codeql.yml

name: CodeQL

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  schedule:
    - cron: "17 03 * * 1"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze ${{ matrix.name }}
    runs-on: ${{ matrix.runner }}

    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        include:
          - name: C/C++ POSIX
            language: c-cpp
            runner: ubuntu-latest
            build_mode: manual
            category: /language:c-cpp-posix
            build_command: |
              cmake -S . -B build-codeql-posix -DCMAKE_BUILD_TYPE=Debug
              cmake --build build-codeql-posix --parallel --target \
                netipc_protocol \
                netipc_uds \
                netipc_shm \
                netipc_service \
                test_protocol \
                interop_codec_c \
                fuzz_protocol \
                test_uds \
                interop_uds_c \
                test_shm \
                interop_shm_c \
                test_service \
                test_service_extra \
                test_service_payload_limits \
                test_service_method_limits \
                test_multi_server \
                interop_service_c \
                test_stress \
                test_ping_pong \
                test_chaos \
                test_hardening \
                test_cache \
                interop_cache_c \
                bench_posix_c
          - name: C/C++ Windows
            language: c-cpp
            runner: windows-latest
            build_mode: manual
            category: /language:c-cpp-windows
            msys2: true
            build_command: |
              cmake -S . -B build-codeql-windows -G Ninja \
                -DCMAKE_BUILD_TYPE=Debug \
                -DCMAKE_C_COMPILER=/usr/bin/gcc \
                -DCMAKE_CXX_COMPILER=/usr/bin/g++
              cmake --build build-codeql-windows \
                --parallel "$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4)" \
                --target \
                netipc_protocol \
                netipc_named_pipe \
                netipc_win_shm \
                netipc_service_win \
                test_named_pipe \
                interop_named_pipe_c \
                test_win_shm \
                test_win_service \
                test_win_service_extra \
                test_win_service_payload_limits \
                test_win_service_guards \
                test_win_service_guards_extra \
                test_win_stress \
                interop_win_shm_c \
                interop_service_win_c \
                interop_cache_win_c \
                bench_windows_c
          - name: Go POSIX
            language: go
            runner: ubuntu-latest
            build_mode: manual
            category: /language:go-posix
            build_command: |
              for module in src/go tests/fixtures/go bench/drivers/go; do
                (cd "$module" && go test ./...)
              done
          - name: Go Windows
            language: go
            runner: windows-latest
            build_mode: manual
            category: /language:go-windows
            msys2: true
            build_command: |
              for module in src/go tests/fixtures/go bench/drivers/go; do
                (cd "$module" && CGO_ENABLED=0 go test ./...)
              done
          - name: Rust
            language: rust
            runner: ubuntu-latest
            build_mode: none
            category: /language:rust
            build_command: ":"

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Go
        if: matrix.language == 'go'
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: src/go/go.mod
          cache: false

      - name: Set up MSYS2
        if: matrix.msys2 == true
        uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2
        with:
          msystem: MSYS
          update: true
          path-type: inherit
          install: >-
            base-devel
            gcc
            cmake
            ninja
            git

      - name: Initialize CodeQL
        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build_mode }}
          config-file: ./.github/codeql.yml

      - name: Build for CodeQL
        if: matrix.build_mode == 'manual' && matrix.msys2 != true
        run: ${{ matrix.build_command }}

      - name: Build for CodeQL on MSYS2
        if: matrix.build_mode == 'manual' && matrix.msys2 == true
        shell: msys2 {0}
        run: ${{ matrix.build_command }}

      - name: Analyze
        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          category: ${{ matrix.category }}