codeql.yml

# CodeQL Security Scanning Workflow for WRAITH Protocol
# Analyzes code for security vulnerabilities and code quality issues
# Documentation: https://docs.github.com/en/code-security/code-scanning

name: "CodeQL Security Scan"

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    # Run weekly on Monday at 09:00 UTC
    - cron: '0 9 * * 1'
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

jobs:
  analyze:
    name: CodeQL Analysis
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      # Required for CodeQL to upload results to GitHub Security tab
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        # CodeQL has experimental Rust support; we'll use it for basic analysis
        # Note: Rust support in CodeQL is limited compared to other languages
        language: ['rust']

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-codeql-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-codeql-
            ${{ runner.os }}-cargo-

      # Initialize CodeQL tools for scanning
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          # Use security-extended query suite for comprehensive security analysis
          queries: security-extended
          # Optional: Add custom queries
          # config-file: ./.github/codeql/codeql-config.yml

      # Build the project (required for compiled languages like Rust)
      # CodeQL needs the build to understand the code structure
      - name: Build project
        run: |
          cargo build --workspace --all-features --release

      # Perform CodeQL Analysis
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"
          # Fail the workflow if high or critical severity issues are found
          # Commented out by default to avoid breaking builds initially
          # fail-on: critical,high

  # Additional Rust-specific security scanning with cargo-audit
  rust-security:
    name: Rust Security Audit
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-audit-${{ hashFiles('**/Cargo.lock') }}

      # Install cargo-audit for RustSec advisory database scanning
      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      # Check for security vulnerabilities in dependencies
      - name: Run cargo audit
        run: cargo audit --deny warnings

      # Check for outdated dependencies with known security issues
      - name: Run cargo outdated
        continue-on-error: true
        run: |
          cargo install cargo-outdated --locked
          cargo outdated --root-deps-only --format json > outdated-deps.json || true

      # Upload results as artifacts for review
      - name: Upload audit results
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: security-audit-results
          path: |
            outdated-deps.json
          retention-days: 30