codeql.yml

name: CodeQL Security Scanning

on:
  pull_request:
    branches:
      - main
      - develop
  push:
    branches:
      - main
      - develop
  schedule:
    - cron: '0 6 * * 1' # Weekly Monday 06:00 UTC

permissions:
  contents: read
  security-events: write
  actions: read

jobs:
  analyze-rust:
    name: CodeQL (Rust)
    runs-on: ubuntu-latest
    if: >-
      github.event_name == 'schedule' ||
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' &&
       (github.event.pull_request.base.ref == 'main' || github.event.pull_request.base.ref == 'develop'))

    strategy:
      fail-fast: false
      matrix:
        language: ['rust']

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          config: |
            paths:
              - contracts/
            paths-ignore:
              - contracts/mock-strategy/
              - contracts/vault/src/test.rs
              - contracts/vault/src/fuzz_math.rs
              - contracts/vault/src/*_tests.rs
            query-filters:
              - exclude:
                  id: rust/unsafe-cast

      # The trailing `|| true` used to swallow every build failure, which is how
      # a non-compiling vault reached main unnoticed. The wasm32 build is
      # expected to fail for the vault (blocked upstream by DataKey
      # contracttype limits), so fall back to the host build -- and let that
      # failure fail the job, as a genuine compile error should.
      - name: Build Rust contracts
        run: |
          cargo build --release --target wasm32-unknown-unknown -p mock-strategy || \
          cargo build --release -p vault
        working-directory: contracts
        env:
          RUSTFLAGS: "-C link-arg=-s"

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"
          output: rust-results

      - name: Upload Rust security artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: codeql-rust-results
          path: rust-results/
          retention-days: 90

  analyze-typescript:
    name: CodeQL (TypeScript)
    runs-on: ubuntu-latest
    if: >-
      github.event_name == 'schedule' ||
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' &&
       (github.event.pull_request.base.ref == 'main' || github.event.pull_request.base.ref == 'develop'))

    strategy:
      fail-fast: false
      matrix:
        language: ['typescript']

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: npm
          cache-dependency-path: |
            backend/package-lock.json
            frontend/package-lock.json
            packages/api-schemas/package-lock.json

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          config: |
            paths:
              - frontend/src/
              - backend/src/
              - packages/api-schemas/
            paths-ignore:
              - '**/*.test.ts'
              - '**/*.test.tsx'
              - '**/*.spec.ts'
              - '**/*.spec.tsx'
              - '**/node_modules/'

      - name: Install backend dependencies
        run: npm ci
        working-directory: backend

      - name: Install frontend dependencies
        run: npm ci
        working-directory: frontend

      - name: Build shared API schemas
        run: npm ci && npm run build
        working-directory: packages/api-schemas

      - name: Autobuild
        uses: github/codeql-action/autobuild@v3

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"
          output: ts-results

      - name: Upload TypeScript security artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: codeql-typescript-results
          path: ts-results/
          retention-days: 90

  security-review:
    name: Security Review Summary
    runs-on: ubuntu-latest
    needs: [analyze-rust, analyze-typescript]
    if: always()

    steps:
      - name: Download all CodeQL artifacts
        uses: actions/download-artifact@v4
        with:
          path: all-results/
          pattern: codeql-*-results
          merge-multiple: true

      - name: Generate security review summary
        run: |
          echo "## CodeQL Security Scan Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Scan completed at:** $(date -u '+%Y-%m-%d %H:%M:%S UTC')" >> $GITHUB_STEP_SUMMARY
          echo "**Triggered by:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
          echo "**Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Rust Contracts" >> $GITHUB_STEP_SUMMARY
          if [ -d "all-results/rust-results" ]; then
            echo "Results available in CodeQL security tab." >> $GITHUB_STEP_SUMMARY
          else
            echo "No Rust results generated." >> $GITHUB_STEP_SUMMARY
          fi
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### TypeScript (Frontend + Backend)" >> $GITHUB_STEP_SUMMARY
          if [ -d "all-results/ts-results" ]; then
            echo "Results available in CodeQL security tab." >> $GITHUB_STEP_SUMMARY
          else
            echo "No TypeScript results generated." >> $GITHUB_STEP_SUMMARY
          fi
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Next Steps" >> $GITHUB_STEP_SUMMARY
          echo "1. Review any alerts in the GitHub Security tab" >> $GITHUB_STEP_SUMMARY
          echo "2. Triage findings by severity (error > warning > note)" >> $GITHUB_STEP_SUMMARY
          echo "3. Address critical/high findings before merge" >> $GITHUB_STEP_SUMMARY

      - name: Notify Slack on security findings
        if: failure()
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SECURITY_SLACK_WEBHOOK_URL }}
        run: |
          if [ -z "$SLACK_WEBHOOK_URL" ]; then
            echo "SECURITY_SLACK_WEBHOOK_URL secret not set; skipping notification."
            exit 0
          fi
          text="🔍 CodeQL scan completed on *${GITHUB_REPOSITORY}* (${GITHUB_REF_NAME}). Review security findings in the GitHub Security tab."
          payload=$(jq -n --arg text "$text" '{text: $text}')
          curl --fail --silent --show-error -X POST \
            -H "Content-Type: application/json" \
            --data "$payload" \
            "$SLACK_WEBHOOK_URL"