panakoes/.github/workflows/codeql.yml at main · Aztec03hub/panakoes · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # merge_group: re-scan the queue's ahead-of-time merged commit to
  # catch security regressions introduced by two simultaneously-merging
  # PRs interacting.
  merge_group:
  schedule:
    - cron: '17 13 * * 1'  # weekly, Monday 13:17 UTC (offset to avoid GHA peak congestion)

# Cancel in-progress runs on the same PR (or branch ref for push events)
# when a new commit / event arrives. Without this, every old run sat in
# queued status holding a runner slot until it ran or naturally aged
# out, which gridlocked the GitHub Actions queue on 2026-05-08 when
# rapid close+reopen + force-push activity flooded the runner pool.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  actions: read
  contents: read
  security-events: write

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        language: ['actions']

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          # config-file points at .github/codeql/config.yml which
          # references both the GitHub-maintained `security-and-quality`
          # suite AND the Panakoes-specific .qls. The inline `queries:`
          # input does not accept repo-relative paths in codeql-action
          # v4 (rejects with "Specifier for external repository is
          # invalid"); the config-file form does.
          config-file: ./.github/codeql/config.yml

      - name: Autobuild
        uses: github/codeql-action/autobuild@v4

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"

  # Companion shell scanners for bug classes CodeQL has no first-class
  # extractor for (Terraform HCL, raw text). Each script emits SARIF
  # 2.1.0 and uploads via codeql-action/upload-sarif. Report-only:
  # continue-on-error: true and no required-status-check gating until
  # the existing findings on main are triaged. See
  # .github/codeql/README.md for the full rationale.
  panakoes-scanners:
    name: Panakoes custom scanners
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Scan IAM resource="*" outside allowlist
        continue-on-error: true
        run: bash .github/codeql/scripts/scan-iam-star.sh iam-star.sarif

      - name: Scan TF variable defaults for secret patterns
        continue-on-error: true
        run: bash .github/codeql/scripts/scan-tf-secrets.sh tf-secrets.sarif

      - name: Scan for em-dash / en-dash in source
        continue-on-error: true
        run: bash .github/codeql/scripts/scan-em-dash.sh em-dash.sarif

      - name: Scan for AUTH_JWT_* outside services/auth
        continue-on-error: true
        run: bash .github/codeql/scripts/scan-jwt-prefix.sh jwt-prefix.sarif

      - name: Upload IAM-star SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: iam-star.sarif
          category: panakoes-iam-star

      - name: Upload TF-secrets SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: tf-secrets.sarif
          category: panakoes-tf-secrets

      - name: Upload em-dash SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: em-dash.sarif
          category: panakoes-em-dash

      - name: Upload JWT-prefix SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: jwt-prefix.sarif
          category: panakoes-jwt-prefix