codeql-analysis.yml

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

permissions:
  contents: read
  security-events: write

on:
  push:
    branches: [ main ]
    paths:
      - '.github/workflows/*.yml'
      - 'scripts/*.py'
      - 'archive/c/c/*.c'
      - 'archive/c/c/testinfo.yml'
      - 'archive/c/c-plus-plus/*.cpp'
      - 'archive/c/c-plus-plus/testinfo.yml'
      - 'archive/c/c-sharp/*.cs'
      - 'archive/c/c-sharp/testinfo.yml'
      - 'archive/g/go/*.go'
      - 'archive/g/go/testinfo.yml'
      - 'archive/j/java/*.java'
      - 'archive/j/java/testinfo.yml'
      - 'archive/j/javascript/*.js'
      - 'archive/j/javascript/testinfo.yml'
      - 'archive/k/kotlin/*.kt'
      - 'archive/k/kotlin/testinfo.yml'
      - 'archive/p/python/*.py'
      - 'archive/p/python/testinfo.yml'
      - 'archive/r/ruby/*.rb'
      - 'archive/r/ruby/testinfo.yml'
      - 'archive/r/rust/*.rs'
      - 'archive/r/rust/testinfo.yml'
      - 'archive/t/typescript/*.ts'
      - 'archive/t/typescript/testinfo.yml'
  pull_request:
    branches: 
      - 'main'
    paths:
      - '.github/workflows/*.yml'
      - 'scripts/*.py'
      - 'archive/c/c/*.c'
      - 'archive/c/c/testinfo.yml'
      - 'archive/c/c-plus-plus/*.cpp'
      - 'archive/c/c-plus-plus/testinfo.yml'
      - 'archive/c/c-sharp/*.cs'
      - 'archive/c/c-sharp/testinfo.yml'
      - 'archive/g/go/*.go'
      - 'archive/g/go/testinfo.yml'
      - 'archive/j/java/*.java'
      - 'archive/j/java/testinfo.yml'
      - 'archive/j/javascript/*.js'
      - 'archive/j/javascript/testinfo.yml'
      - 'archive/k/kotlin/*.kt'
      - 'archive/k/kotlin/testinfo.yml'
      - 'archive/p/python/*.py'
      - 'archive/p/python/testinfo.yml'
      - 'archive/r/ruby/*.rb'
      - 'archive/r/ruby/testinfo.yml'
      - 'archive/r/rust/*.rs'
      - 'archive/r/rust/testinfo.yml'
      - 'archive/t/typescript/*.ts'
      - 'archive/t/typescript/testinfo.yml'
  schedule:
    # Run every Thursday at 4:53 UTC (randomly chosen)
    - cron: '53 4 * * 6'
  
jobs:
  # We need this job to check if changed files should trigger analysis
  changed-files:
    name: "Changed Files"
    runs-on: ubuntu-latest

    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
      changed-files: ${{ steps.changed-files.outputs.files }}
    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 2

    - name: Get changed code files
      id: changed-files
      uses: yumemi-inc/changed-files@v3

    - name: List all relevant changed files
      if: steps.changed-files.outputs.exists == 'true'
      env:
        ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.files }}
      run: |
        for file in ${ALL_CHANGED_FILES}; do
          echo "$file was changed"
        done

    # Reference: https://stackoverflow.com/questions/65384420/how-do-i-make-a-github-action-matrix-element-conditional
    - name: Get CodeQL Languages
      id: set-matrix
      run: |
        matrix=$(python scripts/get_codeql_languages.py --event ${{ github.event_name}} ${{ steps.changed-files.outputs.files }})
        echo "${matrix}"
        echo "matrix={\"include\": ${matrix}}" >> $GITHUB_OUTPUT

  analyze:
    name: Analyze
    needs: changed-files
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.changed-files.outputs.matrix) }}
        # Learn more:
        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed

    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout repository
      uses: actions/checkout@v6
      with:
        fetch-depth: 2

    - name: Read repo config
      uses: pietrobolcato/action-read-yaml@1.1.0
      id: repo-config
      with:
        config: repo-config.yml

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: "${{ steps.repo-config.outputs['python-version'] }}"

    - name: Run Poetry Image
      uses: abatilo/actions-poetry@v3
      with:
        poetry-version: "${{ steps.repo-config.outputs['poetry-version'] }}"

    - name: Install Dependencies
      run: poetry install

    # Workaround for Kotlin scanning.
    - name: Set up Kotlin
      if: ${{ matrix.language == 'kotlin' }}
      run: sudo snap install kotlin --classic --channel=2.2/stable

    # Set up Rust for scanning.
    - name: Set up Rust
      if: ${{ matrix.language == 'rust' }}
      run: |
        curl https://sh.rustup.rs -sSf | sh -s -- -y
        python3 scripts/generate_cargo_toml.py

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
      if: ${{ matrix.build-mode != 'manual' }}
      uses: github/codeql-action/autobuild@v4

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl

    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
    #    and modify them (or add more) to build your code if your project
    #    uses a compiled language

    - name: Manual build
      if: ${{ matrix.build-mode == 'manual' }}
      run: poetry run python scripts/build_codeql_language.py ${{ matrix.language }} ${{ matrix.paths }}

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4