codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly, so dependency and rule updates still get picked up on a quiet repo.
    - cron: "17 3 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: go
            build-mode: manual
          - language: javascript-typescript
            build-mode: none
          # Rust (src-tauri/) IS supported by CodeQL, and runs with build-mode:
          # none — no build step and no extra toolchain setup are needed.
          #
          # It matters here for two reasons. First, switching from default setup
          # to advanced setup silently dropped Rust coverage, which left the
          # existing Rust alerts orphaned: with no Rust analysis running, nothing
          # ever re-evaluates them, so fixed findings stay open forever.
          #
          # Second, Rust is the one case where `paths-ignore` in the CodeQL
          # config actually works. That option applies to languages analysed
          # without a build, and Rust is in that group (C/C++, C#, Java, Rust) —
          # unlike Go, which is built and therefore needs the build-step
          # exclusion described below. So the vendored Rust examples under
          # third_party are filtered by the config file, not by moving files.
          - language: rust
            build-mode: none

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      # Go has to be installed BEFORE `codeql-action/init`, because init injects
      # its own `go` wrapper (the go-tracing shim) so it can record which files
      # actually get compiled. If setup-go runs afterwards, PATH is rewritten to
      # the untraced toolchain and CodeQL sees no Go source, then fails during
      # `database finalize` with "detected code written in Go but this run didn't
      # build any of it" (exit code 32).
      - name: Set up Go
        if: matrix.language == 'go'
        uses: actions/setup-go@v6
        with:
          go-version-file: sidecars/coderelay-proxy/go.mod
          cache-dependency-path: sidecars/coderelay-proxy/go.sum

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          config-file: ./.github/codeql/codeql-config.yml

      # The repo has no go.mod at its root; the sidecar is its own module and
      # pulls the vendored CLIProxyAPI copy in through a replace directive.
      #
      # `paths-ignore` in the CodeQL config does NOT apply to Go. That option is
      # limited to interpreted languages, or to compiled languages analysed
      # without a build (C/C++, C#, Java, Rust). Go is built here, so per the
      # CodeQL docs the exclusion has to happen in this build step instead.
      #
      # The CodeQL Go extractor decides what to extract by measuring each
      # package's directory against the source root: anything that resolves to a
      # path beginning with `..` is reported as "Skipping dependency package"
      # and left out of the database. That is why ordinary module cache
      # dependencies never show up as alerts here. Moving the vendored snapshot
      # out of the workspace before building puts it in exactly that category,
      # while the replace directive keeps it available to the compiler.
      #
      # Mechanism reference: github/codeql, go/extractor/extractor.go — its
      # `excludedDirs` slice is seeded with a `..` pattern, which is what makes
      # out-of-root dependencies get skipped.
      - name: Build Go sidecar
        if: matrix.language == 'go'
        working-directory: sidecars/coderelay-proxy
        run: |
          set -euo pipefail
          # $RUNNER_TEMP and the workspace share a filesystem on GitHub-hosted
          # runners, so this is a directory rename, not a copy of 1293 files.
          EXT="$RUNNER_TEMP/coderelay-ext"
          mkdir -p "$EXT"
          mv third_party/CLIProxyAPI "$EXT/CLIProxyAPI"
          go mod edit -replace github.com/router-for-me/CLIProxyAPI/v7="$EXT/CLIProxyAPI"
          go build ./...

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"