GoTool-Center/.github/workflows/codeql.yml at main · AlgorithMagic/GoTool-Center · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
name: CodeQL Advanced

on:
  workflow_dispatch:

  push:
    branches: [main]
    paths-ignore:
      - "third-party/**"

  pull_request:
    branches: [main]
    paths-ignore:
      - "third-party/**"

  schedule:
    # Runs every Saturday at 19:45 UTC on the default branch.
    - cron: "45 19 * * 6"

permissions:
  contents: read
  security-events: write
  actions: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-24.04
    timeout-minutes: 45

    permissions:
      contents: read
      security-events: write
      actions: read

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: actions
            build-mode: none

          - language: python
            build-mode: none

          - language: c-cpp
            build-mode: manual

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          submodules: recursive
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Python
        if: matrix.language == 'c-cpp'
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.12"

      - name: Install native build dependencies
        if: matrix.language == 'c-cpp'
        run: |
          set -euo pipefail

          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential \
            clang \
            lld \
            python3 \
            python3-pip

          python -m pip install --upgrade pip
          python -m pip install "scons>=4.8,<5"

          clang++ --version
          scons --version

      - name: Verify native build inputs
        if: matrix.language == 'c-cpp'
        run: |
          set -euo pipefail

          python - <<'PY'
          from pathlib import Path

          required = [
              "SConstruct",
              "godot-cpp/SConstruct",
              "third-party/godot/extension_api.json",
              "third-party/sqlite3/sqlite3.c",
          ]

          missing = [path for path in required if not Path(path).is_file()]

          if missing:
              print("Missing required files:")
              for path in missing:
                  print(f"  - {path}")
              raise SystemExit(1)

          print("All required native build inputs are present.")
          PY

      - name: Initialize CodeQL
        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          config-file: ./.github/codeql/codeql-config.yml
          queries: security-extended,security-and-quality

      - name: Build C/C++ for CodeQL
        if: matrix.language == 'c-cpp'
        run: |
          set -euo pipefail

          scons \
            platform=linux \
            target=template_debug \
            arch=x86_64 \
            extension=1 \
            doctest=0 \
            fuzz=0 \
            coverage=0 \
            sanitizer=none \
            compiledb=0 \
            custom_api_file=third-party/godot/extension_api.json \
            generate_bindings=yes \
            -j2

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
        with:
          category: "/language:${{ matrix.language }}"