codeql.yml

name: CodeQL

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]
  schedule:
    - cron: '0 6 * * 1'  # weekly Monday 06:00 UTC
  workflow_dispatch:

jobs:
  analyze:
    name: Analyze (C++)
    runs-on: ubuntu-24.04
    permissions:
      security-events: write
      actions: read
      contents: read
    strategy:
      fail-fast: false
      matrix:
        language: [ 'cpp' ]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install LLVM 22 (for build)
        run: |
          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc > /dev/null
          echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-22 main" | sudo tee /etc/apt/sources.list.d/llvm22.list
          sudo apt-get update
          sudo apt-get install -y \
            cmake ninja-build \
            llvm-22 llvm-22-dev clang-22 libclang-22-dev libclang-cpp22-dev \
            libboost-all-dev libgmp-dev

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: security-and-quality

      - name: Configure
        run: |
          cmake -B build -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_C_COMPILER=clang-22 \
            -DCMAKE_CXX_COMPILER=clang++-22 \
            -DLLVM_DIR=/usr/lib/llvm-22/lib/cmake/llvm

      - name: Build (for CodeQL autobuild alternative)
        run: cmake --build build -j $(nproc)

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{matrix.language}}"