ci(codeql): cap Analyze (c-cpp) build+run-queries footprint on self-hosted 905 (#611)

CodeQL was auto-sizing run-queries to --ram=60466 --threads=32 (nearly the
whole 905 box) and building with -j$(nproc). When it ran concurrently with
an ASan job on the shared self-hosted runner both jobs co-OOMed (exit-137 /
conclusion=null kill), leaving Analyze (c-cpp) as the lone red on DASH PRs
while every other toolchain compiled the identical code green.

Cap self-hosted only: build -j8, analyze threads=12 ram=20000MB, leaving
headroom for a concurrent ASan job. github-hosted (fork) runs keep auto
defaults (threads/ram=0, -j$(nproc)).

Co-authored-by: frstrtr <frstrtr@users.noreply.github.com>

Author: frstrtr

.github/workflows/codeql-analysis.yml

@@ -95,10 +95,24 @@ jobs:
           cmake -S . -B build_codeql \
             -DCMAKE_TOOLCHAIN_FILE=build_codeql/conan_toolchain.cmake \
             -DCMAKE_BUILD_TYPE=Release
-          cmake --build build_codeql --target c2pool -j$(nproc)
+          # Cap build parallelism on the shared self-hosted 905 box so the
+          # CodeQL build does not co-OOM with a concurrent ASan job.
+          # github-hosted (fork) runs keep full parallelism.
+          if [ "${{ runner.environment }}" = "github-hosted" ]; then
+            JOBS=$(nproc)
+          else
+            JOBS=8
+          fi
+          cmake --build build_codeql --target c2pool -j"$JOBS"
 
       # ── Analysis ──────────────────────────────────────────────────────────
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{ matrix.language }}"
+          # Cap the run-queries footprint on the shared self-hosted 905 box so
+          # CodeQL does not co-OOM with a concurrent ASan job (was auto-sizing
+          # to --ram=60466 --threads=32, nearly the whole box). 0 = action
+          # auto-default, kept for github-hosted (fork) runs.
+          threads: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && '12' || '0' }}
+          ram: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && '20000' || '0' }}