CodeQL Advanced #43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL Advanced | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - "third-party/**" | |
| pull_request: | |
| branches: [main] | |
| paths-ignore: | |
| - "third-party/**" | |
| schedule: | |
| # Runs every Saturday at 19:45 UTC on the default branch. | |
| - cron: "45 19 * * 6" | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 45 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: actions | |
| build-mode: none | |
| - language: python | |
| build-mode: none | |
| - language: c-cpp | |
| build-mode: manual | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| submodules: recursive | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Python | |
| if: matrix.language == 'c-cpp' | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install native build dependencies | |
| if: matrix.language == 'c-cpp' | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends \ | |
| build-essential \ | |
| clang \ | |
| lld \ | |
| python3 \ | |
| python3-pip | |
| python -m pip install --upgrade pip | |
| python -m pip install "scons>=4.8,<5" | |
| clang++ --version | |
| scons --version | |
| - name: Verify native build inputs | |
| if: matrix.language == 'c-cpp' | |
| run: | | |
| set -euo pipefail | |
| python - <<'PY' | |
| from pathlib import Path | |
| required = [ | |
| "SConstruct", | |
| "godot-cpp/SConstruct", | |
| "third-party/godot/extension_api.json", | |
| "third-party/sqlite3/sqlite3.c", | |
| ] | |
| missing = [path for path in required if not Path(path).is_file()] | |
| if missing: | |
| print("Missing required files:") | |
| for path in missing: | |
| print(f" - {path}") | |
| raise SystemExit(1) | |
| print("All required native build inputs are present.") | |
| PY | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| config-file: ./.github/codeql/codeql-config.yml | |
| queries: security-extended,security-and-quality | |
| - name: Build C/C++ for CodeQL | |
| if: matrix.language == 'c-cpp' | |
| run: | | |
| set -euo pipefail | |
| scons \ | |
| platform=linux \ | |
| target=template_debug \ | |
| arch=x86_64 \ | |
| extension=1 \ | |
| doctest=0 \ | |
| fuzz=0 \ | |
| coverage=0 \ | |
| sanitizer=none \ | |
| compiledb=0 \ | |
| custom_api_file=third-party/godot/extension_api.json \ | |
| generate_bindings=yes \ | |
| -j2 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4 | |
| with: | |
| category: "/language:${{ matrix.language }}" |