tickoni/.github/workflows/codeql.yml at main · deeprnd/tickoni · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
name: "CodeQL Nightly Analysis"

on:
    workflow_call:
    workflow_dispatch:

permissions:
  security-events: write

jobs:
  analyze:
    if: ${{ vars.SKIP_FIREDANCER_CI != 'true' }}
    name: Analyze (${{ matrix.language }})
    runs-on:
      group: fd-public-repo-codeql
    strategy:
      fail-fast: false
      matrix:
        include:
        - language: c-cpp
          build-mode: manual
          compiler: clang
          machine: linux_clang_x86_64
          compiler-version: 15.0.6
          targets: fddev firedancer-dev
          extras: rpath
    env:
      MACHINE: ${{ matrix.machine }}
      EXTRAS: ${{ matrix.extras || '' }}
      CC: ${{ matrix.compiler }}
      CXX: ${{ matrix.compiler == 'gcc' && 'g++' || 'clang++' }}
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/submodule-init

      - uses: ./.github/actions/deps
        with:
          compiler: ${{ matrix.compiler }}
          compiler-version: ${{ matrix.compiler-version }}
          extras: +dev
      - uses: dtolnay/rust-toolchain@1.95.0
      - name: clean targets
        run: |
          make clean --silent >/dev/null
      - uses: ./.github/actions/submodule
        with:
          machine: ${{ matrix.machine }}
          compiler: ${{ matrix.compiler }}
          compiler-version: ${{ matrix.compiler-version }}
        if: ${{ contains(matrix.targets, 'fdctl') || contains(matrix.targets, 'fddev') }}
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          queries: ./contrib/codeql/src/nightly
          config: |
              disable-default-queries: true
      - if: matrix.build-mode == 'manual'
        shell: bash
        run: |
          source /opt/${{ matrix.compiler }}/${{ matrix.compiler }}-${{ matrix.compiler-version }}/activate
          make -j ${{ matrix.targets }}
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"
          upload: 'always'