-
Notifications
You must be signed in to change notification settings - Fork 12
131 lines (114 loc) · 4.73 KB
/
codeql.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"
on:
push:
# branches: [ "main", "develop" ]
pull_request:
# The branches below must be a subset of the branches above
branches: [ "main", "develop" ]
schedule:
- cron: '38 0 * * 5'
env:
# Conan cache environment variables
CONAN_SYSREQUIRES_MODE: enabled
CONAN_USER_HOME: "${{ github.workspace }}/conan-cache"
CONAN_USER_HOME_SHORT: "${{ github.workspace }}/conan-cache/short"
jobs:
analyze:
name: Analyze
runs-on: ubuntu-22.04
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: [ 'cpp' ]
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
compiler:
- gcc-11
build_type:
- Debug
steps:
- name: Checkout repository
uses: actions/checkout@v3
with:
submodules: recursive
- name: Setup Cache
uses: actions/cache@v3
with:
path: ${{ github.workspace }}/conan-cache
key: ${{ runner.os }}-conan-${{ matrix.language }}-${{ matrix.compiler }}-${{ matrix.build_type }}
restore-keys: |
${{ runner.os }}-conan-
# uses: ./.github/actions/setup_cache
# with:
# compiler: ${{ matrix.compiler }}
# build_type: ${{ matrix.build_type }}
# doxygen: "OFF"
- name: Setup Cpp
uses: aminya/setup-cpp@v1
with:
compiler: ${{ matrix.compiler }}
vcvarsall: ${{ contains(matrix.os, 'windows' )}}
cmake: true
brew: true
conan: "2.2.2"
ccache: true
gcovr: "7.2"
- name: Setup Linux
run: |
sudo apt install -y libglfw3-dev libglfw3
- name: Cleanup Conan system packages (they are not properly cached)
run: |
conan remove -f '*/system/*' || true
- name: Create default Conan profile
run: |
conan profile detect
- name: Update Conan profile for Linux
if: ${{ runner.os == 'Linux' }}
run: |
conan profile detect --force
sed -i 's/compiler=.*/compiler=gcc/' ~/.conan2/profiles/default
sed -i 's/compiler.version=.*/compiler.version=11/' ~/.conan2/profiles/default
sed -i 's/compiler.libcxx=.*/compiler.libcxx=libstdc++11/' ~/.conan2/profiles/default
sed -i 's/build_type=.*/build_type=${{matrix.build_type}}/' ~/.conan2/profiles/default
sed -i 's/arch=.*/arch=x86_64/' ~/.conan2/profiles/default
sed -i 's/os=.*/os=Linux/' ~/.conan2/profiles/default
cat ~/.conan2/profiles/default
- name: Installing conan dependencies
run: |
conan install . --build=missing -s build_type=${{matrix.build_type}}
- name: Configure CMake
run: |
cmake -S . -B ./build -DCMAKE_BUILD_TYPE:STRING=${{matrix.build_type}} -DCMAKE_TOOLCHAIN_FILE="build/${{matrix.build_type}}/generators/conan_toolchain.cmake" -DENABLE_MAIN=TRUE -DENABLE_TESTING=TRUE -DENABLE_COVERAGE:BOOL=${{ matrix.build_type == 'Debug' }} -DENABLE_DOXYGEN=OFF -DLOG_LEVEL:STRING=${{matrix.log-level}} -DWARNINGS_AS_ERRORS:BOOL=${{ !contains(matrix.os, 'windows' )}} -DENABLE_CPPCHECK=OFF -DENABLE_CLANG_TIDY=OFF -DENABLE_INCLUDE_WHAT_YOU_USE=OFF
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
# By default, queries listed here will override any specified in a config file.
# Prefix the list here with "+" to use these queries and those in the config file.
# Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
# queries: security-extended,security-and-quality
- name: Build
run: |
cmake --build ./build --config ${{matrix.build_type}}
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
with:
category: "/language:${{matrix.language}}"
config-file: ./.github/codeql/codeql-config.yml