ci: add CodeQL Advanced analysis workflow#10
Conversation
- Uses Visual Studio 2026 generator (not FASTBuild) for CodeQL compatibility - Runs on push to main, PRs, and weekly schedule (Wed 17:19 UTC) - Reuses vcpkg cache from Windows CI workflow via restore-keys fallback - Temporarily includes ci/add-codeql-analysis branch for testing Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds a new GitHub Actions workflow to run CodeQL Advanced security analysis for the repository’s C/C++ codebase on the Windows VS2026 runner, using a manual CMake/MSBuild build to enable CodeQL tracing.
Changes:
- Introduces
.github/workflows/codeql.ymlto run CodeQL on pushes tomain, PRs tomain, and a weekly schedule. - Uses the
windows-vsCMake preset (VS 2026 generator) and buildsReleaseviacmake --build build/vs --config Release. - Adds vcpkg/Qt setup steps intended to mirror Windows CI dependency provisioning.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| on: | ||
| push: | ||
| branches: [main, ci/add-codeql-analysis] # TODO: remove ci/add-codeql-analysis after testing |
There was a problem hiding this comment.
The push trigger still includes the temporary testing branch ci/add-codeql-analysis. Per the PR description this should be removed before merge; otherwise the workflow will keep running on that branch indefinitely.
| uses: actions/cache@v4 | ||
| with: | ||
| path: C:\vcpkg\installed | ||
| key: vcpkg-x64-windows-${{ hashFiles('vcpkg.json') }}-v1 |
There was a problem hiding this comment.
Cache key uses hashFiles('vcpkg.json'), but this repo does not contain a vcpkg.json, so hashFiles will be empty and the key will effectively be constant (risking stale/incorrect caches when the vcpkg package list changes). Use a hash input that actually changes with the package set (e.g., include this workflow file like Windows CI does, or hash a file that defines the dependency list).
| key: vcpkg-x64-windows-${{ hashFiles('vcpkg.json') }}-v1 | |
| key: vcpkg-x64-windows-${{ hashFiles('.github/workflows/codeql.yml') }}-v1 |
MSBuild defaults to single-threaded project building. Add --parallel flag so CMake passes /m to MSBuild, enabling multi-core compilation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Add paths config to only analyze project source code (app/, tools/) - third_party/ and foundation/ excluded — foundation has its own repo - Remove temporary ci/add-codeql-analysis branch from push trigger Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
CodeQL now only runs on push to main (post-merge) and weekly schedule. Avoids redundant scans on every PR. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Summary
Add CodeQL Advanced security analysis for C/C++ code.
Details
estore-keys\ fallback)
Differences from Windows CI workflow