CI: Full rewrite of CI implementation

.github/actions/analyze-obs/merge-clang-sarif/README.md

@@ -0,0 +1,86 @@
+# merge-clang-sarif Action
+
+The merge-clang-sarif action combines multiple SARIF files as typically generated by Clang Static Analyzer into a single merged SARIF file as required by CodeQL.
+
+## Documentation
+
+### Inputs
+
+| Input | Description | Default |
+|:-----:|-------------|:-------:|
+| `path` | The path on the runner to a directory with SARIF files that need to be merged. | `REQUIRED` |
+| `output-name` | An optional output name for the merged SARIF file. | `merged.sarif` |
+
+### Outputs
+
+| Output | Description |
+|:------:|-------------|
+| `path` | The path to the generated merged SARIF file using the specified `output-name`. |
+
+## Common Usage
+
+The action requires generated SARIF files to be collected into a single location for merging, so a preparation step might be necessary before invoking the action itself:
+
+```yaml
+    - name: Gather All SARIF Files
+      shell: bash --noprofile --norc -eo errexit -eo pipefail -eo nounset {0}
+      working-directory: ${{ github.workspace }}
+      run: |
+        mkdir -p "${RUNNER_TEMP}/codeql"
+        find . -type f -name '*.sarif' | xargs -I '{}' mv '{}' "${RUNNER_TEMP}/codeql"
+```
+
+This location can then be passed to the action directly:
+
+```yaml
+    - name: Merge SARIF files
+      uses: ./.github/actions/merge-clang-sarif
+      with:
+        path: ${{ format('{0}/codeql', runner.temp) }}
+        output-name: my-merged-report.sarif
+```
+
+## Notes
+
+* The action runs no verification on the SARIF files found in the provided input `path`. Any file with the `.sarif` suffix will be used as input for merging. An invalid SARIF file can thus lead to making the action fail.
+* The provided input `path` needs to exist on the runner's file system and needs to be a directory.
+
+## Developer Notes
+
+* The merging of files is necessary because CodeQL requires all reports to originate from a single run of the associated "tool", but Clang Static Analyzer produces reports for each translation unit, which represents individual runs of the tool.
+* The action is designed and tested for SARIF files generated by `AppleClang` 21.0+.
+
+The actual merging of files is done entirely by `jq` using the following query:
+
+```typescript
+{
+    // All SARIF files generated by Clang share the same schema and version object, so simply use the
+    // first such element.
+    "$schema": first(.[]."$schema"),
+    "version": first(.[].version),
+    "runs": [{
+        "tool": {
+        // The driver object is almost identical in all files apart from the "rules" object.
+        // So reuse the driver object of the first such element, but remove the "rules" key.
+        // The add a new "rules" key and collect all rules from all driver objects in all files
+        // and ensure the rules collection only contains unique elements.
+        "driver": (first(.[].runs[].tool.driver) | del(.rules)) + {
+          "rules": reduce(.[].runs[].tool.driver.rules) as $obj ([]; . + $obj) | unique
+        }
+      },
+      // Gather all artifacts elements into a single unique collection.
+      "artifacts": reduce(.[].runs[].artifacts) as $obj ([]; . + $obj) | unique,
+      // Gather all results elements into a single unique collection, but also remove any
+      // "endLine" and "endColumn" keys deep in the "codeFlows" collection whose value is
+      // a zero, which is not allowed by SARIF.
+      "results": (reduce(.[].runs[].results) as $obj ([]; . + $obj))
+      | del(
+        .[].codeFlows[].threadFlows[].locations[].location.physicalLocation.region.endLine,
+        .[].codeFlows[].threadFlows[].locations[].location.physicalLocation.region.endColumn
+        | select(. == 0)
+      )
+    }]
+}
+```
+
+* File paths are handled in their UNIX variant and converted from and to Windows format at the input/output edge of the Bash script.

.github/actions/analyze-obs/merge-clang-sarif/action.yaml

@@ -0,0 +1,23 @@
+name: Merge Clang SARIF Files
+description: Merges SARIF files generated by Clang Static Analyzer into a single tool run as required by CodeQL.
+inputs:
+  path:
+    description: The path on the runner to a directory with SARIF files that need to be merged.
+    required: true
+  output-name:
+    description: An optional output name for the merged SARIF file.
+    default: 'merged.sarif'
+outputs:
+  path:
+    description: The path to the generated merged SARIF file using the specified output-name.
+    value: ${{ steps.merge.outputs.path }}
+runs:
+  using: composite
+  steps:
+    - name: Merge SARIF Files
+      id: merge
+      shell: bash --noprofile --norc -eo errexit -eo pipefail -eo nounset {0}
+      env:
+        SARIF_PATH: ${{ inputs.path }}
+        OUTPUT_NAME: ${{ inputs.output-name }}
+      run: ${GITHUB_ACTION_PATH}/merge-sarif.bash

