name: "CodeQL Security Scanning"

# GitHub's CodeQL security analysis for vulnerability detection
# Runs on push to main branches and PRs, plus weekly scheduled scans
# Results appear in Security > Code scanning alerts

on:
  push:
    branches:
      - main
      - develop
      - 'release/**'
      - 'hotfix/**'
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - 'examples/**'
      - 'LICENSE'
      - '.gitignore'
  pull_request:
    branches:
      - main
      - develop
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - 'examples/**'
      - 'LICENSE'
      - '.gitignore'
  schedule:
    # Run weekly scan on Mondays at 6:00 UTC
    - cron: '0 6 * * 1'
  workflow_dispatch:
    # Allow manual trigger from Actions tab

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: Detect language changes
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      python: ${{ steps.filter.outputs.python }}
      go: ${{ steps.filter.outputs.go }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Detect changed paths
        id: filter
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        with:
          filters: |
            python:
              - 'souschef/**'
              - 'tests/**'
              - 'pyproject.toml'
              - 'poetry.lock'
              - '.github/codeql-config.yml'
              - '.github/workflows/codeql.yml'
            go:
              - 'terraform-provider/**'
              - 'go.work'
              - '.github/codeql-config.yml'
              - '.github/workflows/codeql.yml'

  analyze:
    name: Analyze ${{ matrix.language }} Code
    needs: changes
    if: >-
      github.event_name == 'schedule' ||
      github.event_name == 'workflow_dispatch' ||
      needs.changes.outputs.python == 'true' ||
      needs.changes.outputs.go == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      security-events: write
      actions: read

    strategy:
      fail-fast: false
      matrix:
        language: [python, go]

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Go
        if: matrix.language == 'go'
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v5
        with:
          go-version-file: 'go.work'
          cache-dependency-path: terraform-provider/go.sum

      - name: Initialize CodeQL
        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
        with:
          languages: ${{ matrix.language }}
          # Use default queries plus security-extended for more comprehensive scanning
          queries: +security-extended,security-and-quality
          # Config file includes custom model extensions
          config-file: ./.github/codeql-config.yml

      - name: Set up Python
        if: matrix.language == 'python'
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.13"
          cache: 'pip'

      - name: Install Poetry
        if: matrix.language == 'python'
        run: |
          pipx install poetry
          poetry config virtualenvs.in-project true

      - name: Install dependencies
        if: matrix.language == 'python'
        run: |
          poetry install --no-interaction --no-root

      - name: Build Go
        if: matrix.language == 'go'
        working-directory: terraform-provider
        run: go build ./...

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4
        with:
          category: "/language:${{ matrix.language }}"
          # Upload results even if there are findings
          upload: always
          # Output SARIF file for artifact upload
          output: sarif-results

      - name: Upload SARIF as artifact
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: codeql-sarif-results-${{ matrix.language }}
          path: sarif-results
          retention-days: 30

      - name: Check for critical findings
        if: always()
        run: |
          echo "CodeQL analysis complete. Check Security > Code scanning alerts for results."
          echo "Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
