MessageFoundry/.github/workflows/codeql.yml at main · MEFORORG/MessageFoundry · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
name: CodeQL

# Deep semantic SAST (taint / data-flow analysis) that complements bandit and the curated semgrep
# rules in security.yml — it finds vulnerable flows those pattern matchers can't, e.g. untrusted
# HL7/config data reaching a sink across function boundaries.
#
# WHY THIS IS GUARDED TO THE MIRROR: CodeQL uploads results to GitHub code scanning, which on a
# PRIVATE repo requires paid GitHub Advanced Security (see security.yml's header note). This repo's
# source of truth is private, but the OSS mirror MEFORORG/MessageFoundry is PUBLIC, where CodeQL +
# code scanning are FREE. So the analyze job is gated on the repo slug: it is SKIPPED (a no-op) on the
# private source repo and runs only once publish.ps1 mirrors this file to MEFORORG/MessageFoundry.
# Nothing to pay, nothing to fail on the private side.
#
# PINNING CAVEAT: this repo SHA-pins every Action for supply-chain integrity. actions/checkout below
# reuses the repo's existing v7.0.0 pin; the github/codeql-action steps are on the v3 tag for now
# because the live commit SHA must be looked up at authoring — SHA-pin them before treating this as a
# hardened gate (OSSF Scorecard / zizmor would flag the unpinned tags).
#
# ALTERNATIVE (no file): on the public mirror you can instead enable CodeQL "default setup" from
# Settings -> Security -> Code scanning (one toggle, auto-pinned, auto-updated). Default setup and this
# advanced workflow are mutually exclusive — if you turn default setup ON, delete this file.
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly, so newly-shipped CodeQL queries run against unchanged code (same rationale as the daily
    # pip-audit cron: a fresh finding against a quiet codebase shouldn't wait for the next push).
    - cron: "0 7 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  analyze:
    name: CodeQL (${{ matrix.language }})
    # ONLY on the public mirror — code scanning is free there; on the private source repo it would need
    # paid GHAS, so this is a skipped no-op there. (GitHub Actions string == is case-insensitive.)
    if: github.repository == 'MEFORORG/MessageFoundry'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write # upload the SARIF results to code scanning
      actions: read
    strategy:
      fail-fast: false
      matrix:
        # python = the engine; javascript-typescript = the ide/ VS Code extension (both ship to the
        # mirror). Both are interpreted — CodeQL needs no build step. Drop a language to narrow scope.
        language: [python, javascript-typescript]
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false # CodeQL uploads via the job token, not a persisted git credential
      - name: Initialize CodeQL
        uses: github/codeql-action/init@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
        with:
          languages: ${{ matrix.language }}
          # security-extended adds higher-recall security queries on top of the default suite.
          queries: security-extended
      - name: Analyze
        uses: github/codeql-action/analyze@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
        with:
          category: "/language:${{ matrix.language }}"