vc3d-codeql.yml

name: CodeQL

on:
  # Always trigger on PRs so required checks appear and can succeed fast via a no-op.
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  push:
    branches: [ main ]  # scan after merge too
    paths:
      - 'volume-cartographer/**'
      - '.github/codeql/**'
      - '.github/workflows/vc3d-codeql.yml'
# Keep an on-demand lever now that schedule (which can't be path-filtered) is removed.
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  changes:
    name: Detect changes
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      pull-requests: read
      contents: read
    outputs:
      vc: ${{ steps.filter.outputs.vc }}
    steps:
    # On push events paths-filter uses git and needs a checkout.
      - name: Checkout (non-PR events)
        if: github.event_name != 'pull_request'
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Paths filter
        id: filter
        uses: dorny/paths-filter@v3
        with:
          filters: |
            vc:
              - 'volume-cartographer/**'
              - '.github/codeql/**'
              - '.github/workflows/vc3d-codeql.yml'

  # Fast PR scans use independent source databases so extraction and queries
  # run concurrently. The post-merge deep scan remains monolithic to retain
  # cross-component data-flow analysis.
  analyze_fast_shards:
    name: PR scan (${{ matrix.name }})
    if: github.event_name == 'pull_request' && needs.changes.outputs.vc == 'true'
    needs: [changes]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: core
            id: core
            config: .github/codeql/codeql-pr-core.yml
          - name: VC3D controllers
            id: vc3d-controllers
            config: .github/codeql/codeql-pr-vc3d-controllers.yml
          - name: VC3D components
            id: vc3d-components
            config: .github/codeql/codeql-pr-vc3d-components.yml
          - name: tools and libraries
            id: tools-libs
            config: .github/codeql/codeql-pr-tools-libs.yml
    permissions:
      security-events: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Initialize CodeQL (no build)
        uses: github/codeql-action/init@v3
        with:
          languages: c-cpp
          build-mode: none
          queries: security-extended
          config-file: ${{ matrix.config }}

      - name: Analyze
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:c-cpp/shard:${{ matrix.id }}"

  # Preserve the existing required-check name while making it reflect every
  # parallel PR shard. Unrelated PRs still receive a successful no-op result.
  analyze_fast:
    if: always() && github.event_name == 'pull_request'
    needs: [changes, analyze_fast_shards]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Verify change detection
        env:
          CHANGES_RESULT: ${{ needs.changes.result }}
        run: |
          if [[ "$CHANGES_RESULT" != "success" ]]; then
            echo "Change detection failed: $CHANGES_RESULT" >&2
            exit 1
          fi

      - name: No-op (unrelated changes)
        if: needs.changes.outputs.vc != 'true'
        run: echo "No volume-cartographer or CodeQL changes; PR scan skipped."

      - name: Verify PR scan shards
        if: needs.changes.outputs.vc == 'true'
        env:
          SHARDS_RESULT: ${{ needs.analyze_fast_shards.result }}
        run: |
          if [[ "$SHARDS_RESULT" != "success" ]]; then
            echo "One or more CodeQL PR shards failed: $SHARDS_RESULT" >&2
            exit 1
          fi

  # 🧪 Deep scan for push/schedule: compiles with fast settings
  analyze_deep:
    if: github.event_name == 'push'
    needs: [changes]
    # Pin to Ubuntu 26.04 (resolute) rather than ubuntu-latest (still 24.04).
    # install_build_deps.sh — the single source of truth for the VC3D
    # toolchain, shared with the Dockerfile (FROM ubuntu:26.04) — pulls
    # flang-21 / libclang-rt-21-dev, which only exist in 26.04's default
    # repos. On noble the deps install failed with "Unable to locate package".
    # NOTE: ubuntu-26.04 is currently a *preview* runner image; revisit once
    # ubuntu-latest migrates to 26.04 (GA), at which point this pin can drop.
    runs-on: ubuntu-26.04
    timeout-minutes: 360
    container:
      image: ghcr.io/scrollprize/vc3d-deps/linux:sha-0c371b1d472c5281b703d65517e980d945da693f
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    permissions:
      security-events: write
      contents: read
      packages: read
    steps:
      - name: No-op (unrelated changes)
        if: needs.changes.outputs.vc != 'true'
        run: echo "✅ No volume-cartographer changes — skipping CodeQL deep scan."

      - name: Checkout
        if: needs.changes.outputs.vc == 'true'
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # history-aware queries if needed

      - name: Initialize CodeQL
        if: needs.changes.outputs.vc == 'true'
        uses: github/codeql-action/init@v3
        with:
          languages: c-cpp
          build-mode: manual
          queries: security-extended,security-and-quality
          config-file: .github/codeql/codeql-config.yml

      - name: Configure (Ninja, fast flags)
        if: needs.changes.outputs.vc == 'true'
        working-directory: ./volume-cartographer
        run: |
          cmake -S . -B build -G Ninja \
                -DVC_TESTING=OFF \
                -DCMAKE_BUILD_TYPE=Debug \
                -DCMAKE_C_COMPILER=gcc \
                -DCMAKE_CXX_COMPILER=g++

      - name: Build (fast)
        if: needs.changes.outputs.vc == 'true'
        working-directory: ./volume-cartographer
        run: ninja -C build

      - name: Analyze
        if: needs.changes.outputs.vc == 'true'
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:c-cpp"