reusable_codeql.yml

# CodeQL static analysis
name: CodeQL

on: workflow_call

permissions:
  contents: read
  security-events: read

env:
  BUILD_DIR : "${{github.workspace}}/build"
  INSTL_DIR : "${{github.workspace}}/install-dir"

jobs:
  analyze:
    name: Analyze
    permissions:
      security-events: write
    env:
      VCPKG_PATH: "${{github.workspace}}/build/vcpkg/packages/hwloc_x64-windows;${{github.workspace}}/build/vcpkg/packages/tbb_x64-windows;${{github.workspace}}/build/vcpkg/packages/jemalloc_x64-windows"
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        include:
          - os: ubuntu-latest
            # Windows doesn't recognize 'CMAKE_BUILD_TYPE', it uses '--config' param in build command
            extra_build_option: '-DCMAKE_BUILD_TYPE=Release'
          - os: windows-latest
    runs-on: ${{matrix.os}}

    steps:
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        fetch-depth: 0

    - name: Setup newer Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: "3.10"

    - name: Initialize CodeQL
      uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
      with:
        languages: cpp
        trap-caching: false

    - name: "[Win] Restore vcpkg cache"
      if: matrix.os == 'windows-latest'
      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
      id: cache
      with:
        path: vcpkg_pkgs_cache.zip
        key: vcpkg-codeql-${{matrix.os}}-${{ hashFiles('vcpkg.json') }}

    - name: "[Win] Unpack vcpkg cache"
      if: matrix.os == 'windows-latest' && steps.cache.outputs.cache-hit == 'true'
      run: |
        Expand-Archive -Path ${{github.workspace}}/vcpkg_pkgs_cache.zip -DestinationPath ${{env.BUILD_DIR}}/vcpkg -Force

    - name: "[Win] Initialize vcpkg"
      if: matrix.os == 'windows-latest' && steps.cache.outputs.cache-hit != 'true'
      uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5
      with:
        vcpkgGitCommitId: ea2a964f9303270322cf3f2d51c265ba146c422d # 1.04.2025
        vcpkgDirectory: ${{env.BUILD_DIR}}/vcpkg
        vcpkgJsonGlob: '**/vcpkg.json'

    - name: "[Win] Install vcpkg dependencies"
      if: matrix.os == 'windows-latest' && steps.cache.outputs.cache-hit != 'true'
      run: vcpkg install --triplet x64-windows

    - name: "[Win] Install Python requirements"
      if: matrix.os == 'windows-latest'
      run: python3 -m pip install -r third_party/requirements.txt

    - name: "[Lin] Install apt packages"
      if: matrix.os == 'ubuntu-latest'
      run: |
        sudo apt-get update
        sudo apt-get install -y cmake clang libhwloc-dev libnuma-dev libtbb-dev

    # Latest distros do not allow global pip installation
    - name: "[Lin] Install Python requirements in venv"
      if: matrix.os == 'ubuntu-latest'
      run: |
        python3 -m venv .venv
        . .venv/bin/activate
        echo "$PATH" >> $GITHUB_PATH
        python3 -m pip install -r third_party/requirements.txt

    - name: Configure CMake
      run: >
        cmake
        -B ${{env.BUILD_DIR}}
        ${{matrix.extra_build_option}}
        -DCMAKE_INSTALL_PREFIX="${{env.INSTL_DIR}}"
        -DCMAKE_PREFIX_PATH="${{env.VCPKG_PATH}}"
        -DUMF_FORMAT_CODE_STYLE=OFF
        -DUMF_DEVELOPER_MODE=ON
        -DUMF_BUILD_LIBUMF_POOL_JEMALLOC=ON
        -DUMF_BUILD_LEVEL_ZERO_PROVIDER=ON
        -DUMF_BUILD_CUDA_PROVIDER=ON
        -DUMF_TESTS_FAIL_ON_SKIP=ON

    - name: Build
      run: cmake --build ${{env.BUILD_DIR}} --config Release -j

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0

    - name: "[Win] Prepare vcpkg cache"
      if: matrix.os == 'windows-latest' && steps.cache.outputs.cache-hit != 'true'
      run: |
        Compress-Archive -Path ${{env.BUILD_DIR}}/vcpkg/packages -DestinationPath ${{github.workspace}}/vcpkg_pkgs_cache.zip -Force -CompressionLevel Fastest

    - name: "[Win] Save vcpkg cache"
      if: matrix.os == 'windows-latest' && steps.cache.outputs.cache-hit != 'true'
      uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
      with:
        path: ${{github.workspace}}/vcpkg_pkgs_cache.zip
        key: ${{ steps.cache.outputs.cache-primary-key }}