ArcVideo/.github/workflows/codeql.yml at main · ArcForges/ArcVideo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
name: "CodeQL Advanced"

on:
  schedule:
    - cron: "0 0 1 * *"
  workflow_dispatch:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  security-events: write
  packages: read
  actions: read
  contents: read

defaults:
  run:
    shell: bash

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: [self-hosted, linux, arcforges]
    if: >-
      github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository
    timeout-minutes: 180
    env:
      VCPKG_DEFAULT_BINARY_CACHE: /cache/vcpkg
      VCPKG_DEFAULT_HOST_TRIPLET: x64-linux-dynamic
      GLOBAL_VCPKG_PATH: /tmp/vcpkg
      VCPKG_MAX_CONCURRENCY: 6
      CMAKE_BUILD_PARALLEL_LEVEL: 6

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: c-cpp
            build-mode: manual

    steps:
      # ── Checkout ──────────────────────────────────────────────
      - name: Checkout
        uses: actions/checkout@v6

      # ── Toolchain ─────────────────────────────────────────────
      - name: Install system dependencies
        run: |
          set -euo pipefail
          apt-get update -qq
          apt-get install -y --no-install-recommends \
            wget unzip git curl pkg-config \
            autoconf autoconf-archive automake libtool \
            libltdl-dev \
            lsb-release software-properties-common gnupg ca-certificates \
            libgl-dev libx11-dev libxkbcommon-dev libxcb-cursor-dev \
            libfontconfig1-dev libfreetype-dev libegl-dev \
            g++ nasm bison flex \
            '^libxcb.*-dev' libx11-xcb-dev libglu1-mesa-dev \
            libxrender-dev libxi-dev libxkbcommon-x11-dev libegl1-mesa-dev \
            libsm-dev libice-dev
          wget -qO- https://apt.llvm.org/llvm.sh | bash -s -- 20
          update-alternatives --install /usr/bin/clang   clang   /usr/bin/clang-20   100
          update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-20 100
          update-alternatives --install /usr/bin/lld     lld     /usr/bin/lld-20     100

      - name: Install CMake 4.2.3
        run: |
          wget -qO- https://github.com/Kitware/CMake/releases/download/v4.2.3/cmake-4.2.3-linux-x86_64.tar.gz \
            | tar -xz -C /tmp
          echo "/tmp/cmake-4.2.3-linux-x86_64/bin" >> "$GITHUB_PATH"

      - name: Install FASTBuild v1.19
        run: |
          mkdir -p /tmp/fastbuild
          wget -O /tmp/fastbuild.zip \
            https://www.fastbuild.org/downloads/v1.19/FASTBuild-Linux-x64-v1.19.zip
          unzip -o /tmp/fastbuild.zip -d /tmp/fastbuild
          chmod +x /tmp/fastbuild/fbuild /tmp/fastbuild/fbuildworker
          ln -sf /tmp/fastbuild/fbuild /tmp/fastbuild/FBuild
          echo "/tmp/fastbuild" >> "$GITHUB_PATH"

      - name: Setup vcpkg
        run: |
          if [ ! -f /tmp/vcpkg/vcpkg ]; then
            rm -rf /tmp/vcpkg
            git clone --depth 1 https://github.com/microsoft/vcpkg.git /tmp/vcpkg
            /tmp/vcpkg/bootstrap-vcpkg.sh -disableMetrics
          fi
          echo "VCPKG_ROOT=/tmp/vcpkg" >> "$GITHUB_ENV"
          echo "/tmp/vcpkg" >> "$GITHUB_PATH"

      - name: Verify tool versions
        run: |
          echo "CMake:    $(cmake --version | head -1)"
          echo "Clang:    $(clang++ --version | head -1)"
          echo "FBuild:   $(fbuild -version 2>&1 | head -1)"
          echo "vcpkg:    $(vcpkg version 2>&1 | head -2 | tail -1)"

      # ── vcpkg ─────────────────────────────────────────────────
      - name: Ensure vcpkg binary cache dir
        run: mkdir -p "$VCPKG_DEFAULT_BINARY_CACHE"

      - name: Clone ArcVideoRegistry (overlay ports)
        run: git clone --depth 1 https://github.com/ArcForgesLabs/ArcVideoRegistry.git /tmp/ArcVideoRegistry

      - name: Install base vcpkg packages
        run: |
          vcpkg install \
            --triplet x64-linux-dynamic \
            --host-triplet x64-linux-dynamic \
            --overlay-ports=/tmp/ArcVideoRegistry/ports \
            opencolorio openimageio openexr imath ffmpeg \
            portaudio crashpad qtbase rapidjson pybind11 kddockwidgets \
            opentimelineio arcvideo-foundation

      # ── CodeQL ────────────────────────────────────────────────
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          queries: security-and-quality
          config: |
            paths:
              - app

      - name: Configure (CMake)
        run: cmake --preset linux-ci -DUSE_WERROR=ON

      - name: Build
        run: cmake --build build/linux-ci

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"