codeql.yml

# CodeQL Advanced workflow for the Aria repository.
#
# Tuned for MAXIMUM security signal with INTEGRATED AUTOFIX:
#   - All repo languages covered (Python, JS/TS, GitHub Actions; C/C++ via
#     manual build when present). HTML is analyzed as part of
#     javascript-typescript.
#   - Query packs: security-extended + security-and-quality + experimental
#     security queries, plus community security packs (when available).
#   - Threat model coverage expanded via a CodeQL config file that:
#       * Includes additional CWE-focused query suites.
#       * Disables noisy path filters so generated / vendored code that ships
#         to users is still scanned (only true third-party deps excluded).
#       * Enables ML-powered queries for JS/TS.
#   - Runs on every push to main, every PR (incl. draft), weekly schedule, and
#     manual dispatch — so nothing slips through.
#   - Pinned actions to immutable SHAs (OpenSSF Scorecard).
#   - Strict, least-privilege permissions.
#   - Hardened runner with egress auditing.
#   - **Autofix integration**:
#       1. Copilot Autofix is automatically applied to uploaded SARIF results
#          (when enabled at the repo/org level — see Settings → Code security).
#       2. A separate `autofix` job runs language-native fixers (ruff, eslint,
#          prettier, clang-format) on PRs and pushes suggested fixes back to
#          the PR branch, or opens a follow-up PR on scheduled / manual runs.
#       3. A `dependency-review` job blocks PRs that introduce vulnerable
#          dependencies.

name: "CodeQL Advanced"

on:
  push:
    branches: ["main"]
    paths-ignore:
      - "**/*.md"
      - "**/*.rst"
      - "docs/**"
      - ".github/ISSUE_TEMPLATE/**"
      - ".github/PULL_REQUEST_TEMPLATE/**"
      - "LICENSE"
      - "CODEOWNERS"
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review, edited]
    branches: ["main"]
    paths-ignore:
      - "**/*.md"
      - "**/*.rst"
      - "docs/**"
      - ".github/ISSUE_TEMPLATE/**"
      - ".github/PULL_REQUEST_TEMPLATE/**"
      - "LICENSE"
      - "CODEOWNERS"
  schedule:
    - cron: "36 23 * * 1"
    - cron: "36 23 * * 4"
  workflow_dispatch:
    inputs:
      run_autofix:
        description: "Run language-native autofixers and push results"
        type: boolean
        default: true
      open_autofix_pr:
        description: "Open a PR with autofix results (scheduled/manual runs)"
        type: boolean
        default: true
      allow_unsafe_fixes:
        description: "Allow potentially unsafe autofixes (e.g. ruff --unsafe-fixes) on scheduled/manual runs only"
        type: boolean
        default: false

concurrency:
  group: codeql-${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.head_ref) || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

defaults:
  run:
    shell: bash

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  CODEQL_ACTION_SHA: 4e828ff8d448a8a6e532957b1811f387a63867e8
  HARDEN_RUNNER_SHA: 0634a2670c59f64b4a01f0f96f84700a4088b9f0
  CHECKOUT_SHA: 11bd71901bbe5b1630ceea73d27597364c9af683
  ACTIONS_CACHE_SHA: 1bd1e32a3bdc45362d1e726936510720a7c30a57
  DEPENDENCY_REVIEW_SHA: da24556b548a50705dd671f47852072ea4c105d9
  UPLOAD_ARTIFACT_SHA: 65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
  SETUP_PYTHON_SHA: a26af69be951a213d495a4c3e4e4022e16d87065
  SETUP_NODE_SHA: 49933ea5288caeca8642d1e84afbd3f7d6820020
  CREATE_PR_SHA: 67ccf781d68cd99b580ae25a5c18a1cc84ffff1f
  RUFF_VERSION: ">=0.6,<1.0"

jobs:
  dependency-review:
    name: Dependency Review
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
        with:
          egress-policy: audit
          disable-sudo: true

