codeql.yml

# SPDX-License-Identifier: MIT
# Copyright (c) 2026 TrendVidia, LLC.

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "37 6 * * 1"

permissions:
  contents: read
  security-events: write

jobs:
  analyze:
    name: Analyze (cpp)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Install build deps
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            gcc-13 g++-13 protobuf-compiler libprotobuf-dev libprotoc-dev

      - uses: github/codeql-action/init@v4
        with:
          languages: cpp
          queries: security-and-quality
          config-file: ./.github/codeql/codeql-config.yml

      - name: Configure + build (drives CodeQL extraction)
        env:
          CC:  gcc-13
          CXX: g++-13
        run: |
          cmake -S . -B build
          cmake --build build -j 2

      # The config file's paths-ignore never applied to this build-based
      # C++ analysis (#23), so the exclusions are enforced here instead:
      # analyse with the upload deferred, drop the alerts in the excluded
      # paths from the SARIF, then upload. The rationale for each pattern
      # is in .github/codeql/codeql-config.yml.
      - uses: github/codeql-action/analyze@v4
        with:
          category: "/language:cpp"
          output: sarif-results
          upload: failure-only

      - uses: advanced-security/filter-sarif@v1.1
        with:
          patterns: |
            -cmd/**
            -test/**
            -build/**
            -src/pxf/dataset_reader.cc
          input: sarif-results/cpp.sarif
          output: sarif-results/cpp.sarif

      - uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: sarif-results/cpp.sarif
          category: "/language:cpp"