zeal/.github/workflows/analyze-codeql.yaml

name: CodeQL Scan

on:
  push:
    branches: [main]
  pull_request:
    # The branches below must be a subset of the branches above.
    branches: [main]
  schedule:
  - cron: '0 8 * * 6'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze-codeql:
    name: Analyze
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      security-events: write

    steps:
    - name: Checkout Repository
      uses: actions/checkout@v6

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: c-cpp
        build-mode: manual
        queries: security-and-quality,./.github/codeql/queries
        config-file: .github/codeql/config.yml
        trap-caching: true
        dependency-caching: true

    - name: Install Dependencies
      run: |
        sudo apt-get -y -qq update
        sudo apt-get -y -qq --no-install-recommends install \
          cmake \
          extra-cmake-modules \
          libarchive-dev \
          libgl1-mesa-dev \
          libqt6opengl6-dev \
          libqt6svg6-dev \
          libsqlite3-dev \
          libvulkan-dev \
          libxcb-keysyms1-dev \
          ninja-build \
          qt6-base-private-dev \
          qt6-webengine-dev \
          qt6-webengine-dev-tools

    - name: Configure & Build
      uses: lukka/run-cmake@v10
      with:
        configurePreset: release
        buildPreset: release

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4
      with:
        upload: failure-only
        output: ${{ runner.temp }}/codeql-sarif

    - name: Filter SARIF
      uses: advanced-security/filter-sarif@v1.1
      with:
        patterns: |-
          -**/src/contrib/**
          -**/build/**
        input: ${{ runner.temp }}/codeql-sarif/cpp.sarif
        output: ${{ runner.temp }}/codeql-sarif/cpp.sarif

    - name: Upload SARIF
      uses: github/codeql-action/upload-sarif@v4
      with:
        sarif_file: ${{ runner.temp }}/codeql-sarif/cpp.sarif
        category: .github/workflows/analyze-codeql.yaml:analyze-codeql