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Check for dependency file changes
        id: deps_changed
        run: |
          set -euo pipefail
          BASE_REF="${{ github.event.pull_request.base.ref }}"
          [ -z "$BASE_REF" ] && { echo "::error::BASE_REF is empty"; exit 1; }
          git fetch --no-tags --depth=1 origin "$BASE_REF" || true
          files=$(git diff --name-only "origin/$BASE_REF...HEAD" || true)
          echo "::debug::Files changed in PR: $files"
          if echo "$files" | grep -E -q '(^|/)(package.json|package-lock.json|yarn.lock|pyproject.toml|requirements(\.txt)?|Pipfile|setup\.py|poetry.lock|go.mod|Gemfile|pom.xml)'; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Dependency Review
        if: steps.deps_changed.outputs.changed == 'true'
        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9
        with:
          fail-on-severity: high
          comment-summary-in-pr: on-failure
          deny-licenses: AGPL-1.0-only, AGPL-1.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later

      - name: Skip dependency review (no relevant files changed)
        if: steps.deps_changed.outputs.changed != 'true'
        run: |
          echo "No dependency files modified; skipping Dependency Review."

  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 360

    permissions:
      security-events: write
      contents: read
      packages: read
      actions: read

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: actions
            build-mode: none
            os: ubuntu-latest
          - language: javascript-typescript
            build-mode: none
            os: ubuntu-latest
          - language: python
            build-mode: none
            os: ubuntu-latest
          - language: c-cpp
            build-mode: none
            os: ubuntu-latest

    steps:
      - name: Harden runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
        with:
          egress-policy: audit
          disable-sudo: false

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha || github.ref }}
          persist-credentials: false
          submodules: recursive

      - name: Initialize CodeQL
        uses: github/codeql-action/init@4e828ff8d448a8a6e532957b1811f387a63867e8
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          config-file: ./.github/codeql/codeql-config.yml

      - name: Perform CodeQL Analysis
        id: analyze
        uses: github/codeql-action/analyze@4e828ff8d448a8a6e532957b1811f387a63867e8
        with:
          category: "/language:${{ matrix.language }}"
          upload: always
          wait-for-processing: true
          output: ${{ runner.temp }}/sarif-${{ matrix.language }}

      - name: Upload SARIF as artifact (debug / archival)
        if: always()
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
        with:
          name: codeql-sarif-${{ matrix.language }}
          path: ${{ runner.temp }}/sarif-${{ matrix.language }}
          retention-days: 30
          if-no-files-found: warn

  copilot-autofix-summary:
    name: Copilot Autofix Summary
    if: github.event_name == 'pull_request'
    needs: analyze
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: write
      security-events: read
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
        with:
          egress-policy: audit

      - name: Summarise code scanning alerts + autofixes for this PR
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
        with:
          script: |
            const pr = context.payload.pull_request;
            if (!pr) return;

            const marker = '<!-- codeql-autofix-summary -->';

            const { data: alerts } = await github.rest.codeScanning.listAlertsForRepo({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open',
              ref: `refs/pull/${pr.number}/head`,
              per_page: 100,
            }).catch(err => {
              core.warning(`Could not list alerts: ${err.message}`);
              return { data: [] };
            });

            if (!alerts.length) {
              core.info('No open code scanning alerts on this PR.');
              return;
            }

            const bySeverity = alerts.reduce((acc, a) => {
              const sev = a.rule?.security_severity_level || a.rule?.severity || 'note';
              acc[sev] = (acc[sev] || 0) + 1;
              return acc;
            }, {});

            const lines = [
              marker,
              '### 🔐 CodeQL — Open Alerts on this PR',
              '',
              '| Severity | Count |',
              '| --- | --- |',
              ...Object.entries(bySeverity).map(([k, v]) => `| \`${k}\` | ${v} |`),
              '',
              `Copilot Autofix suggestions (if enabled) appear as inline review comments on the affected lines.`,
              `See the full list in the [Security tab](${pr.base.repo.html_url}/security/code-scanning?query=pr%3A${pr.number}).`,
            ];

            const body = lines.join('\n');
            const comments = await github.paginate(github.rest.issues.listComments, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: pr.number,
              per_page: 100,
            });

            const existing = comments.find(comment =>
              comment.user?.login === 'github-actions[bot]' &&
              typeof comment.body === 'string' &&
              comment.body.includes(marker)
            );

            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: pr.number,
                body,
              });
            }

  autofix:
    name: Auto-fix (lint / format)
    if: >-
      (github.event_name == 'pull_request' ||
       github.event_name == 'push' ||
       github.event_name == 'schedule' ||
       (github.event_name == 'workflow_dispatch' && inputs.run_autofix))
    needs: analyze
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write
      pull-requests: write

    steps:
      - name: Harden runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
        with:
          egress-policy: audit
          disable-sudo: false

      - name: Determine checkout ref
        id: ref
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          REPOSITORY: ${{ github.repository }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          {
            if [ "$EVENT_NAME" = "pull_request" ]; then
              echo "ref=$PR_HEAD_REF"
              echo "repo=$PR_HEAD_REPO"
              if [ "$PR_HEAD_REPO" = "$REPOSITORY" ]; then
                echo "can_push=true"
              else
                echo "can_push=false"
              fi
            else
              echo "ref=$REF_NAME"
              echo "repo=$REPOSITORY"
              echo "can_push=false"
            fi
          } >> "$GITHUB_OUTPUT"

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          ref: ${{ steps.ref.outputs.ref }}
          repository: ${{ steps.ref.outputs.repo }}
          fetch-depth: 0
          persist-credentials: true

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: "3.12"
          cache: "pip"

      - name: Set up Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: "20"

      - name: Cache pip
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: Cache npm
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
        with:
          path: |
            ~/.npm
            ~/.cache
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install autofix tooling
        run: |
          set -euo pipefail
          python -m pip install --upgrade pip
          pip install "ruff${{ env.RUFF_VERSION }}"
          if [ -f package.json ]; then
            if [ -f package-lock.json ]; then
              npm ci --no-audit --no-fund || npm install --no-audit --no-fund
            else
              npm install --no-audit --no-fund
            fi
            if ! command -v prettier >/dev/null 2>&1; then
              npx --no-install prettier --version >/dev/null 2>&1 || npm install --no-audit --no-fund --no-save prettier@3
            fi
          else
            npm install --global --no-fund --no-audit prettier@3
          fi

          if git ls-files '*.c' '*.cc' '*.cpp' '*.cxx' '*.h' '*.hh' '*.hpp' '*.hxx' | grep -q .; then
            echo "::notice::C/C++ files detected; attempting to install clang-format"
            sudo DEBIAN_FRONTEND=noninteractive apt-get update -qq || true
            sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends clang-format || true
          else
            echo "No C/C++ files detected; skipping clang-format install."
          fi

      - name: Run ruff --fix (Python)
        continue-on-error: true
        run: |
          set -euo pipefail
          RUN_UNSAFE="false"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] || [ "${{ github.event_name }}" = "schedule" ]; then
            if [ "${{ inputs.allow_unsafe_fixes }}" = "true" ]; then
              RUN_UNSAFE="true"
            fi
          fi
          if [ "$RUN_UNSAFE" = "true" ]; then
            ruff check --fix --unsafe-fixes --exit-zero .
          else
            ruff check --fix --exit-zero .
          fi
          ruff format .

