# CodeQL security analysis (C++ engine + Python tools).
#
# Runs on pushes to dev, weekly, and on demand -- not on every PR -- because
# the C++ analysis requires a full instrumented build. The SARIF
# results appear under Security -> Code scanning and are also posted as PR
# comments when a PR branch is analyzed.

name: CodeQL

on:
  push:
    branches: [dev]
  schedule:
    - cron: "0 16 * * 0"
  workflow_dispatch:

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  security-events: write

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-24.04
    # Run 34345313586 reached only 978/1046 build steps in 40 minutes.
    # Allow for dependency setup, a growing full build, and database analysis.
    timeout-minutes: 180
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: cpp
            build-mode: manual
          - language: python
            build-mode: none
    steps:
      - name: Checkout
        timeout-minutes: 10
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive

      - name: Install system packages (C++ build)
        if: matrix.language == 'cpp'
        timeout-minutes: 10
        run: |
          sudo sed -i -E 's#https?://[^/]*archive\.ubuntu\.com/ubuntu#http://archive.ubuntu.com/ubuntu#g' \
            /etc/apt/apt-mirrors.txt /etc/apt/sources.list /etc/apt/sources.list.d/*.sources 2>/dev/null || true
          # All requested packages come from Ubuntu. Do not refresh unrelated
          # runner repositories whose indexes can fail independently (Chrome).
          test -s /etc/apt/sources.list.d/ubuntu.sources
          sudo apt-get update \
            -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/ubuntu.sources \
            -o Dir::Etc::sourceparts=- -o Acquire::Retries=2 \
            -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30
          sudo apt-get install -y --no-install-recommends \
            build-essential cmake ninja-build \
            libx11-dev libxxf86vm-dev libxi-dev libxcursor-dev \
            libxrandr-dev libxinerama-dev libxext-dev libxss-dev \
            libgl1-mesa-dev \
            libbz2-dev libpng-dev \
            libwayland-dev libxkbcommon-dev libasound2-dev \
            mesa-vulkan-drivers libvulkan-dev vulkan-tools glslang-tools

      - name: Prepare C++ dependencies outside CodeQL tracing
        if: matrix.language == 'cpp'
        timeout-minutes: 40
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Third-party sources are pinned and scanned in their own upstreams.
          # Build them before CodeQL initialization so the database contains
          # EVEngine production code rather than 1000+ external translation units.
          # Keep Debug semantics/assertions and every default module (including
          # editors). CodeQL extracts source; DWARF symbols only add compiler,
          # linker and disk work, so omit them without enabling optimization.
          cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBUILD_PLATFORM=linux \
            -DCMAKE_C_FLAGS_DEBUG="-O0 -g0" \
            -DCMAKE_CXX_FLAGS_DEBUG="-O0 -g0" \
            -DBUILD_TESTING=OFF \
            -B build/codeql -S .
          cmake --build build/codeql --target deps -j "$(nproc)"

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          queries: security-and-quality

      - name: Build (C++)
        if: matrix.language == 'cpp'
        timeout-minutes: 75
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # The already-prepared build tree contains pinned dependency outputs.
          # Only EVEngine production translation units are traced here.
          cmake --build build/codeql -j "$(nproc)"

      - name: Perform CodeQL analysis
        timeout-minutes: 60
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"