codeql.yml

name: CodeQL Security Analysis

on:
  push:
    branches: [master, main]
  pull_request:
    branches: [master, main]
  schedule:
    - cron: '0 6 * * 1'

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze (Swift)
    runs-on: macos-26
    timeout-minutes: 45
    env:
      DEVELOPER_DIR: /Applications/Xcode_26.3.app/Contents/Developer
    permissions:
      security-events: write
      contents: read
      actions: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Select pinned Xcode
        run: |
          if [[ ! -d "$DEVELOPER_DIR" ]]; then
            echo "Expected Xcode not found: $DEVELOPER_DIR"
            ls -d /Applications/Xcode*.app || true
            exit 1
          fi
          xcodebuild -version

      - name: Initialize CodeQL
        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
        with:
          languages: swift
          build-mode: manual
          tools: https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.27.2/codeql-bundle-swift-osx64.tar.zst
          queries: security-and-quality

      - name: Build
        run: |
          set -o pipefail
          xcodebuild build \
            -project GdeiAssistant-iOS.xcodeproj \
            -scheme GdeiAssistant-iOS \
            -destination 'generic/platform=iOS Simulator' \
            CODE_SIGNING_ALLOWED=NO \
            2>&1 | tee codeql-build.log

      - name: Install verified Gitleaks before artifact upload
        if: ${{ !cancelled() }}
        run: bash .github/scripts/install-gitleaks.sh

      - name: Scan exact upload paths for credentials
        id: artifact_secret_scan_1
        if: ${{ always() }}
        env:
          ARTIFACT_PATHS: |
            codeql-build.log
        run: >-
          python3 .github/scripts/secret_scan.py artifacts
          --gitleaks "$RUNNER_TEMP/gitleaks-bin/gitleaks"

      - name: Upload CodeQL build log
        if: ${{ always() && steps.artifact_secret_scan_1.outcome == 'success' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: ios-codeql-build-log
          path: codeql-build.log
          if-no-files-found: ignore
          retention-days: 7

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
        with:
          category: "/language:swift"