codeql-analysis.yml

name: "CodeQL"

on:
  push:
    branches: ["master"]
  pull_request:
    branches: ["master"]
  schedule:
    - cron: '30 1 * * 1'   # Weekly on Monday 01:30 UTC

# Concurrency: a newer run on the same ref cancels the stale in-progress
# one, cutting concurrent load on the shared self-hosted pool (the OOM/
# oversubscription root cause, not just queue depth). Per-ref group so
# distinct PRs/branches never cancel each other.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true


jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","Linux","X64","c2pool-build"]') || 'ubuntu-24.04' }}
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: c-cpp
            build-mode: manual
          - language: python
            build-mode: none

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          queries: security-and-quality

      # ── C++ build (manual mode only) ─────────────────────────────────────
      - if: matrix.build-mode == 'manual' && runner.environment == 'github-hosted'
        name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends \
            g++ cmake make \
            libleveldb-dev \
            libsecp256k1-dev

      - if: matrix.build-mode == 'manual'
        name: Set up Python for Conan
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - if: matrix.build-mode == 'manual'
        name: Install Conan 2
        run: |
          if [ "${{ runner.environment }}" = "github-hosted" ]; then
            pip install "conan>=2.0,<3.0"
            export PATH="$HOME/.local/bin:$PATH"
            echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          else
            conan --version   # pre-provisioned at /usr/local/bin on self-hosted
          fi
          conan profile detect --force
          sed -i 's/compiler.cppstd=.*/compiler.cppstd=20/' \
            "$(conan profile path default)"

      - if: matrix.build-mode == 'manual'
        name: Restore Conan package cache
        uses: actions/cache@v5
        with:
          path: ~/.conan2
          # Share cache with build.yml (same Release profile)
          key: conan2-ubuntu24-gcc13-${{ hashFiles('conanfile.txt') }}
          restore-keys: conan2-ubuntu24-gcc13-

      - if: matrix.build-mode == 'manual' && runner.environment != 'github-hosted'
        name: Clean stale build dir (self-hosted workspace is reused)
        run: rm -rf build_codeql

      - if: matrix.build-mode == 'manual'
        name: Install Conan dependencies
        run: |
          conan install . \
            --build=missing \
            --output-folder=build_codeql \
            --settings=build_type=Release

      - if: matrix.build-mode == 'manual'
        name: Build for CodeQL analysis
        run: |
          cmake -S . -B build_codeql \
            -DCMAKE_TOOLCHAIN_FILE=build_codeql/conan_toolchain.cmake \
            -DCMAKE_BUILD_TYPE=Release
          # Cap build parallelism on the shared self-hosted 905 box so the
          # CodeQL build does not co-OOM with a concurrent ASan job.
          # github-hosted (fork) runs keep full parallelism.
          if [ "${{ runner.environment }}" = "github-hosted" ]; then
            JOBS=$(nproc)
          else
            JOBS=8
          fi
          cmake --build build_codeql --target c2pool -j"$JOBS"

      # ── Analysis ──────────────────────────────────────────────────────────
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"
          # Cap the run-queries footprint on the shared self-hosted 905 box so
          # CodeQL does not co-OOM with a concurrent ASan job (was auto-sizing
          # to --ram=60466 --threads=32, nearly the whole box). 0 = action
          # auto-default, kept for github-hosted (fork) runs.
          threads: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && '12' || '0' }}
          ram: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && '20000' || '0' }}