西风逍遥游
811eff1c3a
- EVENGINE_ENABLE_STRICT_WARNINGS option: MSVC /W4 /WX, GCC/Clang -Wall -Wextra -Werror, with documented noise suppressions and -isystem/-external:I for third-party headers; enabled on the Windows/Linux debug CI jobs. - Fix warnings across engine, modules and tests exposed by the gate, including real bugs (incomplete-type deletes, Timespan microsecond overflow, overload hiding, enum switch gaps, dead code). - Add Linux ASan+UBSan job, example smoke step, python-tools test job, ruff config (scripts+tools), weekly Linux coverage job and a CodeQL workflow.
83 lines
2.8 KiB
YAML
83 lines
2.8 KiB
YAML
# CodeQL security analysis (C++ engine + Python tools).
|
|
#
|
|
# Runs on pushes to dev, weekly, and on demand -- not on every PR -- because
|
|
# the C++ analysis requires a full instrumented build (~40 min). The SARIF
|
|
# results appear under Security -> Code scanning and are also posted as PR
|
|
# comments when a PR branch is analyzed.
|
|
|
|
name: CodeQL
|
|
|
|
on:
|
|
push:
|
|
branches: [dev]
|
|
schedule:
|
|
- cron: "0 16 * * 0"
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: codeql-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 60
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
language: ["cpp", "python"]
|
|
steps:
|
|
- name: Checkout
|
|
timeout-minutes: 10
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
submodules: recursive
|
|
|
|
- name: Install system packages (C++ build)
|
|
if: matrix.language == 'cpp'
|
|
timeout-minutes: 10
|
|
run: |
|
|
sudo sed -i -E 's#https?://[^/]*archive\.ubuntu\.com/ubuntu#http://archive.ubuntu.com/ubuntu#g' \
|
|
/etc/apt/apt-mirrors.txt /etc/apt/sources.list /etc/apt/sources.list.d/*.sources 2>/dev/null || true
|
|
sudo apt-get update -o Acquire::Retries=2 \
|
|
-o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30
|
|
sudo apt-get install -y --no-install-recommends \
|
|
build-essential cmake ninja-build \
|
|
libx11-dev libxxf86vm-dev libxi-dev libxcursor-dev \
|
|
libxrandr-dev libxinerama-dev libxext-dev libxss-dev \
|
|
libgl1-mesa-dev \
|
|
libbz2-dev libpng-dev \
|
|
libwayland-dev libxkbcommon-dev libasound2-dev \
|
|
mesa-vulkan-drivers vulkan-tools
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@v3
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
queries: security-and-quality
|
|
|
|
- name: Build (C++)
|
|
if: matrix.language == 'cpp'
|
|
timeout-minutes: 40
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
# Third-party deps ship prebuilt SDK headers/libs; the engine itself
|
|
# must be built under CodeQL tracing. BUILD_TESTING=OFF keeps the
|
|
# scan focused on engine sources and avoids the test-only TUs.
|
|
cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBUILD_PLATFORM=linux \
|
|
-DBUILD_TESTING=OFF \
|
|
-B build/codeql -S .
|
|
cmake --build build/codeql --target deps -j "$(nproc)"
|
|
cmake --build build/codeql -j "$(nproc)"
|
|
|
|
- name: Perform CodeQL analysis
|
|
uses: github/codeql-action/analyze@v3
|
|
with:
|
|
category: "/language:${{ matrix.language }}"
|