110 lines
4.1 KiB
YAML
110 lines
4.1 KiB
YAML
# CodeQL security analysis (C++ engine + Python tools).
|
|
#
|
|
# Runs on pushes to dev, weekly, and on demand -- not on every PR -- because
|
|
# the C++ analysis requires a full instrumented build. The SARIF
|
|
# results appear under Security -> Code scanning and are also posted as PR
|
|
# comments when a PR branch is analyzed.
|
|
|
|
name: CodeQL
|
|
|
|
on:
|
|
push:
|
|
branches: [dev]
|
|
schedule:
|
|
- cron: "0 16 * * 0"
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: codeql-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
runs-on: ubuntu-24.04
|
|
# Run 34345313586 reached only 978/1046 build steps in 40 minutes.
|
|
# Allow for dependency setup, a growing full build, and database analysis.
|
|
timeout-minutes: 180
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- language: cpp
|
|
build-mode: manual
|
|
- language: python
|
|
build-mode: none
|
|
steps:
|
|
- name: Checkout
|
|
timeout-minutes: 10
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
submodules: recursive
|
|
|
|
- name: Install system packages (C++ build)
|
|
if: matrix.language == 'cpp'
|
|
timeout-minutes: 10
|
|
run: |
|
|
sudo sed -i -E 's#https?://[^/]*archive\.ubuntu\.com/ubuntu#http://archive.ubuntu.com/ubuntu#g' \
|
|
/etc/apt/apt-mirrors.txt /etc/apt/sources.list /etc/apt/sources.list.d/*.sources 2>/dev/null || true
|
|
# All requested packages come from Ubuntu. Do not refresh unrelated
|
|
# runner repositories whose indexes can fail independently (Chrome).
|
|
test -s /etc/apt/sources.list.d/ubuntu.sources
|
|
sudo apt-get update \
|
|
-o Dir::Etc::sourcelist=/etc/apt/sources.list.d/ubuntu.sources \
|
|
-o Dir::Etc::sourceparts=- -o Acquire::Retries=2 \
|
|
-o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30
|
|
sudo apt-get install -y --no-install-recommends \
|
|
build-essential cmake ninja-build \
|
|
libx11-dev libxxf86vm-dev libxi-dev libxcursor-dev \
|
|
libxrandr-dev libxinerama-dev libxext-dev libxss-dev \
|
|
libgl1-mesa-dev \
|
|
libbz2-dev libpng-dev \
|
|
libwayland-dev libxkbcommon-dev libasound2-dev \
|
|
mesa-vulkan-drivers libvulkan-dev vulkan-tools glslang-tools
|
|
|
|
- name: Prepare C++ dependencies outside CodeQL tracing
|
|
if: matrix.language == 'cpp'
|
|
timeout-minutes: 40
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
# Third-party sources are pinned and scanned in their own upstreams.
|
|
# Build them before CodeQL initialization so the database contains
|
|
# EVEngine production code rather than 1000+ external translation units.
|
|
# Keep Debug semantics/assertions and every default module (including
|
|
# editors). CodeQL extracts source; DWARF symbols only add compiler,
|
|
# linker and disk work, so omit them without enabling optimization.
|
|
cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBUILD_PLATFORM=linux \
|
|
-DCMAKE_C_FLAGS_DEBUG="-O0 -g0" \
|
|
-DCMAKE_CXX_FLAGS_DEBUG="-O0 -g0" \
|
|
-DBUILD_TESTING=OFF \
|
|
-B build/codeql -S .
|
|
cmake --build build/codeql --target deps -j "$(nproc)"
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@v4
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: ${{ matrix.build-mode }}
|
|
queries: security-and-quality
|
|
|
|
- name: Build (C++)
|
|
if: matrix.language == 'cpp'
|
|
timeout-minutes: 75
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
# The already-prepared build tree contains pinned dependency outputs.
|
|
# Only EVEngine production translation units are traced here.
|
|
cmake --build build/codeql -j "$(nproc)"
|
|
|
|
- name: Perform CodeQL analysis
|
|
timeout-minutes: 60
|
|
uses: github/codeql-action/analyze@v4
|
|
with:
|
|
category: "/language:${{ matrix.language }}"
|