codeql.yml

name: CodeQL

on:
  pull_request:
  push:
    branches:
      - main
  schedule:
    - cron: "23 4 * * 1"

permissions:
  contents: read
  security-events: write
  actions: read

jobs:
  analyse:
    name: Analyse ${{ matrix.language }}
    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || 'self-hosted' }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: javascript-typescript
          - language: go

    steps:
      - name: Reset workspace ownership
        run: |
          docker run --rm -v "$GITHUB_WORKSPACE:/ws" alpine \
            chown -R $(id -u):$(id -g) /ws 2>/dev/null || true

      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Go
        if: matrix.language == 'go'
        uses: actions/setup-go@v6
        with:
          go-version: "1.25"
          cache: false
          cache-dependency-path: |
            agent/go.sum
            apps/ingest/go.sum

      - name: Set up Node.js
        if: matrix.language == 'javascript-typescript'
        uses: actions/setup-node@v6
        with:
          node-version: "20"

      - name: Initialise CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          queries: security-and-quality

      - name: Autobuild
        uses: github/codeql-action/autobuild@v4

      - name: Analyse
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"

      - name: Clean up runner disk
        if: always()
        run: |
          set +e
          docker run --rm -v "$GITHUB_WORKSPACE:/ws" alpine \
            chown -R "$(id -u):$(id -g)" /ws 2>/dev/null || true
          find "$GITHUB_WORKSPACE" -mindepth 1 -delete 2>/dev/null || true
          # CodeQL stores its database under RUNNER_TEMP — remove it so the
          # next matrix leg (or next run) doesn't pay for the old copy.
          rm -rf "${RUNNER_TEMP:-/tmp}/codeql_databases" 2>/dev/null || true
          rm -rf /tmp/digests 2>/dev/null || true
          docker buildx prune -f --filter "until=1h" 2>/dev/null || true
          docker system prune -f --filter "until=1h" 2>/dev/null || true
          exit 0