codeql.yml

# agent-pmo:0b21609
name: CodeQL

# CodeQL static security analysis ([GITHUB-CODE-SCANNING]).
#
# SEPARATE from ci.yml on purpose: CodeQL feeds GitHub code-scanning alerts and
# needs `security-events: write` + a weekly schedule, while ci.yml owns
# lint/test/build. It does NOT overlap with `make lint` (style/correctness) or
# the ci.yml `security` job's dependency-review (vulnerable packages) — CodeQL
# finds vulnerable CODE. Never add security-rule linter plugins that re-cover
# CodeQL: no doubling up.
#
# Matrix = (languages actually in this repo) ∩ (languages CodeQL supports right
# now). For Basilisk that is `rust` (the type-checker/LSP) and
# `javascript-typescript` (the VS Code extension + website), plus `actions`
# (scans the workflow files themselves). Python IS supported by CodeQL, but the
# only Python in this repo is type-checker test fixtures under conformance/,
# examples/, and tests/ — deliberately malformed sample code, NOT first-party
# code that ships or executes. Scanning it would drown the real signal in
# fixture noise, so it is intentionally excluded. Action SHAs are kept current
# by the github-actions Dependabot group ([GITHUB-DEPENDABOT]).
on:
  pull_request:
    branches: [main]
  push:
    # Run before EVERY release: scan the exact released SHA with the current
    # query set. A release can ship code last scanned weeks ago — the PR scan
    # covered the diff, the weekly scan covers drift, this covers the release.
    tags: ["v*"]
  schedule:
    # Weekly, so newly-published CodeQL queries re-scan even without a push.
    - cron: "27 4 * * 1"

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 20
    # Code scanning (SARIF upload) requires GitHub Advanced Security on PRIVATE
    # repos. Gating on public visibility lets a private repo skip cleanly (no red
    # X) and self-enable the moment it is made public — no follow-up edit needed.
    # Dependabot PRs are excluded: they are swept into `dependabot-upgrades` by
    # dependabot-automerge.yml and never merge to main directly, so scanning them
    # only burns the matrix on a bump we discard — CodeQL runs on the
    # consolidation PR instead. ([GITHUB-DEPENDABOT])
    if: github.event.repository.visibility == 'public' && github.actor != 'dependabot[bot]'
    permissions:
      security-events: write
      actions: read
      contents: read
    strategy:
      fail-fast: false
      matrix:
        # build-mode: none — Rust and the interpreted langs do not need CodeQL to
        # drive a compile; ci.yml already builds the Rust workspace.
        include:
          - language: actions # scans the workflow files themselves
            build-mode: none
          - language: rust
            build-mode: none
          - language: javascript-typescript
            build-mode: none
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Initialize CodeQL
        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          queries: security-extended
          # query-filters live here, not in the `queries:` input. Currently
          # suppresses the verified false-positive actions/untrusted-checkout/medium
          # on the Dependabot merge bot — see the file for the full rationale. The
          # dangerous /high (pull_request_target) variant stays active.
          config-file: ./.github/codeql/codeql-config.yml
      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
        with:
          category: "/language:${{ matrix.language }}"