.github/workflows/lib-codeql.yml - main - githubmirror/dbus-broker

.github/workflows/lib-codeql.yml
74 строки2 KB
David Rheinsberg
ci: bump codeql workflows to v4
02 июл 2026, 12:13
02 июл 2026, 12:132956b5d
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: D-Bus Broker Developers

#
# lib: CodeQL Analysis
#
# This is a reusable workflow that runs the CodeQL analyzer on the local
# code-base and reports defects directly on GitHub.
#

#
# NB: The actions log will show errors like:
#
#     ERROR: ld.so: object '/__t/CodeQL/2.21.4/x64/codeql/tools/linux64/${LIB}_${PLATFORM}_trace.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
#
#     This can be ignored. This happens because `codeql-action/init` installs
#     an LD_PRELOAD handler in a container, but the LD_PRELOAD environment
#     variable will also be set for `docker exec`. Hence, the docker execution
#     of each step will be unable to honor the LD_PRELOAD. This can be ignored
#     since CodeQL has no interest in tracing the docker execution, but only
#     the binaries _inside_ of the container.
#

name: "lib: codeql analysis"

on:
  workflow_call:
  workflow_dispatch:

defaults:
  run:
    shell: "bash"

permissions:
  actions: "read"
  contents: "read"
  security-events: "write"

jobs:
  scan:
    name: "CodeQL Analysis"

    container:
      image: "ghcr.io/readaheadeu/rae-ci-ubuntu:latest"
      options: "--user root"
    runs-on: "ubuntu-latest"

    steps:
    - name: "Fetch Sources"
      uses: actions/checkout@v7

    - name: "Initialize CodeQL"
      uses: github/codeql-action/init@v4
      with:
        build-mode: "manual"
        config-file: "./.github/codeql-config.yml"
        languages: "cpp"

    - name: "Build Project"
      run: |
        meson setup \
          --buildtype "debugoptimized" \
          --warnlevel "2" \
          -Dapparmor=true \
          -Daudit=true \
          -Dlauncher=true \
          -Dselinux=true \
          "./build" \
          "."
        meson compile \
          -C "./build"

    - name: "Perform CodeQL Analysis"
      uses: github/codeql-action/analyze@v4