codeql.yml

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  push:
    branches:
      - main
      - stable-*
  pull_request:
    paths-ignore:
      - 'doc/**'
      - 'po/**'
      - 'tests/**'
      - '**.md'
  schedule:
    - cron: '19 20 * * 5'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

permissions: {}

jobs:
  analyze:
    if: ${{ github.repository_owner == 'canonical' }}
    name: Analyze
    # Runner size impacts CodeQL analysis time. To learn more, please see:
    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
    #   - https://gh.io/supported-runners-and-hardware-resources
    #   - https://gh.io/using-larger-runners
    # Consider using larger runners for possible analysis time improvements.
    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
    permissions:
      # required for all workflows
      security-events: write

      # only required for workflows in private repositories
      actions: read
      contents: read

    env:
      CGO_CFLAGS: "-I/home/runner/go/bin/dqlite/include/ -I/home/runner/go/bin/liblxc/include/"
      CGO_LDFLAGS: "-L/home/runner/go/bin/dqlite/libs/"
      LD_LIBRARY_PATH: "/home/runner/go/bin/dqlite/libs/"
      LD_RUN_PATH: "/home/runner/go/bin/dqlite/libs/"
      CGO_LDFLAGS_ALLOW: "(-Wl,-wrap,pthread_create)|(-Wl,-z,now)"

    strategy:
      fail-fast: false
      matrix:
        language: ['actions', 'go', 'python']
        # CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
        # Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
        # Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Go
        if: matrix.language == 'go'
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: 'go.mod'

      # Install C headers and build tools needed to compile LXD's CGO code (Go only).
      - name: Install LXD build dependencies
        if: matrix.language == 'go'
        uses: ./.github/actions/install-lxd-builddeps

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
          # By default, queries listed here will override any specified in a config file.
          # Prefix the list here with "+" to use these queries and those in the config file.

          # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
          # queries: security-extended,security-and-quality

      # Create a symlink so the cache-dqlite-liblxc action can build from the checkout on a cache miss.
      - name: Create deps build symlink
        if: matrix.language == 'go'
        run: ln -s "${GITHUB_WORKSPACE}" /home/runner/work/lxd/lxd-test

      # Build or restore dqlite/liblxc from the daily cache (Go only).
      - name: Build or restore dqlite/liblxc dependencies
        if: matrix.language == 'go'
        uses: ./.github/actions/cache-dqlite-liblxc

      - name: Update env variables for deps
        if: matrix.language == 'go'
        run: |
          set -eux
          LIBLXC_ARCH_LIBS="$(readlink -e /home/runner/go/bin/liblxc/libs/*-linux-gnu)"

          echo "CGO_LDFLAGS=${CGO_LDFLAGS} -L${LIBLXC_ARCH_LIBS}"       >> "${GITHUB_ENV}"
          echo "LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:${LIBLXC_ARCH_LIBS}" >> "${GITHUB_ENV}"
          echo "LD_RUN_PATH=${LD_RUN_PATH}:${LIBLXC_ARCH_LIBS}"         >> "${GITHUB_ENV}"
          echo "PKG_CONFIG_PATH=${LIBLXC_ARCH_LIBS}/pkgconfig"          >> "${GITHUB_ENV}"

      # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
      - name: Autobuild
        if: matrix.language != 'go'
        uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1

      # Manual build for Go to ensure all CGO packages are compiled with the correct headers.
      - name: Build LXD
        if: matrix.language == 'go'
        run: |
          set -eux
          make all

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
        with:
          category: "/language:${{matrix.language}}"