runner: macos-26
            build-mode: manual
          - language: swift
            runner: macos-26
            build-mode: manual
          - language: actions
            runner: ubuntu-latest
            build-mode: none
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        if: matrix.language == 'go' || matrix.language == 'swift'
        with:
          go-version-file: go.mod
          cache: false
      - name: Prepare pinned runtime build components
        if: matrix.language == 'swift'
        run: bash .github/scripts/prepare-macos-runtime.sh "$GITHUB_WORKSPACE" "$RUNNER_TEMP/macscope-runtime"
      - name: Initialize CodeQL
        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
      - name: Build every Go production package without running it
        if: matrix.language == 'go'
        run: go build -trimpath ./...
      - name: Build the native Swift application
        if: matrix.language == 'swift'
        run: xcodebuild -project app/MacScope.xcodeproj -scheme MacScope -configuration Debug -destination 'platform=macOS,arch=x86_64' -derivedDataPath "$RUNNER_TEMP/macscope-codeql" ARCHS=x86_64 ONLY_ACTIVE_ARCH=YES SWIFT_ENABLE_EXPLICIT_MODULES=NO SWIFT_USE_INTEGRATED_DRIVER=NO COMPILATION_CACHE_ENABLE_CACHING=NO SWIFT_ENABLE_COMPILE_CACHE=NO CODE_SIGNING_REQUIRED=NO CODE_SIGNING_ALLOWED=NO build
      - name: Analyze without a security write token
        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
        with:
          category: /language:${{ matrix.language }}
          output: ${{ runner.temp }}/codeql-results
          upload: never
          upload-database: false
      - name: Reject Swift extraction errors
        if: matrix.language == 'swift'
        env:
          SARIF_FILE: ${{ runner.temp }}/codeql-results/swift.sarif
        run: |
          if [[ ! -s "$SARIF_FILE" ]]; then
            printf 'Swift SARIF is missing or empty.\n' >&2
            exit 1
          fi
          error_count="$(jq -er '
            if type != "object" or (.runs | type) != "array" or (.runs | length) == 0 then
              error("Invalid Swift SARIF runs")
            elif any(.runs[]; type != "object" or (.invocations | type) != "array" or (.invocations | length) == 0) then
              error("Invalid Swift SARIF invocations")
            elif any(.runs[].invocations[]; type != "object" or (.toolExecutionNotifications | type) != "array") then
              error("Invalid Swift SARIF notifications")
            elif any(.runs[].invocations[].toolExecutionNotifications[]; type != "object" or (.descriptor | type) != "object" or (.descriptor.id | type) != "string") then
              error("Invalid Swift SARIF notification descriptor")
            else
              [.runs[].invocations[].toolExecutionNotifications[] | select(.descriptor.id == "swift/diagnostics/extraction-errors")] | length
            end
          ' "$SARIF_FILE")"
          if [[ "$error_count" != "0" ]]; then
            printf 'Swift extraction reported %s compiler diagnostics; inspect the analysis diagnostics before publishing SARIF.\n' "$error_count" >&2
            exit 1
          fi
          printf 'Swift extraction compiler diagnostics: 0\n'
      - name: Retain analysis for the isolated upload job
        if: success() || failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: codeql-${{ matrix.language }}
          path: ${{ runner.temp }}/codeql-results/*.sarif
          if-no-files-found: error
          retention-days: 1

  publish:
    name: Publish analysis (${{ matrix.language }})
    needs: analyze
    strategy:
      fail-fast: false
      matrix:
        language: [go, swift, actions]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: codeql-${{ matrix.language }}
          path: ${{ runner.temp }}/codeql-results
      - name: Upload the completed analysis
        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
        with:
          sarif_file: ${{ runner.temp }}/codeql-results
          category: /language:${{ matrix.language }}
          wait-for-processing: true

  complete:
    name: CodeQL source analysis
    if: always()
    needs: [analyze, publish]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Require analysis and upload for every language
        env:
          ANALYSIS_RESULT: ${{ needs.analyze.result }}
          PUBLISH_RESULT: ${{ needs.publish.result }}
        run: |
          if [[ "$ANALYSIS_RESULT" != success || "$PUBLISH_RESULT" != success ]]; then
            printf 'CodeQL requires successful extraction, analysis, and upload for every configured language. Analysis=%s upload=%s\n' "$ANALYSIS_RESULT" "$PUBLISH_RESULT" >&2
            exit 1
          fi