MethaneKit/.github/workflows/ci-codeql-scan.yml at master · MethanePowered/MethaneKit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
# Static code analysis workflow with CodeQL

name: "🔮 CI CodeQL Scan"

on:
  workflow_dispatch:
  push:
    branches: [ master ]
    paths:
    - '.github/**/*codeql*.yml'
    - 'Apps/**'
    - 'Modules/**'
    - 'Externals/**'
    - 'Tests/**'
    - 'CMake/**'
    - 'CMakeLists.txt'
    - 'CMakePresets.json'
  pull_request:
    branches: [ master ]
    paths:
    - '.github/**/*codeql*.yml'
    - 'Apps/**'
    - 'Modules/**'
    - 'Externals/**'
    - 'Tests/**'
    - 'CMake/**'
    - 'CMakeLists.txt'
    - 'CMakePresets.json'
  schedule:
    - cron: '20 23 * * 3' # Scheduled workflow will not run in GitHub forks by default

jobs:
  analyze:
    name: ${{ matrix.name }}
    if: ${{ github.repository == 'MethanePowered/MethaneKit' }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            name: "Win64_DX_CodeQL-Scan"
            config_preset: "VS2026-Win64-DX-Scan"
            build_preset: "VS2026-Win64-DX-Scan"

          - os: ubuntu-latest
            name: "Ubuntu_VK_CodeQL-Scan"
            config_preset: "Make-Lin-VK-Scan"
            build_preset: "Make-Lin-VK-Scan"

          # FIXME: disable CodeQL scan on MacOS because of an issue with Metal Toolchain availability
          #- os: macos-latest
          #  name: "MacOS_MTL_CodeQL-Scan"
          #  config_preset: "Xcode-Mac-MTL-Scan"
          #  build_preset: "Xcode-Mac-MTL-Scan"

    runs-on: ${{ matrix.os }}

    env:
      NAME: CodeQL-${{ matrix.os }}

    steps:

    - name: Checkout repository
      uses: actions/checkout@v7
      with:
        # No later step performs authenticated Git operations (SARIF is uploaded through the API),
        # so the checkout token is not persisted into the local Git config.
        persist-credentials: false

    - name: Install Linux prerequisites
      if: ${{ matrix.os == 'ubuntu-latest' }}
      run: |
        sudo apt update
        sudo apt install xcb libx11-dev libx11-xcb-dev libxcb-sync-dev libxcb-randr0-dev

    - name: Install MacOS prerequisites
      if: ${{ matrix.os == 'macos-latest' }}
      run: ./Build/Unix/CI/InstallMacOsPrerequisites.sh

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: cpp
        config-file: ./.github/codeql/codeql-config.yml

    - name: Initialize Externals Cache
      id: cache-externals
      uses: actions/cache@v6
      env:
        cache-name: cache-externals
      with:
        path: Build/Output/ExternalsCache
        key: ExternalsCache-${{ matrix.config_preset }}-${{ hashFiles('Externals/*.cmake') }}

    - name: CMake Configure Preset ${{ matrix.config_preset }}
      run: cmake --preset ${{ matrix.config_preset }} -DMETHANE_CODE_COVERAGE_ENABLED:BOOL=OFF -DMETHANE_TESTS_BUILD_ENABLED:BOOL=OFF

    - name: CMake Build Preset ${{ matrix.build_preset }}
      run: cmake --build --preset ${{ matrix.build_preset }}

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4
      with:
        upload: false
        output: results

    - name: Filter CodeQL Results
      uses: MethanePowered/FilterSarif@master
      with:
        patterns: |
          -Build/Output/**
          -Externals/**
          -Tests/**
        input: results/cpp.sarif
        output: results/cpp-filtered.sarif

    - name: Upload Filtered CodeQL Results
      uses: github/codeql-action/upload-sarif@v4
      with:
        sarif_file: results/cpp-filtered.sarif