.github/workflows/codeql.yml - beam - Git at Google

 # Licensed to the Apache Software Foundation (ASF) under one or more
 # contributor license agreements.  See the NOTICE file distributed with
 # this work for additional information regarding copyright ownership.
 # The ASF licenses this file to You under the Apache License, Version 2.0
 # (the "License"); you may not use this file except in compliance with
 # the License.  You may obtain a copy of the License at
 #
 #     http://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.

 # Enables code scanning alerts in repo.

 name: "CodeQL Advanced"

 on:
   push:
     branches: [ "master" ]
   pull_request:
     branches: [ "master" ]
   workflow_dispatch:
   schedule:
     - cron: '25 10 * * 6'

 jobs:
   detect-changes:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: read
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
       - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d
         id: filter
         with:
           filters: |
             actions:
               - '.github/**'
             go:
               - '**/*.go'
               - '**/go.mod'
               - '**/go.sum'
             java-kotlin:
               - '**/*.java'
               - '**/*.kt'
               - '**/*.gradle'
               - '**/gradle.properties'
               - '**/gradlew'
               - '**/gradlew.bat'
             javascript-typescript:
               - '**/*.js'
               - '**/*.ts'
               - '**/package.json'
               - '**/package-lock.json'
               - '**/tsconfig.json'
             python:
               - '**/*.py'
               - '**/*.pyx'
               - '**/setup.py'
               - '**/setup.cfg'
               - '**/pyproject.toml'
               - '**/*requirements.txt'
             rust:
               - '**/*.rs'

       - name: Generate Matrix
         id: set-matrix
         run: |
           # Full matrix of all CodeQL supported languages and their build modes in Apache Beam.
           ALL_MATRIX='[
             {"language": "actions", "build-mode": "none"},
             {"language": "go", "build-mode": "manual"},
             {"language": "java-kotlin", "build-mode": "autobuild"},
             {"language": "javascript-typescript", "build-mode": "none"},
             {"language": "python", "build-mode": "none"},
             {"language": "rust", "build-mode": "none"}
           ]'

           # On periodic scheduled runs (cron) or manual dispatches, scan all languages.
           if [[ "${{ github.event_name }}" == "schedule" || "${{ github.event_name }}" == "workflow_dispatch" ]]; then
             COMPACT_ALL=$(echo "$ALL_MATRIX" | jq -c .)
             echo "matrix=$COMPACT_ALL" >> $GITHUB_OUTPUT
           else
             # Filter ALL_MATRIX entries keeping only entries for languages with path changes.
             FILTERED=$(echo "$ALL_MATRIX" | jq -c '[.[] | select(
               (.language == "actions" and "${{ steps.filter.outputs.actions }}" == "true") or
               (.language == "go" and "${{ steps.filter.outputs.go }}" == "true") or
               (.language == "java-kotlin" and "${{ steps.filter.outputs['java-kotlin'] }}" == "true") or
               (.language == "javascript-typescript" and "${{ steps.filter.outputs['javascript-typescript'] }}" == "true") or
               (.language == "python" and "${{ steps.filter.outputs.python }}" == "true") or
               (.language == "rust" and "${{ steps.filter.outputs.rust }}" == "true")
             )]')
             echo "matrix=$FILTERED" >> $GITHUB_OUTPUT
           fi

   analyze:
     name: Analyze (${{ matrix.language }})
     needs: detect-changes
     if: needs.detect-changes.outputs.matrix != '[]'
     # Runner size impacts CodeQL analysis time. To learn more, please see:
     #   - https://gh.io/recommended-hardware-resources-for-running-codeql
     #   - https://gh.io/supported-runners-and-hardware-resources
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
     permissions:
       # required for all workflows
       security-events: write

       # required to fetch internal or private CodeQL packs
       packages: read

       # only required for workflows in private repositories
       actions: read
       contents: read

     strategy:
       fail-fast: false
       matrix:
         include: ${{ fromJSON(needs.detect-changes.outputs.matrix) }}
         # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
         # Use `c-cpp` to analyze code written in C, C++ or both
         # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
         # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
         # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
         # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
         # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
       uses: actions/checkout@v7
       with:
         persist-credentials: false

