codeql.yml

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL Advanced"

on:
  push:
    branches: [ "master" ]
    paths-ignore:
      - '**/*.md'
      - '**/*.txt'
      - '**/*.jpg'
      - '**/*.png'
      - 'docs/*'
      - 'case_studies/*'
  pull_request:
    branches: [ "master" ]
    paths-ignore:
      - '**/*.md'
      - '**/*.txt'
      - '**/*.jpg'
      - '**/*.png'
      - 'docs/*'
      - 'case_studies/*'

  schedule:
    - cron: '43 6 * * 3'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
   MPICH_VERSION: 4.1.2
   NETCDF_VERSION: 4.9.2

jobs:
  analyze:
      name: Analyze c-cpp
      # Runner size impacts CodeQL analysis time. To learn more, please see:
      #   - https://gh.io/recommended-hardware-resources-for-running-codeql
      #   - https://gh.io/supported-runners-and-hardware-resources
      #   - https://gh.io/using-larger-runners (GitHub.com only)
      # Consider using larger runners or machines with greater resources for possible analysis time improvements.
      runs-on: ubuntu-latest
      timeout-minutes: 20
      permissions:
        # required for all workflows
        security-events: write

        # required to fetch internal or private CodeQL packs
        packages: read

      strategy:
        fail-fast: false
        matrix:
          include:
          - language: c-cpp
            build-mode: manual
          # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
          # Use `c-cpp` to analyze code written in C, C++ or both
          # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
          # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
          # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
          # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
          # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
          # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
      steps:
        - name: Checkout repository
          uses: actions/checkout@v4.1.1

        - name: Set up dependencies
          run: |
            sudo apt-get update
            sudo apt-get install automake autoconf libtool libtool-bin m4 uuid-dev
            # The MPICH installed on github actions is too slow
            # sudo apt-get install mpich
            # mpicc -v
            # zlib
            sudo apt-get install zlib1g-dev

        - name: Build MPICH
          run: |
            cd ${GITHUB_WORKSPACE}
            rm -rf MPICH ; mkdir MPICH ; cd MPICH
            wget -q https://www.mpich.org/static/downloads/${MPICH_VERSION}/mpich-${MPICH_VERSION}.tar.gz
            gzip -dc mpich-${MPICH_VERSION}.tar.gz | tar -xf -
            cd mpich-${MPICH_VERSION}
            ./configure --prefix=${GITHUB_WORKSPACE}/MPICH \
                        --silent \
                        --enable-romio \
                        --with-file-system=ufs \
                        --with-device=ch3:sock \
                        --disable-fortran \
                        CC=gcc
            make -s LIBTOOLFLAGS=--silent V=1 -j 4 install > qout 2>&1
            make -s -j 4 distclean >> qout 2>&1

        - name: Install HDF5
          run: |
            cd ${GITHUB_WORKSPACE}
            rm -rf HDF5 ; mkdir HDF5 ; cd HDF5
            wget -cq https://github.com/HDFGroup/hdf5/releases/latest/download/hdf5.tar.gz
            tar -zxf hdf5.tar.gz
            cd hdf5-*
            ./configure --prefix=${GITHUB_WORKSPACE}/HDF5 \
                        --silent \
                        --enable-parallel \
                        --enable-build-mode=production \
                        --enable-unsupported \
                        --enable-threadsafe \
                        --disable-doxygen-doc \
                        --disable-doxygen-man \
                        --disable-doxygen-html \
                        --disable-tests \
                        --disable-fortran \
                        --disable-cxx \
                        --enable-shared --disable-static \
                        CC=${GITHUB_WORKSPACE}/MPICH/bin/mpicc
            make -s LIBTOOLFLAGS=--silent V=1 -j 4 install > qout 2>&1
            make -s -j 4 distclean >> qout 2>&1

