codeql.yml

name: CodeQL

on:
  schedule:
    # Weekly, offset from the hour to avoid GitHub's cron pileup.
    - cron: "31 4 * * 1"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  analyze:
    if: github.repository == 'thaw-app/Thaw'
    name: Analyze Swift
    # CodeQL traces Swift builds under Rosetta, and macOS 27 ships some
    # build tools (sandbox-exec, swift-plugin-server) as arm64 only.
    runs-on: macos-26
    timeout-minutes: 90
    permissions:
      security-events: write
      contents: read
      actions: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          languages: swift
          build-mode: manual

      - name: Select Xcode 26.6
        run: sudo xcode-select -s /Applications/Xcode_26.6.app/Contents/Developer

      # The Thaw target's lint build phase requires the pinned SwiftLint on PATH.
      - name: Install pinned SwiftLint
        run: |
          sh scripts/install-swiftlint.sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      # CodeQL traces this build to construct the database. Tests are not run;
      # compilation is all the extractor needs.
      - name: Build
        run: |
          set -euo pipefail
          xcodebuild build \
            -project Thaw.xcodeproj \
            -scheme Thaw \
            -derivedDataPath Build/ \
            -destination 'platform=macOS' \
            CODE_SIGN_IDENTITY="" \
            CODE_SIGNING_REQUIRED=NO \
            CODE_SIGNING_ALLOWED=NO

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          category: "/language:swift"