codeql.yml

name: CodeQL

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  schedule:
    - cron: "23 4 * * 1"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    env:
      TMPDIR: ${{ github.workspace }}/tmp
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        # The Actions extractor also analyzes Bash embedded in workflow `run:`
        # steps. CodeQL does not provide a standalone Bash language extractor.
        language:
          - rust
          - actions
          - python
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare workspace temp directory
        run: mkdir -p "$TMPDIR"

      # The runner image stopped shipping `zstd`, which the pinned bundle below
      # needs: `tar --zstd ...` dies with "zstd: Cannot exec: No such file or
      # directory" and every Analyze job fails in Initialize CodeQL before a
      # single line is analyzed.
      - name: Ensure zstd can unpack the CodeQL bundle
        run: sudo apt-get update -qq && sudo apt-get install -y -qq zstd

      - name: Initialize CodeQL
        id: init
        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
        with:
          # CodeQL 2.26.4 regresses Rust analysis enough to terminate the hosted runner.
          # Remove this pin after https://github.com/github/codeql/issues/22463 is fixed.
          tools: https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.26.3/codeql-bundle-linux64.tar.zst
          languages: ${{ matrix.language }}
          build-mode: none

      # Analysis and upload are separate steps. The Rust extractor (build-mode
      # none, bundle 2.26.3) reports "macro expansion failed for 'X'" for
      # almost every core/alloc/dependency macro call in this tree (174,799
      # sites on 86660dd99b; only std's own macro_rules expand) and writes one
      # toolExecutionNotification per site into the SARIF: 446,259
      # notifications next to 42 results, 265 MB raw / 5 MB gzipped. Since
      # 2026-10-31 the code-scanning endpoint answers HTTP 504 after ~20 s on
      # that payload (the same shape uploaded in 11 s on 2026-10-30). Installing
      # the toolchain's rust-src component changed nothing (identical per-file
      # counts), so the notifications are stripped before upload: the alerts
      # are unaffected, the Analyze step log keeps every WARN line, and the
      # counts are printed below. The retry cannot use the upload-sarif action
      # (one upload per job per category), so the attempts go through the
      # CodeQL CLI the init step installed; the SARIF carries the category set
      # by analyze.
      - name: Analyze
        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
        with:
          category: /language:${{ matrix.language }}
          upload: never
          output: ${{ runner.temp }}/codeql-sarif

      - name: Upload SARIF (results only, up to three attempts)
        env:
          CODEQL: ${{ steps.init.outputs.codeql-path }}
          SARIF: ${{ runner.temp }}/codeql-sarif/${{ matrix.language }}.sarif
          UPLOAD: ${{ runner.temp }}/codeql-sarif/${{ matrix.language }}.results.sarif
          GH_TOKEN: ${{ github.token }}
        run: |
          set -u
          ls -l "$(dirname "$SARIF")"
          printf 'sarif bytes=%s gzip=%s\n' "$(stat -c %s "$SARIF")" "$(gzip -c "$SARIF" | wc -c)"
          jq -r '"sarif results=\([.runs[].results[]] | length) extractor-notifications=\([.runs[].invocations[]?.toolExecutionNotifications[]?] | length)"' "$SARIF"
          # Results only: the extractor's per-site notifications stay in the
          # Analyze step log and are not uploaded (see the comment above).
          jq -c 'del(.runs[].invocations[]?.toolExecutionNotifications)' "$SARIF" > "$UPLOAD"
          printf 'upload bytes=%s gzip=%s\n' "$(stat -c %s "$UPLOAD")" "$(gzip -c "$UPLOAD" | wc -c)"
          for attempt in 1 2 3; do
            if printf '%s' "$GH_TOKEN" | "$CODEQL" github upload-results \
                 --repository="$GITHUB_REPOSITORY" --ref="$GITHUB_REF" --commit="$GITHUB_SHA" \
                 --sarif="$UPLOAD" --github-auth-stdin; then
              echo "upload attempt $attempt succeeded"; exit 0
            fi
            echo "upload attempt $attempt failed"
            [ "$attempt" -lt 3 ] && sleep $((attempt * 120))
          done
          exit 1