      - name: Run eslint --fix (if configured)
        continue-on-error: true
        run: |
          set -euo pipefail
          if [ -f package.json ]; then
            if npx --no-install eslint --version >/dev/null 2>&1; then
              npx eslint --fix --ext .js,.jsx,.ts,.tsx . || true
            else
              echo "eslint not installed locally; skipping eslint --fix."
            fi
          else
            echo "No package.json found; skipping eslint --fix."
          fi

      - name: Run prettier --write (JS/TS/JSON/YAML/MD/CSS/HTML)
        continue-on-error: true
        run: |
          set -euo pipefail
          prettier --write --ignore-unknown \
            "**/*.{js,jsx,ts,tsx,mjs,cjs,json,yml,yaml,md,css,scss,html}" \
            "!**/node_modules/**" \
            "!**/.venv/**" \
            "!**/venv/**" \
            "!**/dist/**" \
            "!**/build/**" \
            "!**/vendor/**" \
            "!**/third_party/**" \
            "!**/third-party/**" \
            "!**/*.min.*" || true

      - name: Run clang-format (C/C++)
        continue-on-error: true
        run: |
          set -euo pipefail
          mapfile -t files < <(git ls-files '*.c' '*.cc' '*.cpp' '*.cxx' '*.h' '*.hh' '*.hpp' '*.hxx' 2>/dev/null || true)
          if [ "${#files[@]}" -gt 0 ]; then
            clang-format -i --style=file --fallback-style=LLVM "${files[@]}" || true
          else
            echo "No C/C++ files to format."
          fi

      - name: Detect changes
        id: diff
        run: |
          set -euo pipefail
          if git diff --quiet --exit-code; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
            echo "No autofix changes."
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
            git --no-pager diff --stat
          fi

      - name: Commit fixes to PR branch
        if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          git config user.name  "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add -A
          git commit -m "style: apply automated autofixes (ruff / prettier / clang-format) [CodeQL Advanced]" || echo "No commit created"
          git push origin "HEAD:${{ steps.ref.outputs.ref }}"

      - name: Produce patch artifact (fork PRs)
        if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'false'
        run: |
          set -euo pipefail
          git diff > autofix.patch || true
          echo "Patch produced."

      - name: Upload patch artifact
        if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'false'
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
        with:
          name: autofix-patch
          path: autofix.patch
          retention-days: 14

      - name: Comment patch link on fork PR
        if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'false'
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
        with:
          script: |
            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
            const marker = '<!-- codeql-autofix-patch -->';
            const body = [
              marker,
              '### 🛠️ Autofix patch available',
              '',
              'This PR is from a fork, so the workflow cannot push directly.',
              `Download the patch from the [workflow run artifacts](${runUrl}) and apply with:`,
              '',
              '```bash',
              'git apply autofix.patch',
              '```',
            ].join('\n');

            const comments = await github.paginate(github.rest.issues.listComments, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.payload.pull_request.number,
              per_page: 100,
            });

            const existing = comments.find(comment =>
              comment.user?.login === 'github-actions[bot]' &&
              typeof comment.body === 'string' &&
              comment.body.includes(marker)
            );

            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.payload.pull_request.number,
                body,
              });
            }

      - name: Open autofix follow-up PR
        if: >-
          steps.diff.outputs.changed == 'true' &&
          (github.event_name == 'push' ||
           github.event_name == 'schedule' ||
           (github.event_name == 'workflow_dispatch' && inputs.open_autofix_pr))
        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          branch: chore/codeql-autofix-${{ github.run_id }}
          base: ${{ github.ref_name }}
          commit-message: |
            style: apply automated autofixes (ruff / prettier / clang-format)
          title: "style: automated autofixes from CodeQL workflow"
          body: |
            Automated cleanup pushed by the **CodeQL Advanced** workflow.

            Tools applied:
            - `ruff check --fix` + `ruff format` (unsafe fixes only enabled when allow_unsafe_fixes=true on scheduled/manual runs)
            - `prettier --write`
            - `eslint --fix` (if configured in the repository)
            - `clang-format -i --style=file` (when C/C++ files are present)

            Triggered by: `${{ github.event_name }}` on `${{ github.ref }}` (run [#${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})).
          labels: |
            automated
            autofix
            chore
          delete-branch: true
          sign-commits: false