codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '34 3 * * 1'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  XCODEGEN_SHA256: "090ec29491aad50aec10631bf6e62253fed733c50f3aab0f5ffc86bc170bdbef"
  XCODEGEN_VERSION: "2.45.4"

jobs:
  changes:
    name: Classify CodeQL changes
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      typescript: ${{ steps.classify.outputs.typescript }}
      swift_product: ${{ steps.classify.outputs.swift_product }}
      swift_remote_server: ${{ steps.classify.outputs.swift_remote_server }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
      - id: classify
        name: Detect affected CodeQL targets
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: bash scripts/ci/classify-codeql-changes.sh "$BASE_SHA" "$HEAD_SHA" "$GITHUB_OUTPUT"

      - if: steps.classify.outputs.typescript == 'true' || steps.classify.outputs.swift_product == 'true' || steps.classify.outputs.swift_remote_server == 'true'
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          cache: npm
      - if: steps.classify.outputs.typescript == 'true' || steps.classify.outputs.swift_product == 'true' || steps.classify.outputs.swift_remote_server == 'true'
        run: ONNXRUNTIME_NODE_INSTALL=skip npm ci
      - if: steps.classify.outputs.typescript == 'true' || steps.classify.outputs.swift_product == 'true' || steps.classify.outputs.swift_remote_server == 'true'
        name: Verify workflow pin contract
        run: npm test -- tests/scripts/ci-workflow.test.ts

  typescript:
    name: CodeQL TypeScript
    needs: changes
    if: needs.changes.outputs.typescript == 'true'
    permissions:
      contents: read
      security-events: write
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          languages: javascript-typescript
          build-mode: none

      - name: Analyze
        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3

  swift:
    name: CodeQL Swift product
    needs: changes
    if: needs.changes.outputs.swift_product == 'true'
    permissions:
      contents: read
      security-events: write
    runs-on: macos-15
    timeout-minutes: 75
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          cache: 'npm'

      - name: Cache SPM package clones
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ~/.cache/engram-codeql-spm
          key: codeql-spm-${{ runner.os }}-${{ runner.arch }}-xcode16-${{ hashFiles('macos/Engram.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved') }}
          restore-keys: codeql-spm-${{ runner.os }}-${{ runner.arch }}-xcode16-

      - name: Install xcodegen
        run: bash scripts/ci/install-xcodegen.sh "$XCODEGEN_VERSION" "$XCODEGEN_SHA256"

      - name: Initialize CodeQL
        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          languages: swift
          build-mode: manual

      - name: Generate project resources
        run: |
          npm ci
          npm run build
          npm run generate:fixtures
          scripts/check-xcodeproj-drift.sh

      - name: Build Swift product
        run: |
          cd macos
          xcodebuild build \
            -project Engram.xcodeproj \
            -scheme Engram \
            -destination 'platform=macOS' \
            -derivedDataPath "$RUNNER_TEMP/codeql-product-derived" \
            -clonedSourcePackagesDirPath "$HOME/.cache/engram-codeql-spm" \
            ONLY_ACTIVE_ARCH=YES \
            CODE_SIGNING_ALLOWED=NO

      - name: Analyze
        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          category: /language:swift/target:product

  swift-remote-server:
    name: CodeQL Swift remote server
    needs: changes
    if: needs.changes.outputs.swift_remote_server == 'true'
    permissions:
      contents: read
      security-events: write
    runs-on: macos-26
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Select Xcode 26.6
        run: sudo xcode-select -s /Applications/Xcode_26.6.app

      - name: Install xcodegen
        run: bash scripts/ci/install-xcodegen.sh "$XCODEGEN_VERSION" "$XCODEGEN_SHA256"

      - name: Initialize CodeQL
        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          languages: swift
          build-mode: manual

      - name: Generate Xcode project
        run: scripts/check-xcodeproj-drift.sh

      - name: Build Swift remote server
        run: |
          cd macos
          xcodebuild build \
            -project Engram.xcodeproj \
            -scheme EngramRemoteServer \
            -configuration Release \
            -destination 'generic/platform=macOS' \
            -derivedDataPath "$RUNNER_TEMP/codeql-remote-derived" \
            ARCHS=arm64 \
            ONLY_ACTIVE_ARCH=NO \
            CODE_SIGNING_ALLOWED=NO

      - name: Analyze
        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          category: /language:swift/target:remote-server

  codeql-gate:
    name: CodeQL Gate
    if: always()
    needs:
      - changes
      - typescript
      - swift
      - swift-remote-server
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    env:
      CHANGES: ${{ needs.changes.result }}
      TYPESCRIPT_REQUIRED: ${{ needs.changes.outputs.typescript }}
      SWIFT_PRODUCT_REQUIRED: ${{ needs.changes.outputs.swift_product }}
      SWIFT_REMOTE_REQUIRED: ${{ needs.changes.outputs.swift_remote_server }}
      TYPESCRIPT_RESULT: ${{ needs.typescript.result }}
      SWIFT_PRODUCT_RESULT: ${{ needs.swift.result }}
      SWIFT_REMOTE_RESULT: ${{ needs.swift-remote-server.result }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Verify expected CodeQL results
        run: |
          bash scripts/ci/verify-codeql-gate.sh \
            "$CHANGES" \
            "$TYPESCRIPT_REQUIRED" "$TYPESCRIPT_RESULT" \
            "$SWIFT_PRODUCT_REQUIRED" "$SWIFT_PRODUCT_RESULT" \
            "$SWIFT_REMOTE_REQUIRED" "$SWIFT_REMOTE_RESULT"