codeql.yml

# *******************************************************************************
# Copyright (c) 2025 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Apache License Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0
#
# SPDX-License-Identifier: Apache-2.0
# *******************************************************************************
name: "CodeQL Scan"

on:
  workflow_call:
    inputs:
      build-script:
        description: "bazel run command to run (e.g.: 'bazel build //src/...')"
        required: false
        default: "bazel build //..."
        type: string
      runner-labels:
        description: >-
          Runner label(s) for this workflow's jobs, overriding the repository/organization runner
          variables. Must be a JSON-encoded string: a single label as a JSON string (e.g.
          '"self-hosted"') or a JSON array of labels (e.g. '["self-hosted", "linux", "x64"]').
        required: false
        default: ""
        type: string
      github-app-client-id:
        description: GitHub App client ID used with `github-app-private-key` to access private dependencies; omit when using `token`
        required: false
        default: ""
        type: string
    secrets:
      github-app-private-key:
        description: GitHub App private key used with `github-app-client-id` to access private dependencies
        required: false
      token:
        description: Token for private dependencies; an alternative to GitHub App credentials
        required: false
jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ${{ inputs.runner-labels && fromJSON(inputs.runner-labels) || vars.runner_labels_ghub_standard_x64 && fromJSON(vars.runner_labels_ghub_standard_x64) || vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS) || 'ubuntu-latest' }}
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: c-cpp
            build-mode: manual
    steps:
      - uses: eclipse-score/more-disk-space@beee38c3b4426a7c43fdfeb2495d1af812179c3e # v1.3.0

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          lfs: true

      # Initializes the CodeQL tools for scanning.

      - name: Configure access to private dependencies
        uses: eclipse-score/cicd-actions/inter-repo-access@212bbf86267e9381da9d2daf962d12f6feafbc90 # main branch (2026-07-24)
        # An `if` condition cannot access secrets, so expose only their presence.
        env:
          HAS_GH_APP_PRIVATE_KEY: ${{ secrets.github-app-private-key != '' }}
          HAS_TOKEN: ${{ secrets.token != '' }}
        if: ${{ env.HAS_GH_APP_PRIVATE_KEY == 'true' || env.HAS_TOKEN == 'true' || inputs.github-app-client-id != '' }}
        with:
          token: ${{ secrets.token }}
          github-app-client-id: ${{ inputs.github-app-client-id }}
          github-app-private-key: ${{ secrets.github-app-private-key }}
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4.37.9
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          packs: codeql/misra-cpp-coding-standards

      - if: matrix.build-mode == 'manual'
        shell: bash
        run: ${{ inputs.build-script }}

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4.37.9
        with:
          category: "/language:${{matrix.language}}"
          output: sarif-results.sarif

      - name: Upload Artifact
        uses: actions/upload-artifact@v7.0.1
        with:
          name: sarif-results.sarif
          path: sarif-results.sarif