c2pool/.github/workflows/codeql-analysis.yml at 35fe7e7c03a0ca841d0ebabb36aeb835096e573a · frstrtr/c2pool · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
name: "CodeQL"

on:
  push:
    branches: ["master"]
  pull_request:
    branches: ["master"]
  schedule:
    - cron: '30 1 * * 1'   # Weekly on Monday 01:30 UTC

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","Linux","X64","c2pool-build"]') || 'ubuntu-24.04' }}
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: c-cpp
            build-mode: manual
          - language: python
            build-mode: none

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          queries: security-and-quality

      # ── C++ build (manual mode only) ─────────────────────────────────────
      - if: matrix.build-mode == 'manual' && runner.environment == 'github-hosted'
        name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends \
            g++ cmake make \
            libleveldb-dev \
            libsecp256k1-dev

      - if: matrix.build-mode == 'manual'
        name: Set up Python for Conan
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - if: matrix.build-mode == 'manual'
        name: Install Conan 2
        run: |
          pip install "conan>=2.0,<3.0"
          conan profile detect --force
          sed -i 's/compiler.cppstd=.*/compiler.cppstd=20/' \
            "$(conan profile path default)"

      - if: matrix.build-mode == 'manual'
        name: Restore Conan package cache
        uses: actions/cache@v5
        with:
          path: ~/.conan2
          # Share cache with build.yml (same Release profile)
          key: conan2-ubuntu24-gcc13-${{ hashFiles('conanfile.txt') }}
          restore-keys: conan2-ubuntu24-gcc13-

      - if: matrix.build-mode == 'manual' && runner.environment != 'github-hosted'
        name: Clean stale build dir (self-hosted workspace is reused)
        run: rm -rf build_codeql

      - if: matrix.build-mode == 'manual'
        name: Install Conan dependencies
        run: |
          conan install . \
            --build=missing \
            --output-folder=build_codeql \
            --settings=build_type=Release

      - if: matrix.build-mode == 'manual'
        name: Build for CodeQL analysis
        run: |
          cmake -S . -B build_codeql \
            -DCMAKE_TOOLCHAIN_FILE=build_codeql/conan_toolchain.cmake \
            -DCMAKE_BUILD_TYPE=Release
          cmake --build build_codeql --target c2pool -j$(nproc)

      # ── Analysis ──────────────────────────────────────────────────────────
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"