codeql-analysis.yml

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
name: "CodeQL"

on:
  push:
    branches: [development, main]
  schedule:
    - cron: '0 7 * * 3'
  workflow_dispatch:

jobs:
  analyze:
    name: ${{matrix.buildname}}
    runs-on: ubuntu-latest

    permissions:
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: cpp
            buildname: 'CodeQL'
            qt: '6.11.1'
            triplet: x64-linux
            compiler: gcc_64
            gcc_compiler_version: 10
            os: ubuntu-latest

    env:
      BOOST_ROOT: ${{github.workspace}}/3rdparty/boost
      BOOST_URL: https://github.com/boostorg/boost/releases/download/boost-1.83.0/boost-1.83.0.7z


    steps:
    - name: Checkout repository
      uses: actions/checkout@v7
      with:
        # We must fetch at least the immediate parents so that if this is
        # a pull request then we can checkout the head.
        fetch-depth: 2
        submodules: recursive

    - name: (Windows) Install Qt
      uses: jurplel/install-qt-action@v4
      if: runner.os == 'Windows'
      with:
        version: ${{matrix.qt}}
        dir: ${{runner.workspace}}
        arch: win64_mingw73
        # uncached for the same reason as the step below
        cache: false
        modules: qt5compat qtmultimedia

    - name: (Linux/macOS) Install Qt
      uses: jurplel/install-qt-action@v4
      if: runner.os == 'Linux' || runner.os == 'macOS'
      with:
        version: ${{matrix.qt}}
        dir: ${{runner.workspace}}
        # Deliberately uncached: the Qt tree is 335MB on Linux and 389MB on macOS,
        # and a copy per runner image, module set and ref took over 40% of the
        # repository's 10GB cache quota - more than every ccache put together.
        # Fetching it afresh costs 25-35s a job. Leaving it cached cost far more
        # than that, because a quota with no headroom has GitHub evicting by
        # least-recently-used, and a dropped branch ccache is a 20 minute cold
        # rebuild rather than a 30 second download.
        cache: false
        modules: qt5compat qtmultimedia

    - name: Restore Boost cache
      uses: actions/cache@v6
      id: cache-boost
      with:
        path: ${{env.BOOST_ROOT}}
        key: boost

    - name: Install Boost
      if: steps.cache-boost.outputs.cache-hit != 'true'
      run: |
        if [ "$OS" == "Windows_NT" ]; then
          # fix up paths to be forward slashes consistently
          BOOST_ROOT=$(echo $BOOST_ROOT | sed 's/\\/\//g')
        fi
        mkdir -p $BOOST_ROOT
        curl --progress-bar --location --output $BOOST_ROOT/download.7z $BOOST_URL
        7z -o$BOOST_ROOT x $BOOST_ROOT/download.7z -y -bd
        cd $BOOST_ROOT && cp -r boost-*/* .
        rm -rf boost-*/* download.7z
      shell: bash

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4.37.8
      with:
        config-file: ./.github/codeql/codeql-config.yml
        languages: ${{ matrix.language }}
        trap-caching: false
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        queries: security-extended, security-and-quality

    - name: Use CMake 3.30.3
      uses: lukka/get-cmake@v4.4.2

    - name: (Linux) Install Lua via GitHub Actions
      uses: leafo/gh-actions-lua@v13
      if: runner.os == 'Linux'
      with:
        luaVersion: "5.1.5"
        buildCache: false

    - name: (Linux) Install Luarocks via GitHub Actions
      uses: leafo/gh-actions-luarocks@v6
      if: runner.os == 'Linux'

    - name: (Linux) Install dependencies
      if: runner.os == 'Linux'
      run: |
        sudo apt-get update

        # Install all required dependencies
        # liblua5.1-0-dev is needed for CMake to find Lua headers/library
        # No ccache here on purpose: CMake picks it up as a compiler launcher
        # wherever it is installed, and a cache hit would hide the compilation
        # from CodeQL's tracer. The runner images do not ship ccache, so leaving
        # it out of this list is enough to keep it out of the build.
        sudo apt-get install libsecret-1-dev pkg-config pcre2-utils libzip-dev libglu1-mesa-dev libpulse-dev g++-${{matrix.gcc_compiler_version}} \
          libassimp-dev libpcre2-dev libpugixml-dev libsqlite3-dev libyajl-dev libhunspell-dev liblua5.1-0-dev libonig-dev libboost-dev qtkeychain-qt6-dev -y

        # switch to GCC that supports C++20 while retaining support for older OS's
        sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-${{matrix.gcc_compiler_version}} ${{matrix.gcc_compiler_version}}
        sudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-${{matrix.gcc_compiler_version}} ${{matrix.gcc_compiler_version}}
        sudo update-alternatives --set gcc /usr/bin/gcc-${{matrix.gcc_compiler_version}}
        sudo update-alternatives --set g++ /usr/bin/g++-${{matrix.gcc_compiler_version}}

        # Install lua-yajl early to generate translation statistics
        luarocks install --local lua-yajl

        # Allow stats generation script to see location of lua-yajl
        eval "$(luarocks path --local --lua-version "5.1")"
        echo "LUA_PATH=$LUA_PATH" >> $GITHUB_ENV
        echo "LUA_CPATH=$LUA_CPATH" >> $GITHUB_ENV

    - name: (Linux/macOS) Set build info
      if: runner.os == 'Linux' || runner.os == 'macOS'
      run: |
        ${{github.workspace}}/CI/validate_deployment.sh
        ${{github.workspace}}/CI/set-build-info.sh

    - name: Build Mudlet
      uses: lukka/run-cmake@v3
      with:
        cmakeListsOrSettingsJson: CMakeListsTxtAdvanced
        cmakeListsTxtPath: '${{github.workspace}}/CMakeLists.txt'
        buildDirectory: '${{runner.workspace}}/b/ninja'
        cmakeAppendedArgs: >-
          -G Ninja
          -DCMAKE_PREFIX_PATH=${{ env.QT_PREFIX != '' && env.QT_PREFIX || env.MINGW_BASE_DIR }}
          -DBUILD_TESTING=OFF
      env:
        NINJA_STATUS: '[%f/%t %o/sec] '
        # ninja's default of cores + 2 exhausts this runner's memory
        CMAKE_BUILD_PARALLEL_LEVEL: 3

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4.37.8
      with:
        category: "/language:${{ matrix.language }}"
        upload: false
        output: sarif-results

    - name: Filter out 3rdparty dependencies
      uses: advanced-security/filter-sarif@v1
      with:
        patterns: |
          -3rdparty/**
        input: sarif-results/${{ matrix.language }}.sarif
        output: sarif-results/${{ matrix.language }}.sarif

    - name: Upload SARIF
      uses: github/codeql-action/upload-sarif@v4.37.8
      with:
        sarif_file: sarif-results/${{ matrix.language }}.sarif