codeql.yml

name: "CodeQL"

on:
  push:
    branches: [ "master" ]
  pull_request:
    branches: [ "master" ]
  schedule:
    - cron: '0 6 * * 1'

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ${{ matrix.runner }}
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: python
            runner: ubuntu-latest
          # Swift analysis must run on macOS: WhisperKit depends on CoreML,
          # which is unavailable on Linux runners.
          - language: swift
            runner: macos-15
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Select Xcode
      if: matrix.language == 'swift'
      run: |
        # Need Xcode 16+ (Swift 6 tooling) for swift-jinja 2.x.
        latest=$(ls -d /Applications/Xcode_16*.app 2>/dev/null | sort -V | tail -n 1)
        if [ -n "$latest" ]; then
          sudo xcode-select -s "$latest/Contents/Developer"
        fi

    - name: Generate VersionInfo.swift
      if: matrix.language == 'swift'
      run: |
        # VersionInfo.swift is gitignored; normally produced by scripts/build.sh.
        VERSION=$(tr -d '[:space:]' < VERSION 2>/dev/null || echo "0.0.0")
        GIT_HASH=$(git rev-parse --short HEAD 2>/dev/null || echo "ci-build")
        # BUNDLED_UV_* must be substituted before VERSION_PLACEHOLDER (substring).
        sed -e "s/BUNDLED_UV_VERSION_PLACEHOLDER//g" \
            -e "s/BUNDLED_UV_SHA256_PLACEHOLDER//g" \
            -e "s/VERSION_PLACEHOLDER/$VERSION/g" \
            -e "s/GIT_HASH_PLACEHOLDER/$GIT_HASH/g" \
            -e "s/BUILD_DATE_PLACEHOLDER/$(date -u +%Y-%m-%d)/g" \
            Sources/VersionInfo.swift.template > Sources/Utilities/VersionInfo.swift

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}

    - name: Autobuild
      uses: github/codeql-action/autobuild@v3

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{ matrix.language }}"