codeql.yml

name: CodeQL

on: 
  workflow_dispatch:
  schedule:
    # Run at the end of every day from Monday to Friday
    - cron: '0 0 * * 1-5'

jobs:
  analyze:
    name: Analyze
    runs-on: ${{ matrix.config.runner }}
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        config:
          - runner: ubuntu-24.04
            language: 'actions'
          - runner: ubuntu-24.04
            language: 'go'
          - runner: ${{ vars.PROXY_BUILD_GITHUB_RUNNER }}
            language: 'cpp'
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Initialize CodeQL
        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
        with:
          languages: ${{ matrix.config.language }}

      - name: Install deps (for C++)
        if: matrix.config.language == 'cpp'
        shell: bash
        run: |
          sudo apt-get update --error-on=any
          sudo apt-get install --yes \
          libtool automake autoconf curl unzip

      - name: Build (for C++)
        if: matrix.config.language == 'cpp'
        run: |
          bazelisk shutdown
          bazel build \
          -c fastbuild \
          --spawn_strategy=local \
          --discard_analysis_cache \
          --nouse_action_cache \
          --features="-layering_check" \
          --noshow_progress \
          --noshow_loading_progress \
          //:cilium-envoy

      - name: Autobuild
        if: matrix.config.language != 'cpp'
        uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
        with:
          category: '/language:${{matrix.config.language}}'
          output: sarif-output-${{ matrix.config.language }}.sarif
      - name: Filter SARIF Results
        run: |
          REPO_URL="https://github.com/${{ github.repository }}/blob/${{ github.ref_name }}/"
          jq --arg baseUrl "$REPO_URL" '[.runs[].results[] |
            {
              ruleId: .ruleId,
              message: .message.text,
              url: "\($baseUrl)\(.locations[0].physicalLocation.artifactLocation.uri)#L\(.locations[0].physicalLocation.region.startLine)\(if .locations[0].physicalLocation.region.endLine != null then "-L\(.locations[0].physicalLocation.region.endLine)" else "" end)"
            }]' sarif-output-${{ matrix.config.language }}.sarif/${{ matrix.config.language }}.sarif > filtered-${{ matrix.config.language }}.json
      - name: Display Filtered Results
        run: cat filtered-${{ matrix.config.language }}.json
      - name: Send Slack Notification
        env:
          SEC_BOT_SLACK_WEBHOOK: ${{ secrets.SEC_BOT_SLACK_WEBHOOK }}
          CHANNEL: "#security-team"
        run: |
          jq -c '.[]' filtered-${{ matrix.config.language }}.json | while read -r item; do
            RULE_ID=$(echo "$item" | jq -r '.ruleId')
            MESSAGE=$(echo "$item" | jq -r '.message')
            URL=$(echo "$item" | jq -r '.url')

            PAYLOAD=$(cat <<EOF
          {
            "channel": "$CHANNEL",
            "blocks": [
              {
                "type": "header",
                "text": {
                  "type": "plain_text",
                  "text": "🚨 CodeQL Alert for ${{ matrix.config.language }} 🚨",
                  "emoji": true
                }
              },
              {
                "type": "section",
                "text": {
                  "type": "mrkdwn",
                  "text": "*Rule:* $RULE_ID"
                }
              },
              {
                "type": "section",
                "text": {
                  "type": "mrkdwn",
                  "text": "*Message:* $MESSAGE"
                }
              },
              {
                "type": "section",
                "text": {
                  "type": "mrkdwn",
                  "text": "*File:* $URL"
                }
              }
            ]
          }
          EOF
            )

            curl -X POST -H "Authorization: Bearer $SEC_BOT_SLACK_WEBHOOK" \
                  -H "Content-type: application/json" \
                  --data-raw "$PAYLOAD" https://slack.com/api/chat.postMessage
          done