codeql.yml

# yamllint disable rule:key-ordering
# cspell:ignore SARIF sarif
# CodeQL Advanced workflow for the Aria repository.
#
# Tuned for MAXIMUM security signal with INTEGRATED AUTOFIX:
#   - All repo languages covered (Python, JS/TS, GitHub Actions; C/C++ via
#     manual build when present). HTML is analyzed as part of
#     javascript-typescript.
#   - Query packs: security-extended + security-and-quality + experimental
#     security queries, plus community security packs (when available).
#   - Threat model coverage expanded via a CodeQL config file that:
#       * Includes additional CWE-focused query suites.
#       * Disables noisy path filters so generated / vendored code that ships
#         to users is still scanned (only true third-party deps excluded).
#       * Enables ML-powered queries for JS/TS.
#   - Runs on every push to main, every PR (incl. draft), weekly schedule, and
#     manual dispatch — so nothing slips through.
#   - Pinned actions to immutable SHAs (OpenSSF Scorecard).
#   - Strict, least-privilege permissions.
#   - Hardened runner with egress auditing.
#   - **Autofix integration**:
#       1. Copilot Autofix is automatically applied to uploaded SARIF results
#          (when enabled at the repo/org level — see Settings → Code security).
#       2. A separate `autofix` job runs language-native fixers (ruff, eslint,
#          prettier, clang-format) on PRs and pushes suggested fixes back to
#          the PR branch, or opens a follow-up PR on scheduled / manual runs.
#       3. A `dependency-review` job blocks PRs that introduce vulnerable
#          dependencies.

concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
  group: codeql-${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.head_ref) || github.ref }}

defaults:
  run:
    shell: bash

env:
  ACTIONS_CACHE_SHA: 1bd1e32a3bdc45362d1e726936510720a7c30a57
  CHECKOUT_SHA: 11bd71901bbe5b1630ceea73d27597364c9af683
  CODEQL_ACTION_SHA: 4e828ff8d448a8a6e532957b1811f387a63867e8
  CREATE_PR_SHA: 67ccf781d68cd99b580ae25a5c18a1cc84ffff1f
  DEPENDENCY_REVIEW_SHA: da24556b548a50705dd671f47852072ea4c105d9
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
  HARDEN_RUNNER_SHA: 0634a2670c59f64b4a01f0f96f84700a4088b9f0
  RUFF_VERSION: '>=0.6,<1.0'
  SETUP_NODE_SHA: 49933ea5288caeca8642d1e84afbd3f7d6820020
  SETUP_PYTHON_SHA: a26af69be951a213d495a4c3e4e4022e16d87065
  UPLOAD_ARTIFACT_SHA: 65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    permissions:
      actions: read
      contents: read
      packages: read
      security-events: write
    runs-on: ${{ matrix.os }}
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
        with:
          disable-sudo: false
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ github.event.pull_request.head.sha || github.ref }}

      - name: Initialize CodeQL
        uses: github/codeql-action/init@4e828ff8d448a8a6e532957b1811f387a63867e8
        with:
          build-mode: ${{ matrix.build-mode }}
          config-file: ./.github/codeql/codeql-config.yml
          languages: ${{ matrix.language }}

      - id: analyze
        name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@4e828ff8d448a8a6e532957b1811f387a63867e8
        with:
          category: '/language:${{ matrix.language }}'
          output: ${{ runner.temp }}/sarif-${{ matrix.language }}
          upload: always
          wait-for-processing: true

      - if: always()
        name: Upload SARIF as artifact (debug / archival)
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
        with:
          if-no-files-found: warn
          name: codeql-sarif-${{ matrix.language }}
          path: ${{ runner.temp }}/sarif-${{ matrix.language }}
          retention-days: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - build-mode: none
            language: actions
            os: ubuntu-latest
          - build-mode: none
            language: javascript-typescript
            os: ubuntu-latest
          - build-mode: none
            language: python
            os: ubuntu-latest
          - build-mode: none
            language: c-cpp
            os: ubuntu-latest
    timeout-minutes: 360

  autofix:
    if: >-
      (github.event_name == 'pull_request' ||
       github.event_name == 'push' ||
       github.event_name == 'schedule' ||
       (github.event_name == 'workflow_dispatch' && inputs.run_autofix))
    name: Auto-fix (lint / format)
    needs: analyze
    permissions:
      contents: write
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
        with:
          disable-sudo: false
          egress-policy: audit

