codeql-analysis.yml

name: "CodeQL"

on:
  workflow_dispatch:
    inputs:
      debug_mode:
        description: "Enable verbose workflow context logging"
        required: false
        default: false
        type: boolean
  schedule:
    - cron: '26 22 * * 6'

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    if: github.repository == 'meshery/meshery'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: write
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: actions
            build-mode: none
          - language: javascript
            build-mode: none
          - language: go
            build-mode: manual

    steps:
      - name: 🔍 Introspect Inputs
        uses: actions/github-script@v8
        with:
          script: |
            core.startGroup('Workflow Inputs and Context');
            core.info(`debug_mode: ${JSON.stringify(context.payload.inputs?.debug_mode ?? false)}`);
            core.info(`repository: ${context.repo.owner}/${context.repo.repo}`);
            core.info(`event_name: ${context.eventName}`);
            core.info(`actor: ${context.actor}`);
            core.info(`ref: ${context.ref}`);
            core.info(`sha: ${context.sha}`);
            core.info(`run_id: ${context.runId}`);
            core.info(`language: ${process.env.CODEQL_LANGUAGE}`);
            core.endGroup();
        env:
          CODEQL_LANGUAGE: ${{ matrix.language }}

      - name: Checkout repository
        uses: actions/checkout@v6

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          config-file: ./.github/codeql-config.yml
          build-mode: ${{ matrix.build-mode }}
      
      - name: Build Go
        if: matrix.language == 'go'
        run: |
          go build -v ./...

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4

      - name: Comment on associated pull requests when analysis fails
        if: failure()
        uses: actions/github-script@v8
        env:
          CODEQL_LANGUAGE: ${{ matrix.language }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        with:
          script: |
            const { owner, repo } = context.repo;
            const associatedPullRequests = await github.paginate(
              github.rest.repos.listPullRequestsAssociatedWithCommit,
              {
                owner,
                repo,
                commit_sha: context.sha,
              },
            );

            const openPullRequests = associatedPullRequests.filter((pullRequest) => pullRequest.state === 'open');
            if (!openPullRequests.length) {
              core.info('No associated open pull requests found for this commit.');
              return;
            }

            const body = [
              `⚠️ CodeQL analysis failed for \`${process.env.CODEQL_LANGUAGE}\` on \`${context.sha.slice(0, 7)}\`.`,
              '',
              `- Workflow: ${context.workflow}`,
              `- Event: ${context.eventName}`,
              `- Actor: ${context.actor}`,
              `- Run: ${process.env.RUN_URL}`,
            ].join('\n');

            for (const pullRequest of openPullRequests) {
              await github.rest.issues.createComment({
                owner,
                repo,
                issue_number: pullRequest.number,
                body,
              });
            }

      - name: 🚨 Email Alert on Failure
        # 1. Map the secrets to environment variables first
        env: 
          MAIL_USER: ${{ secrets.MAIL_USERNAME }}
          MAIL_PASS: ${{ secrets.MAIL_PASSWORD }}
        # 2. Check the 'env' context instead of the 'secrets' context
        if: failure() && env.MAIL_USER != '' && env.MAIL_PASS != ''
        uses: dawidd6/action-send-mail@v7
        with:
          server_address: smtp.gmail.com
          server_port: 465
          secure: true
          username: ${{ secrets.MAIL_USERNAME }}
          password: ${{ secrets.MAIL_PASSWORD }}
          subject: "Workflow Failed: ${{ github.workflow }} (${{ matrix.language }})"
          from: '"Meshery" <no-reply@meshery.io>'
          to: maintainers@meshery.io
          body: |
            Repository: ${{ github.repository }}
            Workflow: ${{ github.workflow }}
            Job: ${{ github.job }}
            Language: ${{ matrix.language }}
            Event: ${{ github.event_name }}
            Actor: ${{ github.actor }}
            Run URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}