codeql.yml

name: CodeQL

# Advanced Setup, replacing GitHub's CodeQL "default setup" (see the removed
# comment in security.yml). Default setup gave two problems with no way to
# fix them because it isn't a file in this repo: every push to a PR queued a
# second full scan on top of the first because there was no concurrency
# group to cancel it, and the same commit got scanned twice — once as the PR
# head, once again as the resulting push to main.
#
# IMPORTANT — this workflow only takes effect once CodeQL "default setup" is
# turned off: Settings -> Code security and analysis -> CodeQL analysis ->
# Set up -> Advanced (or Disable, since this file now covers it). GitHub
# refuses to accept SARIF uploads from an advanced-configuration workflow
# while default setup is still enabled, so this workflow's runs will show a
# red X here until that switch is flipped by hand — no gh/API call available
# from this session — before or immediately after merging.
on:
  push:
    branches: [main]
    paths-ignore: &codeql-irrelevant
      - '**/*.md'
      - 'docs/**'
      - 'testing/**'
  pull_request:
    paths-ignore: *codeql-irrelevant
  schedule:
    # Weekly rather than default setup's own cadence — advisories that land
    # against unchanged dependencies are already covered on the same cadence
    # as security.yml's cargo-audit/npm-audit schedule's sibling monthly
    # scan; weekly here just keeps CodeQL's own query packs fresh sooner.
    - cron: '0 4 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # Cheap up-front check so a change touching only, say, GitHub Actions YAML
  # doesn't also pay for a Rust analyze build, and vice versa. Always true on
  # schedule/workflow_dispatch/push-to-main so those keep full coverage.
  changes:
    name: Detect changed languages
    runs-on: ubuntu-22.04
    timeout-minutes: 5
    outputs:
      rust: ${{ steps.filter.outputs.rust }}
      js: ${{ steps.filter.outputs.js }}
      actions: ${{ steps.filter.outputs.actions }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      # Plain `git diff` against the merge-base (PR) or the pre-push commit
      # (push to main) instead of a third-party paths-filter action — no
      # extra dependency to keep pinned/updated for what's a two-line check.
      - name: Detect changed languages
        id: filter
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            base=$(git merge-base "origin/${{ github.event.pull_request.base.ref }}" HEAD)
          else
            base="${{ github.event.before }}"
          fi
          changed=$(git diff --name-only "$base" "${{ github.sha }}")
          echo "$changed"

          echo "rust=$(echo "$changed" | grep -qE '^(src-tauri/|Cargo\.lock$)' && echo true || echo false)" >> "$GITHUB_OUTPUT"
          echo "js=$(echo "$changed" | grep -qE '^(src/|package(-lock)?\.json$|tsconfig.*\.json$|vite\.config\.ts$)' && echo true || echo false)" >> "$GITHUB_OUTPUT"
          echo "actions=$(echo "$changed" | grep -qE '^\.github/' && echo true || echo false)" >> "$GITHUB_OUTPUT"

  # Three explicit jobs instead of one matrix: a matrix's `language`/`build-mode`
  # values only exist inside the job (strategy/steps/outputs) — `jobs.<id>.if`
  # cannot reference `matrix.*` ("Unrecognized named-value: 'matrix'"), so
  # per-language gating on `needs.changes.outputs.*` has to live on separate
  # jobs' own `if:` instead.
  analyze-actions:
    name: Analyze (actions)
    needs: changes
    if: github.event_name != 'pull_request' || needs.changes.outputs.actions == 'true'
    runs-on: ubuntu-22.04
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Initialize CodeQL
        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          languages: actions
          build-mode: none

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          category: '/language:actions'

  analyze-js:
    name: Analyze (javascript-typescript)
    needs: changes
    if: github.event_name != 'pull_request' || needs.changes.outputs.js == 'true'
    runs-on: ubuntu-22.04
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Initialize CodeQL
        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          languages: javascript-typescript
          build-mode: none

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          category: '/language:javascript-typescript'

  analyze-rust:
    name: Analyze (rust)
    needs: changes
    if: github.event_name != 'pull_request' || needs.changes.outputs.rust == 'true'
    runs-on: ubuntu-22.04
    timeout-minutes: 25
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # CodeQL's Rust extractor only supports build-mode: none (confirmed by
      # a failed run: "Rust does not support the manual build mode. Please
      # try ... none") — but that's NOT source-only parsing: per GitHub's
      # docs, rust-analyzer still compiles and runs build.rs scripts and
      # compiles proc-macro code (it only skips the full crate build), into
      # a fresh, uncached cargo_target_dir every run. So this job doesn't
      # need coverage.yml's rust job's full cached-build sequence
      # (setup-tauri-env, npm run build, externalBin placeholders, cargo
      # build) — those exist only for an actual `cargo`/tauri-build
      # invocation — but it's still heavier than the actions/js-ts jobs,
      # which is why its timeout stays above theirs.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          languages: rust
          build-mode: none

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          category: '/language:rust'