codeql.yml

# SPDX-License-Identifier: Apache-2.0
name: codeql
on:
  push:
    branches: [main]
    # Only run when compiled source or this workflow changes. Docs, charts,
    # migrations, and other non-code PRs skip the scan (the Go autobuild is
    # expensive). The weekly schedule still does a full unconditional scan.
    paths:
      - "**/*.go"
      - "**/*.rs"
      - "**/*.java"
      - "**/go.mod"
      - "**/go.sum"
      - "**/Cargo.toml"
      - "**/Cargo.lock"
      - ".github/workflows/codeql.yml"
  pull_request:
    branches: [main]
    paths:
      - "**/*.go"
      - "**/*.rs"
      - "**/*.java"
      - "**/go.mod"
      - "**/go.sum"
      - "**/Cargo.toml"
      - "**/Cargo.lock"
      - ".github/workflows/codeql.yml"
  schedule:
    # Weekly full scan, Monday 03:27 UTC.
    - cron: "27 3 * * 1"

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  security-events: write
  pull-requests: write

jobs:
  # Decide which languages to analyze. PR policy: only buildless languages scan
  # pre-merge (today Rust; Java joins as build-mode none when it lands). Go is
  # excluded on PRs: its traced autobuild compiles the whole umbrella (~20+ min)
  # for advisory-only feedback (fail-on-findings is false). Go coverage comes
  # from every push to main and the weekly schedule, which scan everything.
  # Emits a dynamic matrix so no job-level `if` referencing `matrix` is needed
  # (that context is not allowed in a job `if`). Uses the GitHub API, not a
  # third-party action (org allowlist).
  detect:
    name: Detect changed languages
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      matrix: ${{ steps.f.outputs.matrix }}
      any: ${{ steps.f.outputs.any }}
    steps:
      - name: Detect changed languages
        id: f
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail
          go=false; rust=false; java=false
          files=""
          if [ "${{ github.event_name }}" != "pull_request" ]; then
            # Pushes to main and the weekly schedule scan everything, Go included.
            go=true; rust=true; java=true
          else
            # Never silently skip: if the changed-file lookup fails, scan both
            # languages instead of treating an empty result as "no code changed".
            if ! files="$(gh api --paginate "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" --jq '.[].filename')"; then
              echo "::warning::changed-file lookup failed; scanning all languages"
              go=true; rust=true; java=true; files=""
            fi
            # gh api filenames are repo-relative with no leading slash, so anchor
            # manifests with (^|/) to match root and nested files alike.
            if printf '%s\n' "$files" | grep -qE '\.rs$|(^|/)Cargo\.(toml|lock)$'; then rust=true; fi
            if printf '%s\n' "$files" | grep -qE '\.java$'; then java=true; fi
            # A change to the scan config itself re-scans the PR-time languages.
            if printf '%s\n' "$files" | grep -qE '(^|/)\.github/workflows/codeql\.yml$'; then rust=true; java=true; fi
          fi
          inc=""
          if [ "$go" = true ];   then inc="${inc}{\"language\":\"go\",\"build-mode\":\"autobuild\"},"; fi
          if [ "$rust" = true ]; then inc="${inc}{\"language\":\"rust\",\"build-mode\":\"none\"},"; fi
          if [ "$java" = true ]; then inc="${inc}{\"language\":\"java-kotlin\",\"build-mode\":\"none\"},"; fi
          inc="${inc%,}"
          echo "matrix={\"include\":[${inc}]}" >> "$GITHUB_OUTPUT"
          if [ -n "$inc" ]; then echo "any=true" >> "$GITHUB_OUTPUT"; else echo "any=false" >> "$GITHUB_OUTPUT"; fi
          echo "selected languages: go=$go rust=$rust java=$java"

  analyze:
    name: CodeQL (${{ matrix.language }})
    needs: detect
    if: needs.detect.outputs.any == 'true'
    runs-on: ubuntu-latest
    strategy:
      # Keep one language's failure from cancelling the others.
      fail-fast: false
      # Only the languages detect selected. Go must autobuild (CodeQL 2.26
      # confirmed Go does not support build-mode none); Rust uses buildless.
      matrix: ${{ fromJSON(needs.detect.outputs.matrix) }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          # CodeQL does not need the repo token after checkout.
          persist-credentials: false

      - name: CodeQL Analysis
        uses: NVIDIA/dsx-github-actions/.github/actions/codeql-scan@9a9ce3a7770a8b53d2726afa920be3276bc3ddd7
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          upload-sarif: true
          # Same-repository PRs can comment here. Fork PRs have a read-only token
          # and are handled by the companion codeql-comment.yml workflow.
          post-pr-comment: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
          # Non-blocking during rollout: findings surface in the Security tab and
          # as a PR comment, but do not gate merges yet. Tighten once triaged.
          fail-on-findings: false

      - name: Upload CodeQL results for fork PR comment
        if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          # The companion workflow parses this artifact as untrusted data only.
          name: codeql-pr-results-${{ matrix.language }}
          path: results/${{ matrix.language }}.sarif
          if-no-files-found: error
          retention-days: 1

      - name: Prepare fork PR metadata
        if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && matrix.language == 'go' }}
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          mkdir -p "${RUNNER_TEMP}/codeql-pr-metadata"
          printf '%s\n' "$PR_NUMBER" > "${RUNNER_TEMP}/codeql-pr-metadata/pr-number"

      - name: Upload fork PR metadata
        if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && matrix.language == 'go' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: codeql-pr-metadata
          path: ${{ runner.temp }}/codeql-pr-metadata/pr-number
          if-no-files-found: error
          retention-days: 1