# CodeQL security analysis (C++ engine + Python tools).
#
# Runs on pushes to dev, weekly, and on demand -- not on every PR -- because
# the C++ analysis requires a full instrumented build (~40 min). The SARIF
# results appear under Security -> Code scanning and are also posted as PR
# comments when a PR branch is analyzed.

name: CodeQL

on:
  push:
    branches: [dev]
  schedule:
    - cron: "0 16 * * 0"
  workflow_dispatch:

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  security-events: write

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-24.04
    # The instrumented C++ build takes about 34 minutes and database analysis
    # can take another 30+ minutes on GitHub-hosted runners.
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        language: ["cpp", "python"]
    steps:
      - name: Checkout
        timeout-minutes: 10
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive

      - name: Install system packages (C++ build)
        if: matrix.language == 'cpp'
        timeout-minutes: 10
        run: |
          sudo sed -i -E 's#https?://[^/]*archive\.ubuntu\.com/ubuntu#http://archive.ubuntu.com/ubuntu#g' \
            /etc/apt/apt-mirrors.txt /etc/apt/sources.list /etc/apt/sources.list.d/*.sources 2>/dev/null || true
          sudo apt-get update -o Acquire::Retries=2 \
            -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30
          sudo apt-get install -y --no-install-recommends \
            build-essential cmake ninja-build \
            libx11-dev libxxf86vm-dev libxi-dev libxcursor-dev \
            libxrandr-dev libxinerama-dev libxext-dev libxss-dev \
            libgl1-mesa-dev \
            libbz2-dev libpng-dev \
            libwayland-dev libxkbcommon-dev libasound2-dev \
            mesa-vulkan-drivers libvulkan-dev vulkan-tools glslang-tools

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          queries: security-and-quality

      - name: Build (C++)
        if: matrix.language == 'cpp'
        timeout-minutes: 40
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Third-party deps ship prebuilt SDK headers/libs; the engine itself
          # must be built under CodeQL tracing. BUILD_TESTING=OFF keeps the
          # scan focused on engine sources and avoids the test-only TUs.
          cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBUILD_PLATFORM=linux \
            -DBUILD_TESTING=OFF \
            -B build/codeql -S .
          cmake --build build/codeql --target deps -j "$(nproc)"
          cmake --build build/codeql -j "$(nproc)"

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"