codeql.yml

#
name: "CodeQL"

on:
  push:
    branches: [ "main" ]
    paths:
      - 'Sources/**'
      - '.github/workflows/**'
      - '.github/codeql-config.yml'
  pull_request:
    branches: [ "main" ]
    paths:
      - 'Sources/**'
      - '.github/workflows/**'
      - '.github/codeql-config.yml'
  schedule:
    - cron: '45 14 * * 2'

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    # Runner size impacts CodeQL analysis time. To learn more, please see:
    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
    #   - https://gh.io/supported-runners-and-hardware-resources
    #   - https://gh.io/using-larger-runners (GitHub.com only)
    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
    runs-on: macos-15
    permissions:
      # required for all workflows
      security-events: write

      # required to fetch internal or private CodeQL packs
      packages: read

      # only required for workflows in private repositories
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
        - language: actions
          build-mode: none
        - language: swift
          build-mode: manual

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    # Install Swift 6.2.1 for Swift language analysis
    - name: Setup Swift 6.2.1
      if: matrix.language == 'swift'
      uses: swift-actions/setup-swift@v3
      with:
        swift-version: "6.2.1"

    # Install build dependencies for Swift
    - name: Install build dependencies
      if: matrix.language == 'swift'
      run: |
        brew install llvm@20 libgit2
        # Setup LLVM paths (ARM64 vs Intel)
        if [ -d "/opt/homebrew/opt/llvm@20" ]; then
          LLVM_PREFIX="/opt/homebrew/opt/llvm@20"
          LIBGIT2_PREFIX="/opt/homebrew/opt/libgit2"
        else
          LLVM_PREFIX="/usr/local/opt/llvm@20"
          LIBGIT2_PREFIX="/usr/local/opt/libgit2"
        fi
        echo "LLVM_PATH=$LLVM_PREFIX" >> $GITHUB_ENV
        echo "$LLVM_PREFIX/bin" >> $GITHUB_PATH
        # Set include paths for C/C++ compilation
        echo "C_INCLUDE_PATH=$LLVM_PREFIX/include:$LIBGIT2_PREFIX/include" >> $GITHUB_ENV
        echo "CPLUS_INCLUDE_PATH=$LLVM_PREFIX/include:$LIBGIT2_PREFIX/include" >> $GITHUB_ENV
        # Set library paths for linking
        echo "LIBRARY_PATH=$LLVM_PREFIX/lib:$LIBGIT2_PREFIX/lib" >> $GITHUB_ENV
        # Set runtime library paths
        echo "DYLD_LIBRARY_PATH=$LLVM_PREFIX/lib:$LIBGIT2_PREFIX/lib" >> $GITHUB_ENV
        echo "DYLD_FALLBACK_LIBRARY_PATH=$LLVM_PREFIX/lib:$LIBGIT2_PREFIX/lib" >> $GITHUB_ENV
        # Create pkg-config file for Swifty-LLVM
        mkdir -p $HOME/.pkgconfig
        printf 'prefix=%s\nexec_prefix=${prefix}\nlibdir=${prefix}/lib\nincludedir=${prefix}/include\n\nName: LLVM\nDescription: Low-level Virtual Machine compiler framework\nVersion: 20.1\nLibs: -L${libdir} -lLLVM\nCflags: -I${includedir}\n' "$LLVM_PREFIX" > $HOME/.pkgconfig/llvm.pc
        echo "PKG_CONFIG_PATH=$HOME/.pkgconfig" >> $GITHUB_ENV

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        config-file: .github/codeql-config.yml

    # Manual build step for Swift
    - name: Build Swift project
      if: matrix.language == 'swift'
      run: |
        # Build for ARM64 only (macos-15 runner is ARM64)
        # This prevents CodeQL tracing from triggering x86_64 builds
        swift build --arch arm64

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4
      with:
        category: "/language:${{matrix.language}}"