      - env:
          EVENT_NAME: ${{ github.event_name }}
          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          REF_NAME: ${{ github.ref_name }}
          REPOSITORY: ${{ github.repository }}
        id: ref
        name: Determine checkout ref
        run: |
          set -euo pipefail
          {
            if [ "$EVENT_NAME" = "pull_request" ]; then
              # Use the commit SHA for checkout so the step succeeds even when
              # the PR branch is deleted before the workflow fetches (e.g. after
              # an auto-delete-on-merge).  Store the branch name separately as
              # push_ref for the optional push-back step.
              echo "ref=$PR_HEAD_SHA"
              echo "push_ref=$PR_HEAD_REF"
              echo "repo=$PR_HEAD_REPO"
              if [ "$PR_HEAD_REPO" = "$REPOSITORY" ]; then
                echo "can_push=true"
              else
                echo "can_push=false"
              fi
            else
              echo "ref=$REF_NAME"
              echo "push_ref=$REF_NAME"
              echo "repo=$REPOSITORY"
              echo "can_push=false"
            fi
          } >> "$GITHUB_OUTPUT"

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0
          persist-credentials: true
          ref: ${{ steps.ref.outputs.ref }}
          repository: ${{ steps.ref.outputs.repo }}

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          cache: 'pip'
          python-version: '3.12'

      - name: Set up Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: '24'

      - name: Cache pip
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
        with:
          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt') }}
          path: ~/.cache/pip
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: Cache npm
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
        with:
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          path: |
            ~/.npm
            ~/.cache
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install autofix tooling
        run: |
          set -euo pipefail
          python -m pip install --upgrade pip
          pip install "ruff${{ env.RUFF_VERSION }}"

          if [ -f package.json ]; then
            if [ -f package-lock.json ]; then
              npm ci --no-audit --no-fund || npm install --no-audit --no-fund
            else
              npm install --no-audit --no-fund
            fi
            # Ensure prettier is available to npx for later steps.
            npx --no-install prettier --version >/dev/null 2>&1 || npm install --no-audit --no-fund --no-save prettier@3
          else
            npm install --global --no-fund --no-audit prettier@3
          fi

          if git ls-files -- '*.c' '*.cc' '*.cpp' '*.cxx' '*.h' '*.hh' '*.hpp' '*.hxx' ':(exclude).github/workflows/**' | grep -q .; then
            echo "::notice::C/C++ files detected; attempting to install clang-format"
            sudo DEBIAN_FRONTEND=noninteractive apt-get update -qq || true
            sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends clang-format || true
          else
            echo "No C/C++ files detected; skipping clang-format install."
          fi

      - continue-on-error: true
        name: Run ruff --fix (Python)
        run: |
          set -euo pipefail
          RUN_UNSAFE="false"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] || [ "${{ github.event_name }}" = "schedule" ]; then
            if [ "${{ inputs.allow_unsafe_fixes }}" = "true" ]; then
              RUN_UNSAFE="true"
            fi
          fi
          if [ "$RUN_UNSAFE" = "true" ]; then
            ruff check --fix --unsafe-fixes --exit-zero .
          else
            ruff check --fix --exit-zero .
          fi
          ruff format .

      - continue-on-error: true
        name: Run eslint --fix (if configured)
        run: |
          set -euo pipefail
          if [ -f package.json ]; then
            if npx --no-install eslint --version >/dev/null 2>&1; then
              npx eslint --fix --ext .js,.jsx,.ts,.tsx . || true
            else
              echo "eslint not installed locally; skipping eslint --fix."
            fi
          else
            echo "No package.json found; skipping eslint --fix."
          fi

      - continue-on-error: true
        name: Run prettier --write (JS/TS/JSON/YAML/MD/CSS/HTML)
        run: |
          set -euo pipefail
          if [ -f package.json ]; then
            npx --no-install prettier --write --ignore-unknown \
              "**/*.{js,jsx,ts,tsx,mjs,cjs,json,yml,yaml,md,css,scss,html}" \
              "!**/node_modules/**" \
              "!**/.venv/**" \
              "!**/venv/**" \
              "!**/dist/**" \
              "!**/build/**" \
              "!**/vendor/**" \
              "!**/third_party/**" \
              "!**/third-party/**" \
              "!**/datasets/**" \
              "!**/*.min.*" \
              "!**/.github/workflows/**" || true
          else
            prettier --write --ignore-unknown \
              "**/*.{js,jsx,ts,tsx,mjs,cjs,json,yml,yaml,md,css,scss,html}" \
              "!**/node_modules/**" \
              "!**/.venv/**" \
              "!**/venv/**" \
              "!**/dist/**" \
              "!**/build/**" \
              "!**/vendor/**" \
              "!**/third_party/**" \
              "!**/third-party/**" \
              "!**/datasets/**" \
              "!**/*.min.*" \
                "!**/.github/workflows/**" || true
          fi

