codeql.yml

---
name: codeql

# Push runs only when Rust, workflow, or script inputs change.
# Self-hosted runners reject pull_request. copy-pr-bot mirrors trusted PRs to
# pull-request/<n>, and this workflow triggers on that push
# (config: .github/copy-pr-bot.yaml).
# A Markdown-only commit skips both analyzers. The weekly schedule has no path
# filter, so that scan still covers the whole tree.
on:
  push:
    # No workflow-level paths: filter; the changes job below gates the jobs.
    branches:
      - main
      - "pull-request/[0-9]+"
  schedule:
    - cron: "44 3 * * 6"

# Each commit on main gets its own group, so it starts at once. Any other ref
# still shares one group and cancels the older run.
# A container job's default shell is dash; use bash, as on ubuntu-latest.
defaults:
  run:
    shell: bash

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}${{ github.ref_name == 'main' && format('-{0}', github.sha) || '' }}
  cancel-in-progress: ${{ github.ref_name != 'main' }}

jobs:
  # Path gate. copy-pr-bot creates pull-request/<n> at an existing SHA, and
  # GitHub often treats that push as having no path changes, so a workflow-level
  # `paths:` filter would skip the whole run. This job diffs against main
  # instead, as cutile-rs.yml does, and every job below runs when no file diff
  # is detected. Other events (schedule, workflow_dispatch) skip the gate.
  changes:
    if: github.event_name == 'push'
    runs-on: linux-amd64-cpu4
    timeout-minutes: 5
    permissions:
      contents: read
    outputs:
      relevant: ${{ steps.changes.outputs.relevant }}
      any_changed: ${{ steps.changes.outputs.any_changed }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad  # v3.0.4
        id: changes
        with:
          filters: |
            relevant:
              - '**/*.rs'
              - '**/Cargo.toml'
              - '**/Cargo.lock'
              - '.github/**'
              - '**/*.sh'
              - '**/*.py'
            # `*` covers a root file, `**` every nested path. Both false means
            # no file diff was detected.
            any_changed:
              - '*'
              - '**'

  analyze:
    needs: changes
    if: ${{ !cancelled() && (github.event_name != 'push' || needs.changes.outputs.relevant == 'true' || needs.changes.outputs.any_changed != 'true') }}
    name: Analyze (${{ matrix.language }})
    # nv-cpu-general: m7i.xlarge, 4 vCPU / 16 GiB. Same size as ubuntu-latest.
    # The VM image has no rustup. rust:1.98.0-bookworm matches the root
    # toolchain pin and is buildpack-deps, so git is there for checkout and
    # rustup is on PATH. The Oxide nightly still comes from
    # cuda-oxide/rust-toolchain.toml when the extractor enters that tree.
    runs-on: linux-amd64-cpu4
    container:
      image: rust:1.98.0-bookworm
    timeout-minutes: 120
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: actions
            build-mode: none
          - language: rust
            build-mode: none
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # The workspace is mounted from the runner, so git refuses it until this
      # directory is marked safe. CodeQL's result upload calls git.
      - name: Mark the workspace as a safe git directory
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      # A missing rustup makes the Rust extractor exit 0 with an empty database.
      - name: Confirm Rust
        if: matrix.language == 'rust'
        run: rustup show active-toolchain

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}

      # On a copy-pr-bot mirror push the results would upload under
      # refs/heads/pull-request/<n> and never reach the pull request's code
      # scanning alerts. Point the upload at the pull request instead. The
      # mirror branch carries the pull request's head commit. Empty outputs
      # (main, schedule) leave the action on its default ref.
      - name: Resolve the code scanning upload ref
        id: upload
        run: |
          case "${GITHUB_REF_NAME}" in
            pull-request/[0-9]*)
              echo "ref=refs/pull/${GITHUB_REF_NAME#pull-request/}/head" >> "${GITHUB_OUTPUT}"
              echo "sha=${GITHUB_SHA}" >> "${GITHUB_OUTPUT}"
              ;;
          esac

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"
          ref: ${{ steps.upload.outputs.ref }}
          sha: ${{ steps.upload.outputs.sha }}