codeql.yml

# CodeQL SAST. The `actions` language pack analyzes the workflow YAML itself,
# not just the Python.
#
# Like every workflow in this repository: **do not assume it ever runs.** The
# account has an Actions spending limit (see ci.yml's header). `make verify`
# already runs ruff's bandit (S) rules locally on every gate pass; this adds a
# second, deeper SAST engine whenever Actions does run.
#
# This repository is public, so the job uploads SARIF to the code-scanning
# dashboard and also checks the same output in-run. A finding therefore fails
# the gate even if branch protection is reconfigured later.
name: codeql

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "42 6 * * 2" # weekly, staggered off ci.yml's Monday cron

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        language: [python, actions]
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        with:
          languages: ${{ matrix.language }}
      - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        with:
          category: "/language:${{ matrix.language }}"
          output: sarif-results
      - name: Fail on findings
        run: |
          python3 - <<'EOF'
          import glob
          import json
          import sys

          findings = 0
          for path in sorted(glob.glob("sarif-results/*.sarif")):
              with open(path) as fh:
                  sarif = json.load(fh)
              for run in sarif.get("runs", []):
                  for result in run.get("results", []):
                      findings += 1
                      rule = result.get("ruleId", "<no rule id>")
                      message = result.get("message", {}).get("text", "")
                      print(f"{path}: {rule}: {message}")
          if findings:
              print(f"CodeQL reported {findings} finding(s) — failing the gate.")
              sys.exit(1)
          print("CodeQL: no findings.")
          EOF