codeql.yml

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Enables code scanning alerts in repo.

name: "CodeQL Advanced"

on:
  push:
    branches: [ "master" ]
  pull_request:
    branches: [ "master" ]
  workflow_dispatch: 
  schedule:
    - cron: '25 10 * * 6'

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d
        id: filter
        with:
          filters: |
            actions:
              - '.github/**'
            go:
              - '**/*.go'
              - '**/go.mod'
              - '**/go.sum'
            java-kotlin:
              - '**/*.java'
              - '**/*.kt'
              - '**/*.gradle'
              - '**/gradle.properties'
              - '**/gradlew'
              - '**/gradlew.bat'
            javascript-typescript:
              - '**/*.js'
              - '**/*.ts'
              - '**/package.json'
              - '**/package-lock.json'
              - '**/tsconfig.json'
            python:
              - '**/*.py'
              - '**/*.pyx'
              - '**/setup.py'
              - '**/setup.cfg'
              - '**/pyproject.toml'
              - '**/*requirements.txt'
            rust:
              - '**/*.rs'

      - name: Generate Matrix
        id: set-matrix
        run: |
          # Full matrix of all CodeQL supported languages and their build modes in Apache Beam.
          ALL_MATRIX='[
            {"language": "actions", "build-mode": "none"},
            {"language": "go", "build-mode": "manual"},
            {"language": "java-kotlin", "build-mode": "autobuild"},
            {"language": "javascript-typescript", "build-mode": "none"},
            {"language": "python", "build-mode": "none"},
            {"language": "rust", "build-mode": "none"}
          ]'

          # On periodic scheduled runs (cron) or manual dispatches, scan all languages.
          if [[ "${{ github.event_name }}" == "schedule" || "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            COMPACT_ALL=$(echo "$ALL_MATRIX" | jq -c .)
            echo "matrix=$COMPACT_ALL" >> $GITHUB_OUTPUT
          else
            # Filter ALL_MATRIX entries keeping only entries for languages with path changes.
            FILTERED=$(echo "$ALL_MATRIX" | jq -c '[.[] | select(
              (.language == "actions" and "${{ steps.filter.outputs.actions }}" == "true") or
              (.language == "go" and "${{ steps.filter.outputs.go }}" == "true") or
              (.language == "java-kotlin" and "${{ steps.filter.outputs['java-kotlin'] }}" == "true") or
              (.language == "javascript-typescript" and "${{ steps.filter.outputs['javascript-typescript'] }}" == "true") or
              (.language == "python" and "${{ steps.filter.outputs.python }}" == "true") or
              (.language == "rust" and "${{ steps.filter.outputs.rust }}" == "true")
            )]')
            echo "matrix=$FILTERED" >> $GITHUB_OUTPUT
          fi

  analyze:
    name: Analyze (${{ matrix.language }})
    needs: detect-changes
    if: needs.detect-changes.outputs.matrix != '[]'
    # Runner size impacts CodeQL analysis time. To learn more, please see:
    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
    #   - https://gh.io/supported-runners-and-hardware-resources
    #   - https://gh.io/using-larger-runners (GitHub.com only)
    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
    permissions:
      # required for all workflows
      security-events: write

      # required to fetch internal or private CodeQL packs
      packages: read

      # only required for workflows in private repositories
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.detect-changes.outputs.matrix) }}
        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
        # Use `c-cpp` to analyze code written in C, C++ or both
        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
    steps:
    - name: Checkout repository
      uses: actions/checkout@v7

    - name: Set up Go
      if: matrix.language == 'go'
      uses: actions/setup-go@v6
      with:
        go-version-file: 'sdks/go.mod'

    # Add any setup steps before running the `github/codeql-action/init` action.
    # This includes steps like installing compilers or runtimes (`actions/setup-node`
    # or others). This is typically only required for manual builds.
    # - name: Setup runtime (example)
    #   uses: actions/setup-example@v1

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.

        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
        # queries: security-extended,security-and-quality

    # If the analyze step fails for one of the languages you are analyzing with
    # "We were unable to automatically build your code", modify the matrix above
    # to set the build mode to "manual" for that language. Then modify this step
    # to build your code.
    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
    - name: Run manual build steps
      if: matrix.build-mode == 'manual'
      shell: bash
      run: |
        if [ "${{ matrix.language }}" = "go" ]; then
          echo "Building sdks module..."
          (cd sdks && go build ./...)

          echo "Building playground/backend module..."
          (cd playground/backend && go build ./...)

          echo "Building learning/katas/go module..."
          (cd learning/katas/go && go mod tidy && go build ./...)

          echo "Building learning/tour-of-beam/backend module..."
          (cd learning/tour-of-beam/backend && go build ./cmd/... ./internal/... ./playground_api/...)
        else
          echo "No manual build steps defined for ${{ matrix.language }}"
          exit 1
        fi

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4
      with:
        category: "/language:${{matrix.language}}"