      - continue-on-error: true
        name: Run clang-format (C/C++)
        run: |
          set -euo pipefail
          mapfile -t files < <(git ls-files -- '*.c' '*.cc' '*.cpp' '*.cxx' '*.h' '*.hh' '*.hpp' '*.hxx' ':(exclude).github/workflows/**' 2>/dev/null || true)
          if [ "${#files[@]}" -gt 0 ]; then
            clang-format -i --style=file --fallback-style=LLVM "${files[@]}" || true
          else
            echo "No C/C++ files to format."
          fi

      - name: Revert workflow file changes (permissions-safe)
        run: |
          set -euo pipefail
          git restore --staged --worktree -- .github/workflows || true

      - id: diff
        name: Detect changes
        run: |
          set -euo pipefail
          if git diff --quiet --exit-code; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
            echo "No autofix changes."
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
            git --no-pager diff --stat
          fi

      - env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PUSH_REF: ${{ steps.ref.outputs.push_ref }}
        if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'true'
        name: Commit fixes to PR branch
        run: |
          set -euo pipefail
          git config user.name  "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add -A
          git commit -m "style: apply automated autofixes (ruff / prettier / clang-format) [CodeQL Advanced]" || echo "No commit created"
          if git ls-remote --heads origin "$PUSH_REF" | grep -q .; then
            git push origin "HEAD:$PUSH_REF"
          else
            echo "PR branch '$PUSH_REF' no longer exists on the remote; skipping push."
          fi

      - if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'false'
        name: Produce patch artifact (fork PRs)
        run: |
          set -euo pipefail
          git diff > autofix.patch || true
          echo "Patch produced."

      - if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'false'
        name: Upload patch artifact
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
        with:
          name: autofix-patch
          path: autofix.patch
          retention-days: 14

      - if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'false'
        name: Comment patch link on fork PR
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
        with:
          script: |
            const pr = context.payload.pull_request;
            if (!pr) return;

            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
            const marker = '<!-- codeql-autofix-patch -->';
            const body = [
              marker,
              '### 🛠️ Autofix patch available',
              '',
              'This PR is from a fork, so the workflow cannot push directly.',
              `Download the patch from the [workflow run artifacts](${runUrl}) and apply with:`,
              '',
              '```bash',
              'git apply autofix.patch',
              '```',
            ].join('\n');

            const comments = await github.paginate(github.rest.issues.listComments, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: pr.number,
              per_page: 100,
            });

            const existing = comments.find(comment =>
              comment.user?.login === 'github-actions[bot]' &&
              typeof comment.body === 'string' &&
              comment.body.includes(marker)
            );

            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: pr.number,
                body,
              });
            }

      - if: >-
          steps.diff.outputs.changed == 'true' &&
          (github.event_name == 'push' ||
           github.event_name == 'schedule' ||
           (github.event_name == 'workflow_dispatch' && inputs.open_autofix_pr))
        name: Open autofix follow-up PR
        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f
        with:
          base: ${{ github.ref_name }}
          body: |
            Automated cleanup pushed by the **CodeQL Advanced** workflow.

            Tools applied:
            - `ruff check --fix` + `ruff format` (unsafe fixes only enabled when allow_unsafe_fixes=true on scheduled/manual runs)
            - `prettier --write`
            - `eslint --fix` (if configured in the repository)
            - `clang-format -i --style=file` (when C/C++ files are present)

            Triggered by: `${{ github.event_name }}` on `${{ github.ref }}` (run [#${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})).
          branch: chore/codeql-autofix-${{ github.run_id }}
          commit-message: |
            style: apply automated autofixes (ruff / prettier / clang-format)
          delete-branch: true
          labels: |
            automated
            autofix
            auto-merge
            chore
          sign-commits: false
          title: 'style: automated autofixes from CodeQL workflow'
          token: ${{ secrets.GITHUB_TOKEN }}
    timeout-minutes: 20

  copilot-autofix-summary:
    if: github.event_name == 'pull_request'
    name: Copilot Autofix Summary
    needs: analyze
    permissions:
      contents: read
      pull-requests: write
      security-events: read
    runs-on: ubuntu-latest
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
        with:
          egress-policy: audit

