_lint.yml

# Reusable: lint + security-static + codeql-gate
name: Lint & Security

on:
  workflow_call: {}

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install build deps
        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev cmake

      - name: Install LLVM 20
        run: |
          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
          echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main" | sudo tee /etc/apt/sources.list.d/llvm-20.list
          sudo apt-get update
          sudo apt-get install -y clang-format-20

      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        id: cppcheck-cache
        with:
          path: /opt/cppcheck
          key: cppcheck-2.20.0-ubuntu-amd64

      - name: Build cppcheck 2.20.0
        if: steps.cppcheck-cache.outputs.cache-hit != 'true'
        run: |
          git clone --depth 1 --branch 2.20.0 https://github.com/danmar/cppcheck.git /tmp/cppcheck
          cmake -S /tmp/cppcheck -B /tmp/cppcheck/build -DCMAKE_BUILD_TYPE=Release -DHAVE_RULES=OFF -DCMAKE_INSTALL_PREFIX=/opt/cppcheck
          cmake --build /tmp/cppcheck/build -j$(nproc)
          cmake --install /tmp/cppcheck/build

      - name: Add cppcheck to PATH
        run: echo "/opt/cppcheck/bin" >> "$GITHUB_PATH"

      - name: Lint (cppcheck + clang-format, no clang-tidy — enforced locally)
        run: scripts/lint.sh --ci CLANG_FORMAT=clang-format-20

  security-static:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "Layer 1: Static allow-list audit"
        run: scripts/security-audit.sh
      - name: "Layer 6: UI security audit"
        run: scripts/security-ui.sh
      - name: "Layer 8: Vendored dependency integrity"
        run: scripts/security-vendored.sh

  codeql-gate:
    runs-on: ubuntu-latest
    timeout-minutes: 50
    steps:
      - name: Wait for CodeQL on current commit (max 45 min)
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          CURRENT_SHA="${{ github.sha }}"
          echo "Waiting for CodeQL to complete on $CURRENT_SHA..."
          for attempt in $(seq 1 90); do
            LATEST=$(gh api repos/${{ github.repository }}/actions/workflows/codeql.yml/runs?per_page=5 \
              --jq '.workflow_runs[] | select(.head_sha == "'"$CURRENT_SHA"'") | "\(.conclusion) \(.status)"' 2>/dev/null | head -1 || echo "")
            if [ -z "$LATEST" ]; then
              echo "  $attempt/90: no run yet..."; sleep 30; continue
            fi
            CONCLUSION=$(echo "$LATEST" | cut -d' ' -f1)
            STATUS=$(echo "$LATEST" | cut -d' ' -f2)
            if [ "$STATUS" = "completed" ] && [ "$CONCLUSION" = "success" ]; then
              echo "=== CodeQL passed ==="; exit 0
            elif [ "$STATUS" = "completed" ]; then
              echo "BLOCKED: CodeQL $CONCLUSION"; exit 1
            fi
            echo "  $attempt/90: $STATUS..."; sleep 30
          done
          echo "BLOCKED: CodeQL timeout"; exit 1

      - name: Check for open code scanning alerts
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Waiting 60s for alert API to settle..."
          sleep 60
          ALERTS=$(gh api 'repos/${{ github.repository }}/code-scanning/alerts?state=open' --jq 'length' 2>/dev/null || echo "0")
          sleep 15
          ALERTS2=$(gh api 'repos/${{ github.repository }}/code-scanning/alerts?state=open' --jq 'length' 2>/dev/null || echo "0")
          [ "$ALERTS" -lt "$ALERTS2" ] && ALERTS=$ALERTS2
          if [ "$ALERTS" -gt 0 ]; then
            echo "BLOCKED: $ALERTS open alert(s)"
            gh api 'repos/${{ github.repository }}/code-scanning/alerts?state=open' \
              --jq '.[] | "  #\(.number) [\(.rule.security_severity_level // .rule.severity)] \(.rule.id) — \(.most_recent_instance.location.path):\(.most_recent_instance.location.start_line)"' 2>/dev/null || true
            exit 1
          fi
          echo "=== CodeQL gate passed (0 alerts) ==="