codeql.yml

name: CodeQL

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  schedule:
    - cron: "23 8 * * 1"
  workflow_dispatch:

permissions:
  contents: read

env:
  XCODE_VERSION: ${{ vars.XCODE_VERSION }}

concurrency:
  group: codeql-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze Swift
    runs-on: macos-26
    timeout-minutes: 60
    permissions:
      contents: read
      packages: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Select Xcode
        run: scripts/ci-select-xcode.sh
      - name: Install the firmware helpers' build tools
        run: brew install autoconf automake libtool pkg-config cmake
      - name: Reuse the firmware helpers built from the same pinned sources
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: build-output/restore-helpers
          key: restore-helpers-${{ hashFiles('scripts/build-restore-helpers.sh') }}-${{ env.XCODE_VERSION }}
      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
        with:
          languages: swift
          build-mode: manual
      - name: Build the package and the app
        run: |
          swift build --arch x86_64
          xcodebuild -project iOSDeveloperToolkit.xcodeproj -scheme iOSDeveloperToolkit \
            -configuration Debug -destination 'platform=macOS,arch=x86_64' \
            -derivedDataPath "$RUNNER_TEMP/dd" \
            ARCHS=x86_64 ONLY_ACTIVE_ARCH=YES SWIFT_ENABLE_EXPLICIT_MODULES=NO \
            CODE_SIGNING_REQUIRED=NO CODE_SIGNING_ALLOWED=NO \
            COMPILATION_CACHE_ENABLE_CACHING=NO SWIFT_ENABLE_COMPILE_CACHE=NO \
            SWIFT_USE_INTEGRATED_DRIVER=NO build
      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
        with:
          upload: never
          upload-database: false
          output: ${{ runner.temp }}/codeql-sarif
          category: "/language:swift"
      - name: Reject Swift extraction errors
        env:
          SARIF_FILE: ${{ runner.temp }}/codeql-sarif/swift.sarif
        run: |
          if [[ ! -s "$SARIF_FILE" ]]; then
            printf 'Swift SARIF is missing or empty.\n' >&2
            exit 1
          fi
          error_count="$(jq -er '
            if type != "object" or (.runs | type) != "array" or (.runs | length) == 0 then
              error("Invalid Swift SARIF runs")
            elif any(.runs[]; type != "object" or (.invocations | type) != "array" or (.invocations | length) == 0) then
              error("Invalid Swift SARIF invocations")
            elif any(.runs[].invocations[]; type != "object" or (.toolExecutionNotifications | type) != "array") then
              error("Invalid Swift SARIF notifications")
            elif any(.runs[].invocations[].toolExecutionNotifications[]; type != "object" or (.descriptor | type) != "object" or (.descriptor.id | type) != "string") then
              error("Invalid Swift SARIF notification descriptor")
            else
              [.runs[].invocations[].toolExecutionNotifications[] | select(.descriptor.id == "swift/diagnostics/extraction-errors")] | length
            end
          ' "$SARIF_FILE")"
          if [[ "$error_count" != "0" ]]; then
            printf 'Swift extraction reported %s compiler diagnostics; inspect the analysis diagnostics before publishing SARIF.\n' "$error_count" >&2
            exit 1
          fi
          printf 'Swift extraction compiler diagnostics: 0\n'
      - name: Upload SARIF artifact
        if: success() || failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: codeql-swift
          path: ${{ runner.temp }}/codeql-sarif
          if-no-files-found: error
          retention-days: 1

  analyze-actions:
    name: Analyze Actions
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
        with:
          languages: actions
          build-mode: none
      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
        with:
          upload: never
          upload-database: false
          output: ${{ runner.temp }}/codeql-sarif
          category: /language:actions
      - name: Upload SARIF artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: codeql-actions
          path: ${{ runner.temp }}/codeql-sarif
          if-no-files-found: error
          retention-days: 1

  upload-analyze:
    name: Upload Swift analysis
    needs: analyze
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Download SARIF artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: codeql-swift
          path: sarif
      - name: Upload analysis to code scanning
        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
        with:
          sarif_file: sarif
          category: /language:swift
          wait-for-processing: true

  upload-analyze-actions:
    name: Upload Actions analysis
    needs: analyze-actions
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Download SARIF artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: codeql-actions
          path: sarif
      - name: Upload analysis to code scanning
        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
        with:
          sarif_file: sarif
          category: /language:actions
          wait-for-processing: true

  upload-gate:
    name: Code scanning uploads
    needs: [upload-analyze, upload-analyze-actions]
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions: {}
    steps:
      - name: Require every analysis upload to succeed
        env:
          SWIFT_UPLOAD_RESULT: ${{ needs.upload-analyze.result }}
          ACTIONS_UPLOAD_RESULT: ${{ needs.upload-analyze-actions.result }}
        run: |
          if [[ "$SWIFT_UPLOAD_RESULT" != "success" ]] || [[ "$ACTIONS_UPLOAD_RESULT" != "success" ]]; then
            printf 'Code scanning upload failed or was skipped: swift=%s; actions=%s\n' "$SWIFT_UPLOAD_RESULT" "$ACTIONS_UPLOAD_RESULT" >&2
            exit 1
          fi