      - name: Summarize code scanning alerts + autofixes for this PR
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
        with:
          script: |
            const pr = context.payload.pull_request;
            if (!pr) return;

            const marker = '<!-- codeql-autofix-summary -->';

            const comments = await github.paginate(github.rest.issues.listComments, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: pr.number,
              per_page: 100,
            });

            const existing = comments.find(comment =>
              comment.user?.login === 'github-actions[bot]' &&
              typeof comment.body === 'string' &&
              comment.body.includes(marker)
            );

            const alerts = await github.paginate(github.rest.codeScanning.listAlertsForRepo, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open',
              ref: `refs/pull/${pr.number}/head`,
              per_page: 100,
            }).catch(err => {
              core.warning(`Could not list alerts: ${err.message}`);
              return [];
            });

            if (!alerts.length) {
              core.info('No open code scanning alerts on this PR.');
              if (existing) {
                const body = [
                  marker,
                  '### 🔐 CodeQL — Open Alerts on this PR',
                  '',
                  '✅ No open CodeQL alerts detected for this PR.',
                ].join('\n');

                await github.rest.issues.updateComment({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  comment_id: existing.id,
                  body,
                });
              }
              return;
            }

            const bySeverity = alerts.reduce((acc, a) => {
              const sev = a.rule?.security_severity_level || a.rule?.severity || 'note';
              acc[sev] = (acc[sev] || 0) + 1;
              return acc;
            }, {});

            const lines = [
              marker,
              '### 🔐 CodeQL — Open Alerts on this PR',
              '',
              '| Severity | Count |',
              '| --- | --- |',
              ...Object.entries(bySeverity).map(([k, v]) => `| \`${k}\` | ${v} |`),
              '',
              `Copilot Autofix suggestions (if enabled) appear as inline review comments on the affected lines.`,
              `See the full list in the [Security tab](${pr.base.repo.html_url}/security/code-scanning?query=pr%3A${pr.number}).`,
            ];

            const body = lines.join('\n');
            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: pr.number,
                body,
              });
            }
    timeout-minutes: 10

  dependency-review:
    if: github.event_name == 'pull_request'
    name: Dependency Review
    permissions:
      contents: read
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
        with:
          disable-sudo: true
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0
          persist-credentials: false

      - id: deps_changed
        name: Check for dependency file changes
        run: |
          # cspell:ignore pyproject
          set -euo pipefail
          BASE_REF="${{ github.event.pull_request.base.ref }}"
          [ -z "$BASE_REF" ] && { echo "::error::BASE_REF is empty"; exit 1; }
          git fetch --no-tags --depth=1 origin "$BASE_REF" || true
          files=$(git diff --name-only "origin/$BASE_REF...HEAD" || true)
          echo "::debug::Files changed in PR: $files"
          if echo "$files" | grep -E -q '(^|/)(package.json|package-lock.json|yarn.lock|pyproject.toml|requirements(\.txt)?|Pipfile|setup\.py|poetry.lock|go.mod|Gemfile|pom.xml)'; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
          fi

      - if: steps.deps_changed.outputs.changed == 'true'
        name: Dependency Review
        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9
        with:
          comment-summary-in-pr: on-failure
          deny-licenses: AGPL-1.0-only, AGPL-1.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later
          fail-on-severity: high

      - if: steps.deps_changed.outputs.changed != 'true'
        name: Skip dependency review (no relevant files changed)
        run: |
          echo "No dependency files modified; skipping Dependency Review."
    timeout-minutes: 10

name: 'CodeQL Advanced'

on:
  pull_request:
    branches: ['main']
    paths-ignore:
      - '**/*.md'
      - '**/*.rst'
      - 'docs/**'
      - '.github/ISSUE_TEMPLATE/**'
      - '.github/PULL_REQUEST_TEMPLATE/**'
      - 'LICENSE'
      - 'CODEOWNERS'
    types: [opened, reopened, synchronize, ready_for_review, edited]
  push:
    branches: ['main']
    paths-ignore:
      - '**/*.md'
      - '**/*.rst'
      - 'docs/**'
      - '.github/ISSUE_TEMPLATE/**'
      - '.github/PULL_REQUEST_TEMPLATE/**'
      - 'LICENSE'
      - 'CODEOWNERS'
  schedule:
    - cron: '36 23 * * 1'
    - cron: '36 23 * * 4'
  workflow_dispatch:
    inputs:
      allow_unsafe_fixes:
        default: false
        description: 'Allow potentially unsafe autofixes (e.g. ruff --unsafe-fixes) on scheduled/manual runs only'
        type: boolean
      open_autofix_pr:
        default: true
        description: 'Open a PR with autofix results (scheduled/manual runs)'
        type: boolean
      run_autofix:
        default: true
        description: 'Run language-native autofixers and push results'
        type: boolean

permissions:
  contents: read