codeql.yml

name: "CodeQL Security Scan"

on:
  push:
    branches: ["main", "develop"]
  pull_request:
    branches: ["main", "develop"]
  schedule:
    - cron: '0 6 * * 1'  # Weekly scan every Monday at 6 AM UTC
  workflow_dispatch:

jobs:
  codeql-analyze:
    name: analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: ['javascript', 'python']
        # CodeQL supports ['cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby']

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          # Fetch full history for better analysis
          fetch-depth: 0

      # Initializes the CodeQL tools for scanning
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          # Use advanced configuration
          config-file: ./.github/codeql-config.yml
          # Enable debug mode for detailed logs
          debug: true
          # Use latest CodeQL bundle
          tools: latest

      # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java)
      # If this step fails, then you should remove it and run the build manually
      - name: Autobuild
        uses: github/codeql-action/autobuild@v4

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{matrix.language}}"
          # Upload results even if analysis fails
          upload: always
          # Generate SARIF output for external tools
          output: sarif-results

      # Generate security report
      - name: Generate Security Report
        if: always()
        run: |
          echo -e "\033[36m[INFO]\033[0m Generating CodeQL security report..."
          echo "## CodeQL Security Analysis Report" >> $GITHUB_STEP_SUMMARY
          echo "- **Language**: ${{ matrix.language }}" >> $GITHUB_STEP_SUMMARY
          if [ ${{ job.status }} == 'success' ]; then
            echo "- **Status**: \x1b[32m[PASS]\x1b[0m Passed" >> $GITHUB_STEP_SUMMARY
          else
            echo "- **Status**: \x1b[31m[FAIL]\x1b[0m Failed" >> $GITHUB_STEP_SUMMARY
          fi
          echo "- **Timestamp**: $(date -u)" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Analysis Details" >> $GITHUB_STEP_SUMMARY
          echo "- Repository: ${{ github.repository }}" >> $GITHUB_STEP_SUMMARY
          echo "- Branch: ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
          echo "- Commit: ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY