codeql.yml

name: CodeQL

on:
  workflow_dispatch:
  push:
    branches:
      - master
  pull_request:
    # The branches below must be a subset of the branches above
    branches:
      - master
  schedule:
    # Every Wednesday at 04:20
    - cron: 20 4 * * 3

# We set `concurrency` to prevent having this workflow being run on code that is not up-to-date on a PR (a user make multiple push in a quick manner).
# But on the main branch, we don't want that behavior.
# Having the workflow run on each merge commit is something we would like, that could help us where a regression was made and missed by previous checks.
#
# For that we use `head_ref` that is only defined on `pull-request` and fallback to `run_id` (this is a counter, so it's value is unique between workflow call).
concurrency:
  group: codeql-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

env:
  node-version: 24.18.0

permissions:
  contents: read
  security-events: write
  pull-requests: read # Needed by `dorny/paths-filter` action

jobs:
  python-analyze:
    name: 🐍 Python static code Analysis
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin v7.0.1
        timeout-minutes: 5

      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # pin v4.0.3
        id: changes
        with:
          filters: .github/filters/codeql.yml

      - name: Check modified path that require `python-analysis` to run
        id: should-run-python-analysis
        # We want the job to run when:
        # - modifying python code
        # - in the merge queue
        # - on the main branch
        if: >-
          steps.changes.outputs.python-analyze == 'true'
          || contains(github.ref, 'gh-readonly-queue')
          || github.ref == 'refs/heads/master'
        run: echo "run=true" >> $GITHUB_OUTPUT
        shell: bash

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        if: steps.should-run-python-analysis.outputs.run == 'true'
        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # pin v4.37.8
        with:
          languages: python
          setup-python-dependencies: false
          # If you wish to specify custom queries, you can do so here or in a config file.
          # By default, queries listed here will override any specified in a config file.
          # Prefix the list here with "+" to use these queries and those in the config file.

          # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
          # queries: security-extended,security-and-quality

      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          working-directory: server
          version: 0.11.29 # marker:uv-version
        timeout-minutes: 5

      - name: Install python deps
        if: steps.should-run-python-analysis.outputs.run == 'true'
        run: uv run --locked sh -c 'echo "CODEQL_PYTHON=$(which python)"' | tee -a $GITHUB_ENV
        working-directory: server

      - name: Perform CodeQL Analysis
        if: steps.should-run-python-analysis.outputs.run == 'true'
        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # pin v4.37.8
        with:
          category: /language:python

  javascript-analyze:
    name: 🌐 Javascript static code Analysis
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin v7.0.1
        timeout-minutes: 5

      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # pin v4.0.3
        id: changes
        with:
          filters: .github/filters/codeql.yml

      - name: Check modified path that require `javascript-analysis` to run
        id: should-run-js-analysis
        if: >-
          steps.changes.outputs.js-analyze == 'true'
          || contains(github.ref, 'gh-readonly-queue')
          || github.ref == 'refs/heads/master'
        run: echo "run=true" >> $GITHUB_OUTPUT
        shell: bash

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        if: steps.should-run-js-analysis.outputs.run == 'true'
        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # pin v4.37.8
        with:
          languages: typescript

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # pin v7.0.0
        if: steps.should-run-js-analysis.outputs.run == 'true'
        with:
          node-version: ${{ env.node-version }}
        timeout-minutes: 2

      - name: Install dependencies for ionic project
        if: steps.should-run-js-analysis.outputs.run == 'true'
        run: npm clean-install
        working-directory: client

      - name: Autobuild for typescript
        if: steps.should-run-js-analysis.outputs.run == 'true'
        uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # pin v4.37.8
        with:
          working-directory: client

      - name: Perform CodeQL Analysis
        if: steps.should-run-js-analysis.outputs.run == 'true'
        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # pin v4.37.8
        with:
          category: /language:typescript