codeql.yml (3612B)
1 # Copyright (c) the JPEG XL Project Authors. All rights reserved. 2 # 3 # Use of this source code is governed by a BSD-style 4 # license that can be found in the LICENSE file. 5 6 # For most projects, this workflow file will not need changing; you simply need 7 # to commit it to your repository. 8 # 9 # You may wish to alter this file to override the set of languages analyzed, 10 # or to provide custom queries or build logic. 11 # 12 # ******** NOTE ******** 13 # We have attempted to detect the languages in your repository. Please check 14 # the `language` matrix defined below to confirm you have the correct set of 15 # supported CodeQL languages. 16 # 17 name: "CodeQL" 18 19 on: 20 push: 21 branches: ["main"] 22 pull_request: 23 # The branches below must be a subset of the branches above 24 branches: ["main"] 25 schedule: 26 - cron: "0 0 * * 1" 27 28 permissions: 29 contents: read 30 31 concurrency: 32 group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} 33 cancel-in-progress: ${{ github.event_name == 'pull_request' }} 34 35 jobs: 36 analyze: 37 name: Analyze 38 runs-on: ubuntu-latest 39 permissions: 40 actions: read 41 contents: read 42 security-events: write 43 44 strategy: 45 fail-fast: false 46 matrix: 47 language: ["cpp"] 48 # CodeQL supports [ $supported-codeql-languages ] 49 # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support 50 51 steps: 52 - name: Harden Runner 53 uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 54 with: 55 egress-policy: audit 56 57 - name: Checkout repository 58 uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 59 60 # Initializes the CodeQL tools for scanning. 61 - name: Initialize CodeQL 62 uses: github/codeql-action/init@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3 63 with: 64 languages: ${{ matrix.language }} 65 # If you wish to specify custom queries, you can do so here or in a config file. 66 # By default, queries listed here will override any specified in a config file. 67 # Prefix the list here with "+" to use these queries and those in the config file. 68 69 - name: Install build deps 70 run: | 71 sudo rm -f /var/lib/man-db/auto-update 72 sudo apt update 73 sudo apt install -y \ 74 ccache \ 75 clang \ 76 cmake \ 77 doxygen \ 78 graphviz \ 79 imagemagick \ 80 libbenchmark-dev \ 81 libbenchmark-tools \ 82 libbrotli-dev \ 83 libgdk-pixbuf2.0-dev \ 84 libgif-dev \ 85 libgtest-dev \ 86 libgtk2.0-dev \ 87 libjpeg-dev \ 88 libjpeg-turbo-progs \ 89 libopenexr-dev \ 90 libpng-dev \ 91 libwebp-dev \ 92 ninja-build \ 93 pkg-config \ 94 xvfb \ 95 ${{ matrix.apt_pkgs }} \ 96 # 97 echo "CC=${{ matrix.cc || 'clang' }}" >> $GITHUB_ENV 98 echo "CXX=${{ matrix.cxx || 'clang++' }}" >> $GITHUB_ENV 99 - name: Checkout the source 100 uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 101 with: 102 submodules: true 103 fetch-depth: 2 104 105 106 - name: Build 107 run: | 108 ./ci.sh opt -DJPEGXL_FORCE_SYSTEM_BROTLI=ON \ 109 -DBUILD_TESTING=OFF 110 env: 111 SKIP_TEST: 1 112 113 - name: Perform CodeQL Analysis 114 uses: github/codeql-action/analyze@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3 115 with: 116 category: "/language:${{matrix.language}}"