codeql-analysis.yml

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "codeql-analysis"

on:
  push:
    branches: [ 'master', 'codeql-fix' ]
    paths-ignore:
      - 'documentation/**'

  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ master ]
    paths-ignore:
      - 'documentation/**'

  schedule:
    - cron: '16 10 * * 3'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-22.04
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'c-cpp' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
        # Learn more about CodeQL language support at https://git.io/codeql-language-support

    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      # Indicates the location of the vcpkg as a Git submodule of the project repository.
      VCPKG_ROOT: ${{ github.workspace }}/external/vcpkg
      # Tells vcpkg where binary packages are stored.
      VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}/external/vcpkg/bincache
      # Let's use GitHub Action cache as storage for the vcpkg Binary Caching feature.
      VCPKG_BINARY_SOURCES: 'clear;x-gha,readwrite'

    steps:
    # Set env vars needed for vcpkg to leverage the GitHub Action cache as a storage
    # for Binary Caching.
    - name: Set env vars needed for vcpkg to leverage the GitHub Action cache
      uses: actions/github-script@v6
      with:
        script: |
          core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
          core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        submodules: recursive
        fetch-depth: 0

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    - name: Install dependencies
      run: |
        sudo dpkg --add-architecture i386
        sudo apt-get update
        sudo apt-get install gcc-multilib g++-multilib cmake
        sudo apt-get install qtbase5-dev

    - name: Install ninja-build tool
      uses: seanmiddleditch/gha-setup-ninja@v4

    - name: Create build environment
      # Some projects don't allow in-source building, so create a separate build directory
      # We'll use this as our working directory for all subsequent commands
      run: cmake -E make_directory ${{ github.workspace }}/build

    - name: "Create directory '${{ env.VCPKG_DEFAULT_BINARY_CACHE }}'"
      shell: bash
      run: mkdir -p $VCPKG_DEFAULT_BINARY_CACHE

    # Restore vcpkg from the GitHub Action cache service. Note that packages are restored by vcpkg's binary caching
    # when it is being run afterwards by CMake.
    - name: Restore vcpkg
      uses: actions/cache@v3
      with:
        # The first path is the location of vcpkg: it contains the vcpkg executable and data files, as long as the
        # built package archives (aka binary cache) which are located by VCPKG_DEFAULT_BINARY_CACHE env var.
        # The other paths starting with '!' are exclusions: they contain termporary files generated during the build of the installed packages.
        path: |
          ${{ env.VCPKG_ROOT }}
          !${{ env.VCPKG_ROOT }}/buildtrees
          !${{ env.VCPKG_ROOT }}/packages
          !${{ env.VCPKG_ROOT }}/downloads
          !${{ env.VCPKG_ROOT }}/installed
        # The key is composed in a way that it gets properly invalidated whenever a different version of vcpkg is being used.
        key: |
          ${{ hashFiles( '.git/modules/external/vcpkg/HEAD' )}}

    - name: Configure CMake
      working-directory: ${{ github.workspace }}/build
      # Note the current convention is to use the -S and -B options here to specify source
      # and build directories, but this is only available with CMake 3.13 and higher.
      # The CMake binaries on the Github Actions machines are (as of this writing) 3.12
      run: cmake "${{ github.workspace }}" --preset linux-x64-debug

    - name: Build
      working-directory: ${{ github.workspace }}/build
      # Execute the build. You can specify a specific target with "--target <NAME>"
      run: cmake --build . --parallel 4

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3