     - name: Set up Go
       if: matrix.language == 'go'
       uses: actions/setup-go@v7
       with:
         go-version-file: 'sdks/go.mod'

     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
     # or others). This is typically only required for manual builds.
     # - name: Setup runtime (example)
     #   uses: actions/setup-example@v1

     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
         # If you wish to specify custom queries, you can do so here or in a config file.
         # By default, queries listed here will override any specified in a config file.
         # Prefix the list here with "+" to use these queries and those in the config file.

         # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
         # queries: security-extended,security-and-quality

     # If the analyze step fails for one of the languages you are analyzing with
     # "We were unable to automatically build your code", modify the matrix above
     # to set the build mode to "manual" for that language. Then modify this step
     # to build your code.
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
     - name: Run manual build steps
       if: matrix.build-mode == 'manual'
       shell: bash
       run: |
         if [ "${{ matrix.language }}" = "go" ]; then
           echo "Building sdks module..."
           (cd sdks && go build ./...)

           echo "Building playground/backend module..."
           (cd playground/backend && go build ./...)

           echo "Building learning/katas/go module..."
           (cd learning/katas/go && go mod tidy && go build ./...)

           echo "Building learning/tour-of-beam/backend module..."
           (cd learning/tour-of-beam/backend && go build ./cmd/... ./internal/... ./playground_api/...)
         else
           echo "No manual build steps defined for ${{ matrix.language }}"
           exit 1
         fi

     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v4
       with:
         category: "/language:${{matrix.language}}"
	# Licensed to the Apache Software Foundation (ASF) under one or more
	# contributor license agreements. See the NOTICE file distributed with
	# this work for additional information regarding copyright ownership.
	# The ASF licenses this file to You under the Apache License, Version 2.0
	# (the "License"); you may not use this file except in compliance with
	# the License. You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	# Enables code scanning alerts in repo.

	name: "CodeQL Advanced"

	on:
	push:
	branches: [ "master" ]
	pull_request:
	branches: [ "master" ]
	workflow_dispatch:
	schedule:
	- cron: '25 10 * * 6'

	jobs:
	detect-changes:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	pull-requests: read
	outputs:
	matrix: ${{ steps.set-matrix.outputs.matrix }}
	steps:
	- name: Checkout repository
	uses: actions/checkout@v7
	- uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d
	id: filter
	with:
	filters: \|
	actions:
	- '.github/**'
	go:
	- '*/.go'
	- '**/go.mod'
	- '**/go.sum'
	java-kotlin:
	- '*/.java'
	- '*/.kt'
	- '*/.gradle'
	- '**/gradle.properties'
	- '**/gradlew'
	- '**/gradlew.bat'
	javascript-typescript:
	- '*/.js'
	- '*/.ts'
	- '**/package.json'
	- '**/package-lock.json'
	- '**/tsconfig.json'
	python:
	- '*/.py'
	- '*/.pyx'
	- '**/setup.py'
	- '**/setup.cfg'
	- '**/pyproject.toml'
	- '*/requirements.txt'
	rust:
	- '*/.rs'

	- name: Generate Matrix
	id: set-matrix
	run: \|
	# Full matrix of all CodeQL supported languages and their build modes in Apache Beam.
	ALL_MATRIX='[
	{"language": "actions", "build-mode": "none"},
	{"language": "go", "build-mode": "manual"},
	{"language": "java-kotlin", "build-mode": "autobuild"},
	{"language": "javascript-typescript", "build-mode": "none"},
	{"language": "python", "build-mode": "none"},
	{"language": "rust", "build-mode": "none"}
	]'

