.github/workflows/codeql-analysis.yml

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning

name: "CodeQL"

on:
  push:
    branches: [ trunk, release* ]
    # Changes that cannot affect the analyzed sources (documentation, Docker/IDE/devcontainer
    # setup, Windows-only scripts, other workflows...) don't trigger the analysis: the
    # ubuntu-latest runners are a limited resource shared by all the ASF projects.
    # The weekly scheduled analysis runs anyway.
    # GitHub evaluates these patterns in order, so a later pattern can re-include a path that an
    # earlier "!" pattern excluded.
    paths: &analysis-paths
      - '**'
      - '!**.md'
      - '!**.adoc'
      - '!**/src/docs/**'
      - '!docs/**'
      - '!**.bat'
      - '!APACHE2_HEADER'
      - '!INSTALL'
      - '!LICENSE'
      - '!NOTICE'
      - '!OPTIONAL_LIBRARIES'
      - '!VERSION'
      - '!.asf.yaml'
      - '!.devcontainer/**'
      - '!.dockerignore'
      - '!.gitattributes'
      - '!.gitignore'
      - '!.hgignore'
      - '!.idea/**'
      - '!.pre-commit-config.yaml'
      - '!Dockerfile'
      - '!docker/**'
      - '!.github/**'
      - '.github/workflows/codeql-analysis.yml'
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ trunk, release* ]
    paths: *analysis-paths
  schedule:
    - cron: '27 15 * * 1'

# A new push to a pull request makes its previous, still running or queued analysis useless.
# Pushes to trunk and release* are never cancelled so that every commit gets its own result.
# Each of them gets its own group (run_id): in a shared group a newer run would replace a pending one.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze
    # A Dependabot pull request only changes dependency versions, not the analyzed sources.
    # The push of its merge is analyzed as any other push.
    if: github.event.pull_request.user.login != 'dependabot[bot]'
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'java', 'javascript' ]

    steps:
    - name: Checkout repository
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    # Java is a compiled language: CodeQL extracts it by tracing the compilation,
    # so the sources must be built between the init and analyze steps.
    # The build needs the JDK it targets (see build.gradle), not the runner's default JDK.
    - name: Set up JDK 25
      if: matrix.language == 'java'
      uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
      with:
        java-version: 25
        distribution: temurin

    # The Gradle wrapper jar is not committed and must be downloaded first.
    # Only compilation is needed, so tests and other checks are not run.
    - name: Build with Gradle
      if: matrix.language == 'java'
      run: |
        ./gradle/init-gradle-wrapper.sh
        ./gradlew compileJava compileTestJava

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2