codeql.yml

# CodeQL static analysis: JavaScript, TypeScript, the workflow logic, and the
# model-driven implementation's Java under emf/.
#
# Every language is analysed without a build (`build-mode: none`), so Tycho and
# p2 resolution can never break the scan. Generated sources and build output
# are ignored through .github/codeql/codeql-config.yml.
#
# A gate, not a report. ci.yml calls this workflow on every pull request and on
# every push to main, as the `codeql` job `Pipeline Complete` needs, and the last
# step fails on any finding of any severity, so a finding blocks the merge. It
# still uploads to the Security tab, and still runs weekly on its own, so a new
# query that flags old code is seen without waiting for a change. A finding that
# is wrong is filtered in .github/codeql/codeql-config.yml, with the reason.
'name': 'CodeQL'

'on':
  'workflow_call':
  'schedule':
    - 'cron': '22 3 * * 1'

'permissions':
  'contents': 'read'

'jobs':
  'analyze':
    'name': 'Analyze'
    'runs-on': 'ubuntu-latest'
    'timeout-minutes': 360
    'permissions':
      'actions': 'read'
      'contents': 'read'
      'security-events': 'write'

    'strategy':
      'fail-fast': false
      'matrix':
        'include':
          - 'language': 'javascript-typescript'
          - 'language': 'actions'
          - 'language': 'java-kotlin'

    'steps':
      - 'uses': 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1

      - 'name': 'Initialize CodeQL'
        'uses': 'github/codeql-action/init@faaca9a8f6edddba5725ffe5adefdab6669a2eca' # v3.38.0
        'with':
          'languages': '${{ matrix.language }}'
          'build-mode': 'none'
          'queries': 'security-and-quality'
          'config-file': './.github/codeql/codeql-config.yml'

      - 'name': 'Perform CodeQL Analysis'
        'uses': 'github/codeql-action/analyze@faaca9a8f6edddba5725ffe5adefdab6669a2eca' # v3.38.0
        'with':
          'category': '/language:${{matrix.language}}'
          'output': 'sarif'

      # The upload above records findings; this is what makes one fail the
      # pipeline. Every result counts, notes included, unless CodeQL itself
      # marked it suppressed.
      - 'name': 'Fail on any finding'
        'shell': 'bash'
        'run': |
          set -euo pipefail
          findings=$(jq -r '
            .runs[].results[]
            | select((.suppressions // []) | length == 0)
            | .locations[0].physicalLocation as $at
            | "\(.ruleId) \($at.artifactLocation.uri):\($at.region.startLine) \(.message.text)"
          ' sarif/*.sarif)
          if [ -n "${findings}" ]; then
            printf '%s\n' "${findings}"
            echo "::error::CodeQL reported findings. Fix them, or filter a wrong one in .github/codeql/codeql-config.yml with its reason."
            exit 1
          fi
          echo "No CodeQL findings."