codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly, Monday 06:00 UTC.
    - cron: "0 6 * * 1"

permissions:
  contents: read

env:
  LLVM_VERSION: "23"

jobs:
  analyze:
    name: Analyze (C++)
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v7

      - name: Install LLVM
        run: |
          # Chrome is unused; its preinstalled apt source can fail with hash
          # mismatches and block LLVM installation during repository updates.
          sudo rm -f /etc/apt/sources.list.d/google-chrome.list \
            /etc/apt/sources.list.d/google-chrome.sources
          wget -qO- https://apt.llvm.org/llvm.sh | sudo bash -s -- "$LLVM_VERSION" all
          sudo apt-get install -y ninja-build
          echo "WEAVEC_LLVM_PREFIX=/usr/lib/llvm-$LLVM_VERSION" >> "$GITHUB_ENV"
          echo "CC=clang-$LLVM_VERSION" >> "$GITHUB_ENV"
          echo "CXX=clang++-$LLVM_VERSION" >> "$GITHUB_ENV"

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: c-cpp
          # Security queries only: style and maintainability are clang-tidy's
          # job (.clang-tidy, warnings-as-errors), and the `quality` pack
          # duplicates it with heuristics (long switch cases, comment
          # density, ...) that are not defects this project gates on.
          queries: security-extended

      - name: Build
        run: |
          cmake --preset ci-release -DWEAVEC_BUILD_TESTS=OFF -DWEAVEC_ENABLE_CCACHE=OFF
          cmake --build --preset ci-release

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:c-cpp"