codeql.yml

name: CodeQL

# Static analysis (SAST) over the TypeScript (the vscode-bynk extension + the
# embedded runtime — a real file since v0.48, so the Bearer JWT verifier is now
# in scope) and the Rust compiler. Free on this public repo; satisfies the
# OpenSSF Scorecard SAST check. SHA-pinned, the repo's posture (ADR 0087).
#
# CodeQL's load-bearing coverage here is the TypeScript surface; the Rust leg is
# maturing — defense-in-depth over what `clippy` + the type system already give.
# The *behavioral* guard for the emitted auth verifier is the bearer-auth test
# (`bynkc/tests/bearer_auth.rs`), not SAST — see ADR 0087.

on:
  # SAST analyses only Rust + TypeScript, so skip docs/design/markdown-only
  # changes — they cannot affect the analysed code, and re-analysing an
  # unchanged tree is wasted CI. The weekly `schedule` below stays unfiltered so
  # the default-branch baseline is always refreshed regardless. A mixed change
  # (any non-ignored path also touched) still runs.
  push:
    branches: [main]
    paths-ignore: &non_code_paths
      - "docs/**"
      - "design/**"
      - "**/*.md"
  pull_request:
    branches: [main]
    paths-ignore: *non_code_paths
  schedule:
    # Weekly drift check, offset from the other security workflows.
    - cron: "40 7 * * 1"

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      # Upload results to the code-scanning dashboard.
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language: [javascript-typescript, rust]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
        with:
          languages: ${{ matrix.language }}

      # JS/TS needs no build; Rust autobuild runs `cargo build`.
      - name: Autobuild
        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
        with:
          category: "/language:${{ matrix.language }}"