codeql.yml

name: CodeQL Advanced

on:
  push:
    branches: [dev, main]
  pull_request:
    branches: [dev, main]
  schedule:
    - cron: "37 10 * * 5"
  workflow_dispatch:

concurrency:
  group: codeql-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: Check CodeQL scope
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      should_analyze: ${{ steps.scope.outputs.should_analyze }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Determine whether CodeQL should run
        id: scope
        env:
          EVENT_NAME: ${{ github.event_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail

          if [[ "$EVENT_NAME" != "pull_request" && "$EVENT_NAME" != "push" ]]; then
            echo "Scheduled and manually dispatched runs always execute CodeQL."
            echo "should_analyze=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if [[ -z "$BASE_SHA" || "$BASE_SHA" =~ ^0+$ ]]; then
            echo "No usable base commit is available; running CodeQL as a safe fallback."
            echo "should_analyze=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          git cat-file -e "$BASE_SHA^{commit}"
          git cat-file -e "$HEAD_SHA^{commit}"

          mapfile -t changed_files < <(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
          if (( ${#changed_files[@]} == 0 )); then
            echo "No changed files were found; running CodeQL as a safe fallback."
            echo "should_analyze=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          should_analyze=false
          for path in "${changed_files[@]}"; do
            if [[ "$path" == docs/* || "$path" == *.md ]]; then
              continue
            fi

            should_analyze=true
            break
          done

          echo "Changed files: ${#changed_files[@]}"
          echo "should_analyze=$should_analyze" >> "$GITHUB_OUTPUT"

  analyze:
    name: Analyze (swift)
    needs: changes
    if: ${{ !cancelled() }}
    runs-on: xcode-27
    timeout-minutes: 120
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    steps:
      - name: Fail when CodeQL scope detection failed
        if: needs.changes.result != 'success'
        run: exit 1

      - name: Checkout repository
        if: needs.changes.outputs.should_analyze == 'true'
        uses: actions/checkout@v6

      - name: Show build environment
        if: needs.changes.outputs.should_analyze == 'true'
        id: toolchain
        run: |
          xcodebuild -version
          xcrun swiftc --version
          sw_vers -productVersion
          xcode_version="$(xcodebuild -version | awk 'NR == 1 { print $2 }')"
          macos_version="$(sw_vers -productVersion)"

          [[ "$xcode_version" == 27.* ]] || {
            echo "Expected Xcode 27, got $xcode_version"
            exit 1
          }

          [[ "$macos_version" == 27.* ]] || {
            echo "Expected macOS 27, got $macos_version"
            exit 1
          }

          echo "xcode_version=$xcode_version" >> "$GITHUB_OUTPUT"

      - name: Cache Swift package sources
        if: needs.changes.outputs.should_analyze == 'true'
        uses: actions/cache@v5
        with:
          path: ${{ runner.temp }}/swift-package-sources
          key: swiftpm-${{ runner.os }}-${{ runner.arch }}-xcode-${{ steps.toolchain.outputs.xcode_version }}-${{ hashFiles('Easydict.xcworkspace/xcshareddata/swiftpm/Package.resolved') }}
          restore-keys: |
            swiftpm-${{ runner.os }}-${{ runner.arch }}-xcode-${{ steps.toolchain.outputs.xcode_version }}-

      - name: Initialize CodeQL
        if: needs.changes.outputs.should_analyze == 'true'
        uses: github/codeql-action/init@v4
        with:
          languages: swift
          build-mode: manual

      - name: Build application
        if: needs.changes.outputs.should_analyze == 'true'
        # The CodeQL tracer is injected into every build subprocess through DYLD_INSERT_LIBRARIES.
        # On the macOS 27 runner images (> 20260912.0186) it cannot re-spawn the arm64e-only
        # platform binaries in /usr/bin, so the traced build fails with
        # `Bad CPU type in executable (86)` in three places:
        #   1. SwiftPM manifest evaluation (sandbox-exec), which aborts xcodebuild with
        #      "Could not resolve package dependencies" before compiling anything;
        #   2. swift-frontend's nested sandbox for the Swift macro plugin server
        #      (sandbox-exec), which fails with "compiler plugin ... could not be loaded";
        #   3. icon packaging (TiffUtil), which Xcode runs per @2x + @3x PNG pair to build
        #      each hidpi .tiff, failing with "unable to spawn process '/usr/bin/tiffutil'".
        # `-IDEPackageSupportDisableManifestSandbox=1`, `-disable-sandbox`, and
        # `COMBINE_HIDPI_IMAGES=NO` cover (1), (2) and (3) respectively. Only these three
        # workarounds are needed: the other tools this build spawns (touch, ibtool, actool)
        # ship an x86_64 slice and are unaffected. All three are build-only changes that do
        # not affect the sources being analyzed or any shipped artifact; see
        # docs/histories/2026-09/2026-09-25-codeql-swiftpm-manifest-sandbox.md.
        run: |
          xcodebuild build \
            -workspace Easydict.xcworkspace \
            -scheme Easydict \
            -configuration Debug \
            -destination "generic/platform=macOS" \
            -clonedSourcePackagesDirPath "$RUNNER_TEMP/swift-package-sources" \
            -IDEPackageSupportDisableManifestSandbox=1 \
            OTHER_SWIFT_FLAGS='$(inherited) -disable-sandbox' \
            COMBINE_HIDPI_IMAGES=NO \
            ARCHS=arm64 \
            ONLY_ACTIVE_ARCH=YES \
            EASYDICT_RELEASE_PACKAGING=YES \
            CODE_SIGNING_REQUIRED=NO \
            CODE_SIGNING_ALLOWED=NO

      - name: Perform CodeQL analysis
        if: needs.changes.outputs.should_analyze == 'true'
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:swift