codeql-pr.yml

name: "CodeQL PR"

on:
  pull_request:
    branches: [ "main" ]
    types: [ opened, ready_for_review, synchronize ]
    paths:
      - '**/*.js'
      - '**/*.jsx'
      - '**/*.ts'
      - '**/*.tsx'
      - '**/*.mjs'
      - '**/*.cjs'
      - '.github/codeql/**'

jobs:

  check-permissions:
    name: Check author permissions
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      is_authorized: ${{ steps.check.outputs.is_authorized }}
    steps:
    - name: Check author repository permission
      id: check
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
      with:
        github-token: ${{ github.token }}
        script: |
          const allowed = ['admin', 'maintain', 'write'];
          const username = context.payload.pull_request.user.login;
          try {
            const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
              owner: context.repo.owner,
              repo: context.repo.repo,
              username,
            });
            const authorized = allowed.includes(data.permission) || allowed.includes(data.role_name);
            core.info(`Author '${username}' permission='${data.permission}' role_name='${data.role_name}' authorized=${authorized}`);
            core.setOutput('is_authorized', String(authorized));
          } catch (error) {
            if (error.status === 404) {
              core.info(`Author '${username}' is not a collaborator; treating as unauthorized.`);
              core.setOutput('is_authorized', 'false');
              return;
            }
            core.setFailed(`Unable to resolve permission for '${username}': ${error.message}`);
          }

  test:
    name: Test CodeQL queries
    runs-on: ubuntu-latest
    needs: check-permissions
    if: |
      (needs.check-permissions.outputs.is_authorized == 'true'
        && github.event.pull_request.user.type != 'Bot'
        && github.event.pull_request.draft == false
      )
    permissions:
      contents: read

    steps:
    - name: Checkout repository
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    - name: Initialize CodeQL
      uses: github/codeql-action/init@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
      with:
        languages: javascript

    - name: Run CodeQL unit tests
      run: |
        set -euo pipefail
        CODEQL_VERSION=$(ls ${{ runner.tool_cache }}/CodeQL | grep -E '^[0-9]' | head -1)
        export PATH="${{ runner.tool_cache }}/CodeQL/$CODEQL_VERSION/x64/codeql:$PATH"
        # Find all unique test directories containing .qlref files
        mapfile -t TEST_DIRS < <(find .github/codeql/custom-queries -name "*.qlref" -exec dirname {} \; | sort -u)
        if [ "${#TEST_DIRS[@]}" -eq 0 ]; then
          echo "No test directories with .qlref files found. Failing the workflow."
          exit 1
        fi
        for testdir in "${TEST_DIRS[@]}"; do
          echo "Running CodeQL tests in $testdir"
          codeql test run "$testdir" --additional-packs .github/codeql/custom-queries
        done

  analyze:
    name: Analyze javascript
    runs-on: kibana
    needs: check-permissions
    if: |
      (needs.check-permissions.outputs.is_authorized == 'true'
        && github.event.pull_request.user.type != 'Bot'
        && github.event.pull_request.draft == false
      )
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        language: [ 'javascript' ]
    steps:
    - name: Checkout repository
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    - name: Initialize CodeQL
      uses: github/codeql-action/init@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
      with:
        languages: ${{ matrix.language }}
        config-file: ./.github/codeql/codeql-config.yml
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
      env:
        CODEQL_EXTRACTOR_JAVASCRIPT_OPTION_SKIP_TYPES: true
      with:
        category: "/language:${{matrix.language}}"
        wait-for-processing: true