codeql.yml

name: "CodeQL"

on:
  pull_request:
    branches: ["development"]

  push:
    branches: ["development"]

  workflow_dispatch:

permissions:
  actions: read
  contents: read
  security-events: write
  packages: read
  id-token: write

concurrency:
  group: "codeql"
  cancel-in-progress: false

jobs:
  analyze:
    name: Analyze
    runs-on: [self-hosted, linux, X64]
    timeout-minutes: 360

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: cpp
            build-mode: manual
          - language: python
            build-mode: none

    steps:
      - name: Setup Action Environment
        if: always()
        run: |
          cd /opt
          if [ ! -d "Autonomy_Software" ]; then git clone --recurse-submodules -j8 https://github.com/MissouriMRDT/Autonomy_Software.git; fi

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Fix Dubious Ownership
        run: git config --global --add safe.directory /opt/Autonomy_Software

      - name: Extract branch name
        shell: bash
        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
        id: extract_branch

      - name: Update Branch
        run: |
          cd /opt/Autonomy_Software/
          git fetch --force --recurse-submodules
          branch=${{ steps.extract_branch.outputs.branch }}
          echo $branch
          git reset --hard origin/$branch
          git checkout $branch
          git pull --ff-only
          git submodule update --force --recursive --init
          git config --global --add safe.directory /opt/Autonomy_Software/external

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: security-extended
          build-mode: ${{ matrix.build-mode }}

      - name: Manual Build
        if: matrix.build-mode == 'manual'
        shell: bash
        run: |
          cd /opt/Autonomy_Software/
          if [ -d "build" ]; then rm -Rf build; fi
          mkdir build
          cd build
          cmake -DBUILD_TESTS_MODE=OFF ..
          make

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{matrix.language}}"

      - name: Cleanup Action Environment
        if: always()
        run: |
          cd /opt
          rm -rf /opt/Autonomy_Software