reusable_codeql.yml

# CodeQL static analysis
name: CodeQL

on: workflow_call

permissions:
  contents: read
  security-events: read

env:
  BUILD_DIR : "${{github.workspace}}/build"
  INSTL_DIR : "${{github.workspace}}/install-dir"

jobs:
  analyze:
    name: Analyze
    permissions:
      security-events: write
    env:
      VCPKG_PATH: "${{github.workspace}}/build/vcpkg/packages/hwloc_x64-windows;${{github.workspace}}/build/vcpkg/packages/tbb_x64-windows;${{github.workspace}}/build/vcpkg/packages/jemalloc_x64-windows"
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        include:
          - os: ubuntu-latest
            # Windows doesn't recognize 'CMAKE_BUILD_TYPE', it uses '--config' param in build command
            extra_build_option: '-DCMAKE_BUILD_TYPE=Release'
          - os: windows-latest
    runs-on: ${{matrix.os}}

    steps:
    - name: Checkout repository
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        fetch-depth: 0

    - name: Setup newer Python
      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
      with:
        python-version: "3.10"

    - name: Initialize CodeQL
      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
      with:
        languages: cpp
        trap-caching: false

    - name: "[Win] Restore vcpkg cache"
      if: matrix.os == 'windows-latest'
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      id: cache
      with:
        path: vcpkg_pkgs_cache.zip
        key: vcpkg-codeql-${{matrix.os}}-${{ hashFiles('vcpkg.json') }}

    - name: "[Win] Unpack vcpkg cache"
      if: matrix.os == 'windows-latest' && steps.cache.outputs.cache-hit == 'true'
      run: |
        Expand-Archive -Path ${{github.workspace}}/vcpkg_pkgs_cache.zip -DestinationPath ${{env.BUILD_DIR}}/vcpkg -Force

    - name: "[Win] Initialize vcpkg"
      if: matrix.os == 'windows-latest' && steps.cache.outputs.cache-hit != 'true'
      uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11.6
      with:
        vcpkgGitCommitId: ea2a964f9303270322cf3f2d51c265ba146c422d # 1.04.2025
        vcpkgDirectory: ${{env.BUILD_DIR}}/vcpkg
        vcpkgJsonGlob: '**/vcpkg.json'

    - name: "[Win] Install vcpkg dependencies"
      if: matrix.os == 'windows-latest' && steps.cache.outputs.cache-hit != 'true'
      env:
        VCPKG_BINARY_SOURCES: clear
      run: vcpkg install --triplet x64-windows

    - name: "[Win] Install Python requirements"
      if: matrix.os == 'windows-latest'
      run: python3 -m pip install -r third_party/requirements.txt

    - name: "[Lin] Install apt packages"
      if: matrix.os == 'ubuntu-latest'
      run: |
        sudo apt-get update
        sudo apt-get install -y cmake clang libhwloc-dev libnuma-dev libtbb-dev

    # Latest distros do not allow global pip installation
    - name: "[Lin] Install Python requirements in venv"
      if: matrix.os == 'ubuntu-latest'
      run: |
        python3 -m venv .venv
        . .venv/bin/activate
        echo "$PATH" >> $GITHUB_PATH
        python3 -m pip install -r third_party/requirements.txt

    - name: Configure CMake
      run: >
        cmake
        -B ${{env.BUILD_DIR}}
        ${{matrix.extra_build_option}}
        -DCMAKE_INSTALL_PREFIX="${{env.INSTL_DIR}}"
        -DCMAKE_PREFIX_PATH="${{env.VCPKG_PATH}}"
        -DUMF_FORMAT_CODE_STYLE=OFF
        -DUMF_DEVELOPER_MODE=ON
        -DUMF_BUILD_LIBUMF_POOL_JEMALLOC=ON
        -DUMF_BUILD_LEVEL_ZERO_PROVIDER=ON
        -DUMF_BUILD_CUDA_PROVIDER=ON
        -DUMF_TESTS_FAIL_ON_SKIP=ON

    - name: Build
      run: cmake --build ${{env.BUILD_DIR}} --config Release -j

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

    - name: "[Win] Prepare vcpkg cache"
      if: matrix.os == 'windows-latest' && steps.cache.outputs.cache-hit != 'true'
      run: |
        Compress-Archive -Path ${{env.BUILD_DIR}}/vcpkg/packages -DestinationPath ${{github.workspace}}/vcpkg_pkgs_cache.zip -Force -CompressionLevel Fastest

    - name: "[Win] Save vcpkg cache"
      if: matrix.os == 'windows-latest' && steps.cache.outputs.cache-hit != 'true'
      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ${{github.workspace}}/vcpkg_pkgs_cache.zip
        key: ${{ steps.cache.outputs.cache-primary-key }}