        - name: Install NetCDF
          run: |
            cd ${GITHUB_WORKSPACE}
            rm -rf /NetCDF ; mkdir NetCDF ; cd NetCDF
            wget -qc https://github.com/Unidata/netcdf-c/archive/refs/tags/v${NETCDF_VERSION}.tar.gz
            tar -zxf v${NETCDF_VERSION}.tar.gz
            cd netcdf-c-${NETCDF_VERSION}
            ./configure --prefix=${GITHUB_WORKSPACE}/NetCDF \
                        --silent \
                        --disable-dap \
                        --disable-nczarr \
                        --disable-nczarr-filters \
                        --disable-filter-testing \
                        --disable-byterange \
                        CC=${GITHUB_WORKSPACE}/MPICH/bin/mpicc \
                        CPPFLAGS="-I${GITHUB_WORKSPACE}/HDF5/include" \
                        LDFLAGS="-L${GITHUB_WORKSPACE}//HDF5/lib" \
                        LIBS="-lhdf5"
            make -s LIBTOOLFLAGS=--silent V=1 -j 4 install > qout 2>&1
            make -s -j 4 distclean >> qout 2>&1

        # Initializes the CodeQL tools for scanning.
        - name: Initialize CodeQL
          uses: github/codeql-action/init@v3
          with:
            languages: c-cpp
            build-mode: manual
            config-file: ./.github/codeql-config.yml
            # If you wish to specify custom queries, you can do so here or in a config file.
            # By default, queries listed here will override any specified in a config file.
            # Prefix the list here with "+" to use these queries and those in the config file.

            # For more details on CodeQL's query packs, refer to:
            #https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
            queries: +security-extended,security-and-quality

        - name: Configure Log VOL connector
          run: |
            cd ${GITHUB_WORKSPACE}
            autoreconf -i
            ./configure --with-hdf5=${GITHUB_WORKSPACE}/HDF5 \
                        --enable-test-netcdf4=${GITHUB_WORKSPACE}/NetCDF \
                        --disable-test-hdf5-iotest \
                        --with-mpi=${GITHUB_WORKSPACE}/MPICH
            # Do NOT test QMCPACK, as it requires FFTW which fails to build

#        - name: Print config.log if error
#          if: ${{ failure() }}
#          run: |
#            cd ${GITHUB_WORKSPACE}
#            cat config.log

        - name: Build Log VOL connector
          if: ${{ success() }}
          run: |
            cd ${GITHUB_WORKSPACE}
            make -j 4
            # Do NOT parallel build, cmake for external tests can fail
            make tests

        - name: Serial-run test - make check
          if: ${{ success() }}
          run: |
            cd ${GITHUB_WORKSPACE}
            make check

        - name: Print test log files
          if: ${{ always() }}
          run: |
            cd ${GITHUB_WORKSPACE}
            fname=`find tests utils examples -type f -name "*.log"`
            for f in $fname ; do \
               bname=`basename $f` ; \
               if test "x$bname" != xconfig.log ; then \
                  echo "-------- dump $f ----------------------------" ; \
                  cat $f ; \
               fi ; \
            done

        - name: Parallel-run test - make ptest
          if: ${{ success() }}
          run: |
            cd ${GITHUB_WORKSPACE}
            make ptest

        - name: Test distribution - make distcheck
          if: ${{ success() }}
          run: |
            cd ${GITHUB_WORKSPACE}
            make -j4 -s V=1 LIBTOOLFLAGS=--silent distcheck DISTCHECK_CONFIGURE_FLAGS="--silent --with-hdf5=${GITHUB_WORKSPACE}/HDF5 --with-mpi=${GITHUB_WORKSPACE}/MPICH"

#        - name: make distclean
#          if: ${{ always() }}
#          run: |
#            cd ${GITHUB_WORKSPACE}
#            make -s distclean

        - name: Perform CodeQL Analysis
          uses: github/codeql-action/analyze@v3
          with:
            category: "/language:c-cpp"
            output: sarif-results
            upload: failure-only

        - name: filter-sarif
          uses: advanced-security/filter-sarif@main
          with:
            patterns: |
              -**/*
              src/**/*
            input: sarif-results/cpp.sarif
            output: sarif-results/cpp.sarif

        - name: Upload SARIF
          uses: github/codeql-action/upload-sarif@v3
          with:
            sarif_file: sarif-results/cpp.sarif

        - name: Upload loc as a Build Artifact
          uses: actions/upload-artifact@v4
          with:
            name: sarif-results
            path: sarif-results
            retention-days: 1