rust-clippy.yml

# Advanced Clippy analysis with SARIF output for security integration
# Note: Basic clippy checks are also run in the main CI workflow

name: "Clippy Security Analysis"

concurrency:
  group: >-
    clippy-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    branches: ["main"]
  schedule:
    - cron: "17 22 * * 0" # Weekly on Sunday
  workflow_dispatch:
  # Run on main branch pushes for security scanning
  push:
    branches: ["main"]

# Security: Define minimal required permissions
permissions:
  contents: read
  security-events: write
  actions: read

jobs:
  clippy-sarif:
    name: Clippy SARIF Analysis
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
        with:
          cache: true # toolchain/components are specified in rust-toolchain.toml
          cache-bin: false

      - name: Set up just
        uses: ./.github/actions/setup-just

      - name: Export tool versions
        id: tool_versions
        shell: bash
        run: |
          set -euo pipefail

          resolve_version() {
            local name="$1"
            local value

            if ! value="$(just --evaluate "$name")"; then
              echo "::error::Failed to resolve $name from justfile" >&2
              return 1
            fi
            if [[ -z "$value" ]]; then
              echo "::error::Resolved empty $name from justfile" >&2
              return 1
            fi

            printf '%s\n' "$value"
          }

          clippy_sarif_version="$(resolve_version clippy_sarif_version)"
          sarif_fmt_version="$(resolve_version sarif_fmt_version)"

          {
            echo "CLIPPY_SARIF_VERSION=$clippy_sarif_version"
            echo "SARIF_FMT_VERSION=$sarif_fmt_version"
          } >> "$GITHUB_OUTPUT"

      - name: Install clippy-sarif
        uses: taiki-e/cache-cargo-install-action@9ee83daaa7b96a6fab930949ecf1122bba04a389 # v3.0.8
        with:
          tool: clippy-sarif@${{ steps.tool_versions.outputs.CLIPPY_SARIF_VERSION }}

      - name: Install sarif-fmt
        uses: taiki-e/cache-cargo-install-action@9ee83daaa7b96a6fab930949ecf1122bba04a389 # v3.0.8
        with:
          tool: sarif-fmt@${{ steps.tool_versions.outputs.SARIF_FMT_VERSION }}

      - name: Run clippy with SARIF output
        run: |
          set -euo pipefail
          # Lint levels are owned by Cargo.toml.
          cargo clippy \
            --workspace \
            --all-targets \
            --all-features \
            --message-format=json | \
            clippy-sarif | \
            tee rust-clippy-results.sarif | \
            sarif-fmt

      - name: Upload SARIF results
        if: >-
          always()
          && hashFiles('rust-clippy-results.sarif') != ''
          && (
            github.event_name != 'pull_request'
            || github.event.pull_request.head.repo.full_name == github.repository
          )
        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          sarif_file: rust-clippy-results.sarif
          category: "clippy"
          wait-for-processing: true