codeql.yml

# SPDX-License-Identifier: MPL-2.0
# CodeQL Analysis
# Security scanning - note: Julia and Ada are not supported by CodeQL
# This workflow focuses on configuration security scanning only

name: CodeQL
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly on Sundays
    - cron: "0 0 * * 0"
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
# updates do not pile up queued runs against the shared account-wide
# Actions concurrency pool. Applied only to read-only check workflows
# (no publish/mutation), so cancelling a superseded run is always safe.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions: read-all
jobs:
  # ==========================================================================
  # Note on Language Support
  # ==========================================================================
  # CodeQL does NOT support:
  # - Julia (our game engine)
  # - Ada (our TUI)
  #
  # For these languages, we rely on:
  # - Trivy for vulnerability scanning
  # - TruffleHog for secrets detection
  # - Language-specific linters in CI
  # ==========================================================================
  security-scan:
    name: Security Configuration Scan
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      # Since we don't have CodeQL-supported languages (no JS, Python, Go, etc.)
      # we skip CodeQL analysis and rely on other security tools configured in CI
      - name: Security scan summary
        run: |
          echo "## Security Scanning Status" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Languages in Repository" >> $GITHUB_STEP_SUMMARY
          echo "- **Julia**: Engine code (not CodeQL supported)" >> $GITHUB_STEP_SUMMARY
          echo "- **Ada**: TUI code (not CodeQL supported)" >> $GITHUB_STEP_SUMMARY
          echo "- **YAML/TOML**: Configuration files" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Security Tools Used" >> $GITHUB_STEP_SUMMARY
          echo "- Trivy: Vulnerability scanning" >> $GITHUB_STEP_SUMMARY
          echo "- TruffleHog: Secrets detection" >> $GITHUB_STEP_SUMMARY
          echo "- ShellCheck: Script security" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### SHA Pinning" >> $GITHUB_STEP_SUMMARY
          echo "All GitHub Actions are pinned to full-length commit SHAs" >> $GITHUB_STEP_SUMMARY
          echo "to prevent supply chain attacks." >> $GITHUB_STEP_SUMMARY