codeql.yml

# CodeQL SAST. The `actions` language pack analyzes the workflow YAML itself,
# not just the Python.
#
# Like every workflow in this repository: **do not assume it ever runs.** The
# account has an Actions spending limit (see ci.yml's header). `make verify`
# already runs ruff's bandit (S) rules locally on every gate pass; this adds a
# second, deeper SAST engine whenever Actions does run.
#
# This repository is PRIVATE and the account has no GitHub Advanced Security,
# so the code-scanning SARIF upload API is unavailable here ("Resource not
# accessible by integration"). The job therefore does not upload: it writes
# SARIF locally and fails directly on any finding, which is the same gate with
# the dashboard swapped for the job log. If the repo ever goes public (or GHAS
# is enabled), switch `upload: never` back to the default and restore the
# `security-events: write` permission to get the dashboard as well.
name: codeql

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "42 6 * * 2" # weekly, staggered off ci.yml's Monday cron

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        language: [python, actions]
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: github/codeql-action/init@a2983b8bed1923f44751c5c43237f479442827b3 # v3.37.4
        with:
          languages: ${{ matrix.language }}
      - uses: github/codeql-action/analyze@a2983b8bed1923f44751c5c43237f479442827b3 # v3.37.4
        with:
          category: "/language:${{ matrix.language }}"
          upload: never # private repo without GHAS — the upload API 403s; see header
          output: sarif-results
      - name: Fail on findings (no code-scanning dashboard on this private repo)
        run: |
          python3 - <<'EOF'
          import glob
          import json
          import sys

          findings = 0
          for path in sorted(glob.glob("sarif-results/*.sarif")):
              with open(path) as fh:
                  sarif = json.load(fh)
              for run in sarif.get("runs", []):
                  for result in run.get("results", []):
                      findings += 1
                      rule = result.get("ruleId", "<no rule id>")
                      message = result.get("message", {}).get("text", "")
                      print(f"{path}: {rule}: {message}")
          if findings:
              print(f"CodeQL reported {findings} finding(s) — failing the gate.")
              sys.exit(1)
          print("CodeQL: no findings.")
          EOF