static-analysis.yml

---
name: Static Analysis

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read

concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}
  cancel-in-progress: true

jobs:
  sonar:
    name: SonarCloud
    runs-on: ubuntu-latest
    container: ghcr.io/philips-software/amp-devcontainer-cpp:5.2.0@sha256:c47fcc83b59fb08f3a3a6e591b18bad49b3862acc35770fca6cec9ad0adb9cb2 # v5.2.0
    env:
      SONAR_SERVER_URL: "https://sonarcloud.io"
    steps:
      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
        with:
          fetch-depth: 0 # Disable shallow clone to enable blame information
          persist-credentials: false

      - uses: hendrikmuhs/ccache-action@ed74d11c0b343532753ecead8a951bb09bb34bc9 # v1.2.14
        with:
          key: ${{ github.job }}
          max-size: 2G

      - uses: lukka/run-cmake@af1be47fd7c933593f687731bc6fdbee024d3ff4 # v10.8
        with:
          configurePreset: "Coverage"
          buildPreset: "Coverage"
          testPreset: "Coverage"
          configurePresetAdditionalArgs: "['-DCMAKE_C_COMPILER_LAUNCHER=ccache', '-DCMAKE_CXX_COMPILER_LAUNCHER=ccache']"
        env:
          GTEST_OUTPUT: "xml:${{ github.workspace }}/testresults/"

      - name: Convert Results
        run: |
          { echo '<testExecutions version="1">'; xsltproc .github/formatters/gtest-to-generic-execution.xslt ${{ github.workspace }}/testresults/*.xml; echo '</testExecutions>'; } | tee execution.xml > /dev/null
          gcovr --sonarqube=coverage.xml --exclude-lines-by-pattern '.*assert\(.*\);|.*really_assert\(.*\);|.*std::abort();' --exclude-unreachable-branches --exclude-throw-branches -j "$(nproc)"
          cp .build/Coverage/compile_commands.json compile_commands.json

      - name: Prepare dependencies for sonar-scanner
        run: apt-get update && apt-get install -y --no-install-recommends curl

      - name: Install sonar-scanner and build-wrapper
        uses: sonarsource/sonarqube-github-c-cpp@4aebde3df73d6b8588d2b61acc360cd94185da2c # v2.0.0
        env:
          SONAR_HOST_URL: ${{ env.SONAR_SERVER_URL }}

      - name: Run sonar-scanner
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: sonar-scanner -D sonar.host.url="${{ env.SONAR_SERVER_URL }}"

  codeql:
    name: CodeQL
    runs-on: ubuntu-latest
    container: ghcr.io/philips-software/amp-devcontainer-cpp:5.2.0@sha256:c47fcc83b59fb08f3a3a6e591b18bad49b3862acc35770fca6cec9ad0adb9cb2 # v5.2.0
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
        with:
          persist-credentials: false
      - uses: hendrikmuhs/ccache-action@ed74d11c0b343532753ecead8a951bb09bb34bc9 # v1.2.14
        with:
          key: ${{ github.job }}
      - uses: github/codeql-action/init@f779452ac5af1c261dce0346a8f964149f49322b # v3.26.13
        with:
          languages: cpp
      - uses: lukka/run-cmake@af1be47fd7c933593f687731bc6fdbee024d3ff4 # v10.8
        with:
          configurePreset: "Host"
          buildPreset: "Host-Debug"
          configurePresetAdditionalArgs: "['-DCMAKE_C_COMPILER_LAUNCHER=ccache', '-DCMAKE_CXX_COMPILER_LAUNCHER=ccache']"
      - uses: github/codeql-action/analyze@f779452ac5af1c261dce0346a8f964149f49322b # v3.26.13