codeql-analysis.yml

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  push:
    branches: [ main ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ main ]
  schedule:
    - cron: '39 5 * * 0'
  workflow_dispatch:

env:
  # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
  BUILD_TYPE: RelWithDebInfo

  # Conan cache environment variables
  CONAN_SYSREQUIRES_MODE: enabled
  CONAN_USER_HOME: "${{ github.workspace }}/conan-cache"
  CONAN_USER_HOME_SHORT: "${{ github.workspace }}/conan-cache/short"

jobs:
  analyze:
    name: Analyze ${{ matrix.compiler.name }}, C++${{ matrix.cxx_std }}
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        # We will only analyse with the latest GCC and Clang, but for C++17 and C++20 modes.
        # The Build CI steps will test code in more versions.
        language: [ 'cpp' ]
        compiler: [ {name: "GCC 11", cpp: g++-11, c: gcc-11, pkgs: 'gcc-11 g++-11 lib32gcc-11-dev gcc-multilib'},
                    {name: "Clang 15", cpp: clang++-15, c: clang-15, pkgs: 'clang-15 llvm-15'}
                  ]
        cxx_std: [17, 20]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
        # Learn more:
        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v2
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    - name: Cache
      uses: actions/cache@v3
      env:
        cache-name: cache-conan-modules
      with:
        path: |
          ${{ env.CONAN_USER_HOME }}
          ~/.cache/pip
        key: ${{ runner.os }}-${{ env.BUILD_TYPE }}-${{ hashFiles('CMakeLists.txt') }}-${{ hashFiles('cmake/Conan.cmake') }}

    - name: Create Build Environment
      # Some projects don't allow in-source building, so create a separate build directory
      # We'll use this as our working directory for all subsequent commands
      run: |
        sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)"
        sudo apt update
        sudo apt install ${{ matrix.compiler.pkgs }}
        cmake -E make_directory ${{runner.workspace}}/build
      shell: bash

    - name: Install conan
      shell: bash
      run: |
        source ~/.profile

    - name: Configure CMake
      # Use a bash shell so we can use the same syntax for environment variable
      # access regardless of the host operating system
      shell: bash
      working-directory: ${{runner.workspace}}/build
      env:
         CC: ${{ matrix.compiler.c }}
         CXX: ${{ matrix.compiler.cpp }}
      # Note the current convention is to use the -S and -B options here to specify source
      # and build directories, but this is only available with CMake 3.13 and higher.
      # The CMake binaries on the Github Actions machines are (as of this writing) 3.12
      #
      # We need to source the profile file to make sure conan is in PATH
      run: |
        source ~/.profile
        cmake $GITHUB_WORKSPACE -DCMAKE_BUILD_TYPE=$BUILD_TYPE -DCXX_STANDARD=${{ matrix.cxx_std }}

    - name: Build
      working-directory: ${{runner.workspace}}/build
      shell: bash
      # Execute the build.  You can specify a specific target with "--target <NAME>"
      run: cmake --build . --config $BUILD_TYPE

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v2