codeql.yaml

# SPDX-License-Identifier: Apache-2.0 OR MIT
#
# SPDX-FileCopyrightText: Copyright 2022 Micron Technology, Inc.

name: CodeQL

on:
  push:
    branches:
      - master
      - "v[0-9]+.[0-9]+"
  pull_request:
    branches:
      - master
      - "v[0-9]+.[0-9]+"
    paths:
      - "**.c"
      - "**.h"
      - "**.java"
      - "**/meson.build"
      - .github/workflows/codeql.yaml
  schedule:
    - cron: 0 0 * * SUN

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref }}
  cancel-in-progress: true

permissions:
  security-events: write

jobs:
  determine-tag:
    runs-on: ubuntu-latest
    continue-on-error: false
    outputs:
      tag: ${{ steps.determine-tag.outputs.tag }}

    steps:
      - name: Determine tag
        id: determine-tag
        run: |
          if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
            echo "tag=$GITHUB_BASE_REF" >> "$GITHUB_OUTPUT"
          else
            echo "tag=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
          fi

  codeql:
    runs-on: ubuntu-latest
    needs:
      - determine-tag
    container:
      image: ghcr.io/hse-project/ci-images/fedora-37:${{ needs.determine-tag.outputs.tag }}

    steps:
      - name: Checkout hse-java
        uses: actions/checkout@v3

      - name: Checkout HSE
        uses: actions/checkout@v3
        with:
          repository: hse-project/hse
          path: subprojects/hse

      - name: Cache Meson packagecache
        uses: actions/cache@v3
        with:
          path: subprojects/packagecache
          key: meson-packagecache-fedora-37-${{ hashFiles('subprojects/hse/subprojects/*.wrap') }}

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          config-file: .github/codeql/codeql-config.yaml

      # Ideally we compile no code from subprojects other than built-in code.
      # CodeQL will analyze any code that actually gets built. Fedora doesn't
      # package all cJSON functionality we need, so build it and cross fingers!
      #
      # https://bugzilla.redhat.com/show_bug.cgi?id=2117773
      - name: Setup
        run: |
          meson setup builddir --fatal-meson-warnings --werror \
            -Dwrap_mode=nofallback -Dforce_fallback_for=hse,cjson \
            -Ddocs=false

      - name: Build
        run: |
          ninja -C builddir

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v3