codeql.yml

# Copyright (c) 2026 SnowdreamTech. All rights reserved.
# Licensed under the MIT License. See LICENSE file in the project root for full license information.

---
# CodeQL Security Analysis
# Purpose: Performs deep static analysis to detect security vulnerabilities and coding errors.
# Trigger: Push to main, weekly schedule, and manual dispatch.
# Permissions:
#   - security-events: write (Required to upload SARIF results to the GitHub Security tab).
#   - actions: read (Required to determine workflow run status).
#   - contents: read (Required for code analysis).
# Concurrency:
#   - group: ${{ github.workflow }}-${{ github.ref }} (Ensures only the latest scan results are processed).
#   - cancel-in-progress: true (In-progress scans are superseded by newer commits to save resources).
# Design:
#   - Utilizes advanced matrix strategy for multi-language support (Go, Python).
#   - Leverages internal CodeQL autobuild for zero-config compilation where possible.

name: "🔬 CodeQL Analysis"

"on":
  push:
    branches:
      - "main"
      - "dev"
  pull_request:
    branches:
      - "main"
      - "dev"
      - "feat/**"
      - "branch/**"
      - "feature/**"
      - "fix/**"
      - "pr/**"

permissions: {}

env:
  UNIRTM_LOCKED: 1

jobs:
  analyze:
    name: "🛡️ Deep Semantic Analysis (${{ matrix.language }})"
    runs-on: ubuntu-latest
    concurrency:
      group: codeql-${{ github.workflow }}-${{ matrix.language }}-${{ github.ref }}
      cancel-in-progress: true
    permissions:
      security-events: write # Required to upload SARIF results to the GitHub Security tab
      actions: read # Required to determine workflow run status
      contents: read # Required for code analysis
    timeout-minutes: 360 # Deep scans on large repos can take significant time

    strategy:
      fail-fast: false
      matrix:
        language:
          - actions
          # Uncomment the following lines when source files exist in the repo:
          # - go # Go (*.go) — golangci-lint, gofmt
          # - python                # Python (*.py) — ruff, ansible-lint
          # - javascript-typescript # JS/TS (*.js, *.ts, *.jsx, *.tsx) — eslint
          # - c-cpp                 # C/C++/Obj-C (*.c, *.cpp, *.h) — clang-format
          # - csharp                # C# (*.cs) — dotnet format
          # - java-kotlin           # Java/Kotlin (*.java, *.kt) — ktlint
          # - ruby                  # Ruby (*.rb) — rubocop
          # - swift                 # Swift (*.swift) — swiftformat, swiftlint

    steps:
      - name: "🔒 Harden Runner"
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            raw.githubusercontent.com:443
            objects.githubusercontent.com:443
            pkg-containers.githubusercontent.com:443
            avatars.githubusercontent.com:443
            github.com:443
            packages.microsoft.com:443
            archive.ubuntu.com:80
            archive.ubuntu.com:443
            security.ubuntu.com:80
            security.ubuntu.com:443
            ports.ubuntu.com:80
            ports.ubuntu.com:443
            keyserver.ubuntu.com:80
            keyserver.ubuntu.com:443
            changelogs.ubuntu.com:80
            changelogs.ubuntu.com:443
            deb.debian.org:80
            deb.debian.org:443
            security.debian.org:80
            security.debian.org:443
            snapshot.debian.org:80
            snapshot.debian.org:443
            dl.rockylinux.org:443
            mirrors.rockylinux.org:443
            mirror.centos.org:443
            vault.centos.org:443
            isv-data.centos.org:443
            mirrorlist.centos.org:80
            mirrorlist.centos.org:443
            cdn.redhat.com:443
            cdn-ubi.redhat.com:443
            access.redhat.com:443
            sso.redhat.com:443
            dl-cdn.alpinelinux.org:443
            registry.npmjs.org:443
            registry.yarnpkg.com:443
            pypi.org:443
            files.pythonhosted.org:443
            proxy.golang.org:443
            sum.golang.org:443
            index.crates.io:443
            static.rust-lang.org:443
            packagist.org:443
            repo.maven.apache.org:443
            golang.org:443
            pkg.go.dev:443
            dl.google.com:443
            rubygems.org:443
            registry.terraform.io:443
            formulae.brew.sh:443
            repo.yarnpkg.com:443
            ghcr.io:443
            production.cloudflare.docker.com:80
            production.cloudflare.docker.com:443
            registry-1.docker.io:443
            auth.docker.io:443
            docker.io:443
            quay.io:443
            cdn.quay.io:443
            docker-images-prod.s3.us-west-2.amazonaws.com:443
            docker-images-prod.s3.us-east-1.amazonaws.com:443
            docker-images-prod.s3.amazonaws.com:443
            s3.amazonaws.com:443
            s3.us-west-2.amazonaws.com:443
            s3.us-east-1.amazonaws.com:443
            osv-vulnerabilities.storage.googleapis.com:443
            api.osv.dev:443
            get.trivy.dev:443
            aquasecurity.github.io:443
            tuf-repo-cdn.sigstore.dev:443
            oauth2.sigstore.dev:443
            rekor.sigstore.dev:443
            fulcio.sigstore.dev:443
            api.sigstore.dev:443
      - name: "📂 Checkout Repository Code"
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: "🛡️ Initialize CodeQL Engine"
        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          # Sets up the CodeQL database for the specified technical stack (e.g., Python, Go).
          languages: ${{ matrix.language }}
          config-file: .github/codeql/codeql-config.yml

      - name: "🚀 Bootstrap Target Build"
        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        # Attempts to automatically compile the project to enable full-trace analysis.

      - name: "🔍 Perform Deep Security Analysis"
        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          # Executes the semantic queries and generates the final vulnerability report.
          category: "/language:${{ matrix.language }}"