codeql.yml

# CodeQL Advanced — analyzer of record for this repository.
#
# Scope: Java and JavaScript/TypeScript only (no Actions, C#, Python, etc.).
#
# Path-filtered language jobs (repository-wide on PR + push):
#   - Analyze (java-kotlin) runs only when Java-relevant paths change
#   - Analyze (javascript-typescript) runs only when JS/TS-relevant paths change
#   - Docs-only / markdown-only changes skip both analyzers
# Full dual-language scan still runs on schedule and workflow_dispatch so the
# default-branch security picture does not rot.
#
# IMPORTANT — only one CodeQL orchestrator may own code-scanning uploads:
#   - This workflow (.github/workflows/codeql.yml) is the analyzer of record.
#   - Code scanning *default setup* must stay state=not-configured.
#   - GitHub *Code Quality* (dynamic workflow "Code Quality: CodeQL Setup" at
#     dynamic/github-code-scanning/codeql) must be DISABLED for this repo.
#     Settings → Code quality → Disable. That dynamic runner ignores this
#     config file, scans extra languages, and empty/stub analyses on the
#     default branch close open alerts as "fixed".
#
# Verify default setup:
#   gh api repos/intersoftdatalabs-in/percussioncms/code-scanning/default-setup --jq .state
#   # expected: not-configured
#
# Config applied only by this workflow:
#   - .github/codeql/codeql-config.yml (paths-ignore, query-filters, model packs)
#   - .github/codeql/models (custom sanitizer barriers for Java)
#
# See docs/ai-generated/tasks/gh-codeql-alerts/codeql-pr-playbook.md
#
name: "CodeQL Advanced"

on:
  push:
    branches: ["development"]
  pull_request:
    branches: ["development"]
  schedule:
    - cron: "44 2 * * 4"
  # Manual re-scan after config changes or after disabling Code Quality / default setup
  workflow_dispatch:

# Least privilege at workflow level; jobs elevate only what CodeQL needs.
# Repo may have default_workflow_permissions=read — security-events must be
# requested explicitly or SARIF upload silently fails to open alerts.
permissions:
  contents: read

jobs:
  # ---------------------------------------------------------------------------
  # Detect which language analyzers must run for this event.
  # ---------------------------------------------------------------------------
  changes:
    name: Detect language changes
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      java: ${{ steps.resolve.outputs.java }}
      js: ${{ steps.resolve.outputs.js }}
    steps:
      - name: Checkout repository
        # Only needed for push path-filter base; PRs use the API. Always cheap.
        if: github.event_name == 'push' || github.event_name == 'pull_request'
        uses: actions/checkout@v4

      - name: Path filter (PR / push)
        id: filter
        if: github.event_name == 'push' || github.event_name == 'pull_request'
        uses: dorny/paths-filter@v3
        with:
          # Default quantifier is "some": any matching path enables that language.
          filters: |
            java:
              - '**/*.java'
              - '**/*.kt'
              - '**/*.kts'
              - '**/pom.xml'
              - '**/.mvn/**'
              - 'mvnw'
              - 'mvnw.cmd'
              - '.github/codeql/**'
              - '.github/workflows/codeql.yml'
            js:
              - '**/*.js'
              - '**/*.jsx'
              - '**/*.ts'
              - '**/*.tsx'
              - '**/*.mjs'
              - '**/*.cjs'
              - '**/package.json'
              - '**/package-lock.json'
              - '**/npm-shrinkwrap.json'
              - '**/yarn.lock'
              - '**/pnpm-lock.yaml'
              - '**/tsconfig.json'
              - '**/tsconfig.*.json'
              - '**/vite.config.*'
              - '**/vitest.config.*'
              - '**/esbuild.config.*'
              - '**/webpack.config.*'
              - '.github/codeql/**'
              - '.github/workflows/codeql.yml'

      - name: Resolve which analyzers run
        id: resolve
        run: |
          set -euo pipefail
          event="${{ github.event_name }}"
          # Weekly schedule + manual dispatch: always full dual-language scan.
          if [ "$event" = "schedule" ] || [ "$event" = "workflow_dispatch" ]; then
            echo "java=true" >> "$GITHUB_OUTPUT"
            echo "js=true" >> "$GITHUB_OUTPUT"
            echo "Event=$event → full CodeQL (java + js)"
            exit 0
          fi
          java="${{ steps.filter.outputs.java }}"
          js="${{ steps.filter.outputs.js }}"
          # Empty/missing filter output → fail open (run the analyzer).
          [ -n "$java" ] || java=true
          [ -n "$js" ] || js=true
          echo "java=$java" >> "$GITHUB_OUTPUT"
          echo "js=$js" >> "$GITHUB_OUTPUT"
          echo "Event=$event → java=$java js=$js"

  # ---------------------------------------------------------------------------
  # Language jobs (same check names as before for branch-protection continuity).
  # ---------------------------------------------------------------------------
  analyze-java:
    name: Analyze (java-kotlin)
    needs: changes
    if: needs.changes.outputs.java == 'true'
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read
      pull-requests: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: java-kotlin
          build-mode: none
          config-file: ./.github/codeql/codeql-config.yml

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:java-kotlin"

  analyze-js:
    name: Analyze (javascript-typescript)
    needs: changes
    if: needs.changes.outputs.js == 'true'
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read
      pull-requests: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript
          build-mode: none
          config-file: ./.github/codeql/codeql-config.yml

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:javascript-typescript"

  # ---------------------------------------------------------------------------
  # Always-green gate so required checks stay satisfiable when a language is
  # skipped (docs-only PR) without leaving "Analyze (…)" missing.
  # Prefer requiring *this* check ("CodeQL") in branch protection if you want a
  # single required status; language jobs remain visible when they run.
  # ---------------------------------------------------------------------------
  codeql-gate:
    name: CodeQL
    needs: [changes, analyze-java, analyze-js]
    if: always()
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Aggregate language job results
        run: |
          set -euo pipefail
          changes_result="${{ needs.changes.result }}"
          java_needed="${{ needs.changes.outputs.java }}"
          js_needed="${{ needs.changes.outputs.js }}"
          java_result="${{ needs.analyze-java.result }}"
          js_result="${{ needs.analyze-js.result }}"
          echo "changes_result=$changes_result"
          echo "java_needed=$java_needed java_result=$java_result"
          echo "js_needed=$js_needed js_result=$js_result"

          if [ "$changes_result" != "success" ]; then
            echo "::error::Detect language changes failed (result=$changes_result)"
            exit 1
          fi

          fail=0
          if [ "$java_needed" = "true" ]; then
            case "$java_result" in
              success) ;;
              skipped)
                echo "::error::Java analysis was required but the job was skipped"
                fail=1
                ;;
              *)
                echo "::error::Java CodeQL failed or cancelled (result=$java_result)"
                fail=1
                ;;
            esac
          else
            echo "Java CodeQL skipped (no Java-relevant path changes)"
          fi

          if [ "$js_needed" = "true" ]; then
            case "$js_result" in
              success) ;;
              skipped)
                echo "::error::JS/TS analysis was required but the job was skipped"
                fail=1
                ;;
              *)
                echo "::error::JS/TS CodeQL failed or cancelled (result=$js_result)"
                fail=1
                ;;
            esac
          else
            echo "JS/TS CodeQL skipped (no JS/TS-relevant path changes)"
          fi

          if [ "$fail" -ne 0 ]; then
            exit 1
          fi
          echo "CodeQL gate passed"