codeql.yml

# CodeQL scanning is intentionally data-only. This workflow may analyze
# pull-request-controlled code while holding security-events:write, so it must
# never execute repository reporter/test scripts or mutate PR comments.
name: "CodeQL Advanced"

on:
  workflow_dispatch:
  # Topic branches (claude/**, codex/**, feature/**) are analyzed through
  # the pull_request trigger only; the push copy duplicated every analysis.
  push:
    branches: [ main, develop, Working ]
  pull_request:
    branches: [ main, develop, Working ]
  schedule:
    - cron: '35 22 * * 4'

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
    # CodeQL Action v4.37.9 pins CLI/bundle 2.26.4. Its buildless C/C++
    # scanner otherwise synthesizes -std=c++17 even though SparkEngine is a
    # C++23 project. Keep this option bound to that exact action pin; the
    # workflow-shape tests must be updated deliberately if the pin changes.
    env:
      CODEQL_EXTRACTOR_CPP_OPTION_FRONTEND_OPTIONS: --c++23
    strategy:
      fail-fast: false
      matrix:
        include:
        - language: actions
          build-mode: none
          artifact-file: actions.sarif
        - language: c-cpp
          build-mode: none
          artifact-file: cpp.sarif
        - language: python
          build-mode: none
          artifact-file: python.sarif
    steps:
    - name: Checkout repository
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
        # workflow_run.head_sha identifies the PR head, not GitHub's synthetic
        # merge ref. Analyze that exact immutable commit so artifact provenance,
        # freshness checks, and the actual CodeQL input all agree.
        ref: ${{ github.event.pull_request.head.sha || github.sha }}
        persist-credentials: false
        fetch-depth: 1

    - name: Initialize CodeQL
      uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        # Keep all scanner configuration in this attested workflow. PR code is
        # source data only and cannot supply query packs, scripts, or config.
        config: |
          paths-ignore:
            - "ThirdParty"
            - "ThirdParty/**"

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
      with:
        category: "/language:${{ matrix.language }}"
        output: ${{ runner.temp }}/codeql-sarif
        upload: always
        upload-database: false

    # Direct-file artifacts use the uploaded file name as the artifact name.
    # Rename the scanner output in trusted workflow code so a failed-job-only
    # rerun cannot reuse a successful language artifact from an older attempt.
    - name: Bind raw CodeQL SARIF to exact source attempt
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
      env:
        SARIF_ROOT: ${{ runner.temp }}/codeql-sarif
        SOURCE_SARIF: ${{ runner.temp }}/codeql-sarif/${{ matrix.artifact-file }}
        EXACT_SARIF: ${{ runner.temp }}/codeql-sarif/codeql-${{ matrix.language }}-attempt-${{ github.run_attempt }}.sarif
      with:
        script: |
          const fs = require('fs');
          const path = require('path');
          const root = path.resolve(process.env.SARIF_ROOT || '');
          const source = path.resolve(process.env.SOURCE_SARIF || '');
          const target = path.resolve(process.env.EXACT_SARIF || '');
          if (!root || path.dirname(source) !== root || path.dirname(target) !== root || source === target) {
            throw new Error('CodeQL SARIF paths are not exact trusted-runner files.');
          }
          const stat = fs.lstatSync(source);
          if (!stat.isFile() || stat.isSymbolicLink() || fs.existsSync(target)) {
            throw new Error('CodeQL SARIF source is not one new regular file.');
          }
          fs.renameSync(source, target);

    - name: Upload raw CodeQL SARIF
      if: always()
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        # Direct single-file artifacts avoid compressed-archive expansion in
        # the privileged reporter. With archive:false the file name is the
        # immutable artifact name and the name input is intentionally omitted.
        path: ${{ runner.temp }}/codeql-sarif/codeql-${{ matrix.language }}-attempt-${{ github.run_attempt }}.sarif
        archive: false
        retention-days: 7
        if-no-files-found: error