codeql.yml

name: CodeQL

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]
  schedule:
    - cron: "27 4 * * 1"   # weekly, Monday 04:27 UTC

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze (c-cpp)
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      security-events: write   # upload results to the Security tab
      contents: read
    steps:
      - uses: actions/checkout@v7

      - name: Install build deps
        run: |
          sudo apt-get update
          sudo apt-get install -y cmake ninja-build g++ libopenmpi-dev openmpi-bin libomp-dev

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: c-cpp
          queries: security-and-quality

      # Build only the CPU backends (no CUDA toolkit on the hosted runner).
      - name: Build (omp + mpi)
        run: |
          cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=Release \
            -DAMR_BUILD_MPI=ON -DAMR_BUILD_CUDA=OFF -DBUILD_TESTING=OFF
          cmake --build build -j

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:c-cpp"