codeql.yml

# Copyright 2018-2026 contributors to the OpenLineage project
# SPDX-License-Identifier: Apache-2.0
#
# Overrides GitHub Default Setup with a dynamic language matrix: only languages
# that have source files in the repository are scanned. This prevents false
# failures when CodeQL is configured for a language (e.g. Go) that has no
# corresponding source code.
name: "CodeQL"

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  schedule:
    - cron: "30 1 * * 0"

permissions:
  contents: read

# Cancel any in-progress run for the same ref to avoid concurrent SARIF uploads
# conflicting with each other or with GitHub's Default Setup.
concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  detect-languages:
    name: Detect languages
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.detect.outputs.matrix }}
    steps:
      - uses: actions/checkout@v4

      - name: Detect CodeQL-supported languages present in repo
        id: detect
        shell: bash
        run: |
          includes=()

          # GitHub Actions workflows (always present if the .github/workflows dir exists)
          actions_files=$(find .github/workflows -name '*.yml' -print -quit 2>/dev/null)
          [ -n "$actions_files" ] && includes+=('{"language":"actions","build-mode":"none"}')

          # Go — excluded: CodeQL's autobuild fails to extract Go source code for
          # this project ("no Go source code written") regardless of whether
          # client/go/ is present. Re-enable once the Go module is compatible
          # with CodeQL autobuild (see GitHub's troubleshooting guide for details).
          # go_files=$(find . -not -path './.git/*' -name '*.go' -print -quit 2>/dev/null)
          # [ -n "$go_files" ] && includes+=('{"language":"go","build-mode":"autobuild"}')

          # Java/Kotlin — excluded: autobuild cannot handle OpenLineage's Gradle project
          # without custom build steps. Add manual build steps here if Java scanning
          # is needed in the future.

          py_files=$(find . -not -path './.git/*' -name '*.py' -print -quit 2>/dev/null)
          [ -n "$py_files" ] && includes+=('{"language":"python","build-mode":"none"}')

          js_files=$(find . -not -path './.git/*' \( -name '*.js' -o -name '*.ts' \) -print -quit 2>/dev/null)
          [ -n "$js_files" ] && includes+=('{"language":"javascript-typescript","build-mode":"none"}')

          rb_files=$(find . -not -path './.git/*' -name '*.rb' -print -quit 2>/dev/null)
          [ -n "$rb_files" ] && includes+=('{"language":"ruby","build-mode":"none"}')

          matrix='{"include":['
          for i in "${!includes[@]}"; do
            [ "$i" -gt 0 ] && matrix+=','
            matrix+="${includes[$i]}"
          done
          matrix+=']}'

          echo "Detected languages: $matrix"
          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"

  analyze:
    name: Analyze (${{ matrix.language }})
    needs: detect-languages
    if: ${{ needs.detect-languages.outputs.matrix != '{"include":[]}' }}
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.detect-languages.outputs.matrix) }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"