	# On periodic scheduled runs (cron) or manual dispatches, scan all languages.
	if [[ "${{ github.event_name }}" == "schedule" \|\| "${{ github.event_name }}" == "workflow_dispatch" ]]; then
	COMPACT_ALL=$(echo "$ALL_MATRIX" \| jq -c .)
	echo "matrix=$COMPACT_ALL" >> $GITHUB_OUTPUT
	else
	# Filter ALL_MATRIX entries keeping only entries for languages with path changes.
	FILTERED=$(echo "$ALL_MATRIX" \| jq -c '[.[] \| select(
	(.language == "actions" and "${{ steps.filter.outputs.actions }}" == "true") or
	(.language == "go" and "${{ steps.filter.outputs.go }}" == "true") or
	(.language == "java-kotlin" and "${{ steps.filter.outputs['java-kotlin'] }}" == "true") or
	(.language == "javascript-typescript" and "${{ steps.filter.outputs['javascript-typescript'] }}" == "true") or
	(.language == "python" and "${{ steps.filter.outputs.python }}" == "true") or
	(.language == "rust" and "${{ steps.filter.outputs.rust }}" == "true")
	)]')
	echo "matrix=$FILTERED" >> $GITHUB_OUTPUT
	fi

	analyze:
	name: Analyze (${{ matrix.language }})
	needs: detect-changes
	if: needs.detect-changes.outputs.matrix != '[]'
	# Runner size impacts CodeQL analysis time. To learn more, please see:
	# - https://gh.io/recommended-hardware-resources-for-running-codeql
	# - https://gh.io/supported-runners-and-hardware-resources
	# - https://gh.io/using-larger-runners (GitHub.com only)
	# Consider using larger runners or machines with greater resources for possible analysis time improvements.
	runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') \|\| 'ubuntu-latest' }}
	permissions:
	# required for all workflows
	security-events: write

	# required to fetch internal or private CodeQL packs
	packages: read

	# only required for workflows in private repositories
	actions: read
	contents: read

	strategy:
	fail-fast: false
	matrix:
	include: ${{ fromJSON(needs.detect-changes.outputs.matrix) }}
	# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
	# Use `c-cpp` to analyze code written in C, C++ or both
	# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
	# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
	# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
	# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
	# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
	# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
	steps:
	- name: Checkout repository
	uses: actions/checkout@v7
	with:
	persist-credentials: false

	- name: Set up Go
	if: matrix.language == 'go'
	uses: actions/setup-go@v7
	with:
	go-version-file: 'sdks/go.mod'

	# Add any setup steps before running the `github/codeql-action/init` action.
	# This includes steps like installing compilers or runtimes (`actions/setup-node`
	# or others). This is typically only required for manual builds.
	# - name: Setup runtime (example)
	# uses: actions/setup-example@v1

	# Initializes the CodeQL tools for scanning.
	- name: Initialize CodeQL
	uses: github/codeql-action/init@v4
	with:
	languages: ${{ matrix.language }}
	build-mode: ${{ matrix.build-mode }}
	# If you wish to specify custom queries, you can do so here or in a config file.
	# By default, queries listed here will override any specified in a config file.
	# Prefix the list here with "+" to use these queries and those in the config file.

	# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
	# queries: security-extended,security-and-quality

	# If the analyze step fails for one of the languages you are analyzing with
	# "We were unable to automatically build your code", modify the matrix above
	# to set the build mode to "manual" for that language. Then modify this step
	# to build your code.
	# ℹ️ Command-line programs to run using the OS shell.
	# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
	- name: Run manual build steps
	if: matrix.build-mode == 'manual'
	shell: bash
	run: \|
	if [ "${{ matrix.language }}" = "go" ]; then
	echo "Building sdks module..."
	(cd sdks && go build ./...)

	echo "Building playground/backend module..."
	(cd playground/backend && go build ./...)

	echo "Building learning/katas/go module..."
	(cd learning/katas/go && go mod tidy && go build ./...)

	echo "Building learning/tour-of-beam/backend module..."
	(cd learning/tour-of-beam/backend && go build ./cmd/... ./internal/... ./playground_api/...)
	else
	echo "No manual build steps defined for ${{ matrix.language }}"
	exit 1
	fi

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v4
	with:
	category: "/language:${{matrix.language}}"