codeql.yml

name: codeql

on:
  pull_request:
    branches:
      - main
    paths:
      - '.github/workflows/**'
      - '**/*.java'
      - '**/*.kt'
      - '**/*.kts'
      - '**/*.py'
      - '**/*.swift'
      - 'gradle/**'
      - 'gradle.properties'
      - '**/project.yml'
      - '**/*.xcodeproj/**'
  push:
    branches:
      - main
    paths:
      - '.github/workflows/**'
      - '**/*.java'
      - '**/*.kt'
      - '**/*.kts'
      - '**/*.py'
      - '**/*.swift'
      - 'gradle/**'
      - 'gradle.properties'
      - '**/project.yml'
      - '**/*.xcodeproj/**'
  schedule:
    - cron: '23 3 * * 1'
  workflow_dispatch:
    inputs:
      include_swift:
        description: 'Also run the slower Swift scan'
        type: boolean
        default: false

permissions:
  actions: read
  contents: read
  packages: read
  pull-requests: read
  security-events: write

concurrency:
  group: codeql-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  detect-swift-changes:
    name: Detect Swift-side changes
    runs-on: ubuntu-latest
    outputs:
      swift_related: ${{ steps.filter.outputs.swift_related }}

    steps:
      - name: Checkout repository
        if: github.event_name == 'push'
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 0

      - name: Detect Swift-side changes
        id: filter
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" != 'push' ]]; then
            echo 'swift_related=false' >> "$GITHUB_OUTPUT"
            exit 0
          fi

          base="${{ github.event.before }}"
          if [[ -z "$base" || "$base" == '0000000000000000000000000000000000000000' ]]; then
            if git rev-parse HEAD^ >/dev/null 2>&1; then
              base="$(git rev-parse HEAD^)"
            else
              echo 'swift_related=true' >> "$GITHUB_OUTPUT"
              exit 0
            fi
          fi

          if ! git cat-file -e "$base^{commit}" 2>/dev/null; then
            echo 'swift_related=true' >> "$GITHUB_OUTPUT"
            exit 0
          fi

          changed_files="$(git diff --name-only "$base" "$GITHUB_SHA")"
          printf 'Changed files between %s and %s:\n%s\n' "$base" "$GITHUB_SHA" "$changed_files"

          if printf '%s\n' "$changed_files" | grep -Eq '(^|/).*\.swift$|(^|/)project\.yml$|\.xcodeproj/'; then
            echo 'swift_related=true' >> "$GITHUB_OUTPUT"
          else
            echo 'swift_related=false' >> "$GITHUB_OUTPUT"
          fi

  analyze-fast:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: ${{ matrix.timeout_minutes }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: actions
            timeout_minutes: 10
            build_mode: none
          - language: python
            timeout_minutes: 10
            build_mode: none
          - language: java-kotlin
            timeout_minutes: 20
            build_mode: manual

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6.0.2

      - name: Set up Java
        if: matrix.language == 'java-kotlin'
        uses: actions/setup-java@v5.2.0
        with:
          distribution: temurin
          java-version: '21'
          cache: gradle

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build_mode }}

      - name: Build Java/Kotlin database
        if: matrix.language == 'java-kotlin'
        shell: bash
        run: |
          # CodeQL must observe real compiler invocations, so do not let Gradle satisfy
          # this repository-owned aggregation task from the build cache or up-to-date checks.
          ./gradlew \
            codeqlJavaKotlinBuild \
            --rerun-tasks \
            --no-build-cache \
            --no-daemon \
            --console=plain

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"

  analyze-swift:
    name: Analyze (swift)
    needs: detect-swift-changes
    if: >-
      ${{ github.event_name == 'schedule' ||
          (github.event_name == 'workflow_dispatch' && inputs.include_swift) ||
          (github.event_name == 'push' && needs.detect-swift-changes.outputs.swift_related == 'true') }}
    runs-on: macos-latest
    timeout-minutes: 35

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6.0.2

      - name: Set up Java
        uses: actions/setup-java@v5.2.0
        with:
          distribution: temurin
          java-version: '21'
          cache: gradle

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: swift
          build-mode: manual

      - name: Build Swift database
        shell: bash
        run: |
          # Let Xcode invoke the Kotlin embed/sign script phase with the real build
          # environment. Calling embedAndSignAppleFrameworkForXcode directly from the
          # workflow shell misses required Xcode variables on GitHub-hosted runners.
          xcodebuild build \
            -project meshlink-proof/ios/ProofApp.xcodeproj \
            -target ProofApp \
            CODE_SIGNING_ALLOWED=NO \
            CODE_SIGNING_REQUIRED=NO \
            COMPILER_INDEX_STORE_ENABLE=NO

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:swift"