code-ql.yml

name: "Code Scanning - Action"

on: [push, pull_request]

env:
  # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
  BUILD_TYPE: Release
  CMAKE_OPTIONS: |
      -Dtests=OFF -Dsymbols=ON -Dwarnings-as-errors=OFF

jobs:
  pre_run:
    runs-on: ubuntu-latest
    outputs:
      should_skip: ${{ steps.skip_check.outputs.should_skip }}
    steps:
      - id: skip_check
        uses: fkirc/skip-duplicate-actions@v5
        with:
          concurrent_skipping: same_content_newer
          skip_after_successful_duplicate: 'true'

  CodeQL-Build:
    needs: pre_run
    if: needs.pre_run.outputs.should_skip != 'true'

    strategy:
      matrix:
        os: [ubuntu-latest]

    runs-on: ${{ matrix.os }}

    permissions:
      security-events: write
      actions: read
      contents: read

    steps:
    - uses: actions/checkout@v4
      with:
          submodules: 'recursive'

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
          languages: python, cpp

    - uses: ./.github/actions/install-dependencies
      with:
          type: shared
          os: ${{ matrix.os }}
          arch: 64bit

    - name: Create build dir
      run: cmake -E make_directory ${{runner.workspace}}/build

    - name: Run CMake
      run: |
          cmake -G Ninja -S $GITHUB_WORKSPACE -B ${{runner.workspace}}/build -DCMAKE_BUILD_TYPE=Release $CMAKE_OPTIONS -DCMAKE_UNITY_BUILD=ON
      shell: bash

    - name: Build
      working-directory: ${{runner.workspace}}/build
      run: cmake --build . --config $BUILD_TYPE
      shell: bash

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3