codeql_analysis.yml

name: "CodeQL"

on:
  push:
    branches:
      - main
      - release-**.0
  schedule:
    - cron: '0 0 * * 1'
  workflow_dispatch:

permissions: read-all

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-24.04
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'go', 'javascript', 'python' ]

    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: 'false'

      - name: Set up Go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version-file: go.mod

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify cu stom queries, you can do so here or in a config file.
          # By default, queries listed here will override any specified in a config file.
          # Prefix the list here with "+" to use these queries and those in the config file.

          # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
          # queries: security-extended,security-and-quality

      - name: Get base dependencies
        run: |
          sudo DEBIAN_FRONTEND="noninteractive" apt-get update
          # Uninstall any previously installed MySQL first
          sudo systemctl stop apparmor
          sudo DEBIAN_FRONTEND="noninteractive" apt-get remove -y --purge mysql-server mysql-client mysql-common
          sudo apt-get -y autoremove
          sudo apt-get -y autoclean
          sudo deluser mysql
          sudo rm -rf /var/lib/mysql
          sudo rm -rf /etc/mysql
          # Install mysql80
          sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys A8D3785C
          wget -c https://dev.mysql.com/get/mysql-apt-config_0.8.33-1_all.deb
          echo mysql-apt-config mysql-apt-config/select-server select mysql-8.0 | sudo debconf-set-selections
          sudo DEBIAN_FRONTEND="noninteractive" dpkg -i mysql-apt-config*
          sudo apt-get update
          sudo DEBIAN_FRONTEND="noninteractive" apt-get install -y mysql-server mysql-client
          # Install everything else we need, and configure
          sudo apt-get install -y make unzip g++ etcd-client etcd-server curl git wget eatmydata
          sudo service mysql stop
          sudo service etcd stop
          sudo bash -c "echo '/usr/sbin/mysqld { }' > /etc/apparmor.d/usr.sbin.mysqld" # https://bugs.launchpad.net/ubuntu/+source/mariadb-10.1/+bug/1806263
          sudo ln -s /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/disable/
          sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld || echo "could not remove mysqld profile"
          
          # install JUnit report formatter
          go install github.com/vitessio/go-junit-report@HEAD
          
      - name: Building binaries
        timeout-minutes: 30
        run: |
          source build.env
          make build

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3

      - name: Slack Workflow Notification
        if: ${{ failure() }}
        uses: Gamesight/slack-workflow-status@master
        with:
          repo_token: ${{secrets.GITHUB_TOKEN}}
          slack_webhook_url: ${{secrets.SLACK_WEBHOOK_URL}}
          channel: '#codeql'
          name: 'CodeQL Workflows'

      - name: Fail if needed
        if: ${{ failure() }}
        run: |
          exit 1