.github/actions/analyze-obs/merge-clang-sarif/merge-sarif.bash

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC2154
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+: "${CI:?}"
+if [[ -n "${RUNNER_DEBUG:-}" ]]; then set -x; fi
+
+merge-sarif() {
+  if [[ ! -d "${SARIF_PATH}" ]]; then
+    echo "::error::Provided path for SARIF files '${SARIF_PATH}' is not a directory."
+    return 1
+  fi
+
+  if [[ "${RUNNER_OS}" == 'Windows' ]]; then
+    SARIF_PATH="$(cygpath --unix "${SARIF_PATH}")"
+  fi
+
+  local output
+  local -a sarif_files=()
+  if output="$(compgen -G "${SARIF_PATH}/*.sarif")"; then
+    while read -r file; do
+      full_path="$(realpath "${file}")"
+      sarif_files+=("${full_path}")
+    done <<< "${output}"
+  fi
+
+  if (( ! ${#sarif_files[@]} )); then
+    echo "::error::No SARIF files found in '${SARIF_PATH}'."
+    return 1
+  fi
+
+  local output_path="${RUNNER_TEMP}/${OUTPUT_NAME}"
+  jq --slurp '{
+    "$schema": first(.[]."$schema"),
+    "version": first(.[].version),
+    "runs": [{
+      "tool": {
+        "driver": (first(.[].runs[].tool.driver) | del(.rules)) + {
+          "rules": reduce(.[].runs[].tool.driver.rules) as $obj ([]; . + $obj) | unique
+        }
+      },
+      "artifacts": reduce(.[].runs[].artifacts) as $obj ([]; . + $obj) | unique,
+      "results": (reduce(.[].runs[].results) as $obj ([]; . + $obj))
+      | del(
+        .[].codeFlows[].threadFlows[].locations[].location.physicalLocation.region.endLine,
+        .[].codeFlows[].threadFlows[].locations[].location.physicalLocation.region.endColumn
+        | select(. == 0)
+      )
+    }]
+  }' "${sarif_files[@]}" > "${output_path}"
+
+  if [[ "${RUNNER_OS}" == 'Windows' ]]; then
+    output_path="$(cygpath --windows "${output_path}")"
+  fi
+  echo "path=${output_path}" >> "${GITHUB_OUTPUT}"
+}
+
+merge-sarif

.github/actions/analyze-obs/run-clang-analyze/README.md

@@ -0,0 +1,47 @@
+# run-clang-analyze Action
+
+The run-clang-analyze action uses Clang Static Analyzer to generate SARIF files which can then be uploaded to GitHub as a CodeQL report after merging the files into a format accepted by GitHub.
+
+## Documentation
+
+### Inputs
+
+| Input | Description | Default |
+|:-----:|-------------|:-------:|
+| `architecture` | The CPU architecture used for building OBS Studio. Available values are `x86_64` and `arm64`.| `REQUIRED` |
+| `upload-codeql` | A boolean value to indicate whether the generated SARIF report should be automatically uploaded. |`false`|
+| `xcode-version` | An Xcode version number to select a specific Xcode version preinstalled on the runner. | `''` |
+| `github-token`| The GitHub token required to upload the SARIF file as CodeQL report. The provided token needs to have the `security-events: write` permission. | `github.token`|
+
+### Outputs
+
+The action has no outputs.
+
+## Common Usage
+
+The action requires no prior setup and can be invoked directly on a checkout of the repository:
+
+```yaml
+      - name: Analyze OBS Studio
+        id: analyze
+        uses: ./.github/actions/analyze-obs/run-clang-analyze
+        with:
+          architecture: arm64
+          upload-codeql: true
+
+```
+
+Be aware that just like the `build-obs` action, environment variables can influence project generation by CMake and code paths might not be included in the build and analysis without them. Thus it should be ensured that a "maximalist" build of OBS Studio can be configured to achieve the highest possible coverage of source code.
+
+## Notes
+
+> [!IMPORTANT]
+> The action requires a macOS or Linux GitHub Actions runner.
+
+* The CodeQL report uses the category identifier `clang-analyze`.
+
+## Developer Notes
+
+Under the hood the action uses the `build-obs` action with the optional input `analyze` set to `true`. The action thus mostly serves as a convenience wrapper around this action, with the benefit of automatically gathering and merging of all generated SARIF files so that their contents can be (optionally) uploaded as a single CodeQL report.
+
+The merging is handled by the `merge-clang-sarif` action, refer to its documentation for details about the production of a single CodeQL report file.

.github/actions/analyze-obs/run-clang-analyze/action.yaml

@@ -0,0 +1,62 @@
+name: Run clang-analyze
+description: >
+  Uses Clang Static Analyzer to generate SARIF files which can then be uploaded to GitHub as a CodeQL report after
+  merging the files into a format accepted by GitHub.
+inputs:
+  architecture:
+    description: >
+      The CPU architecture used for building OBS Studio. Available values are 'x86_64' and 'arm64'.
+    required: true
+  upload-codeql:
+    description: A boolean value to indicate whether the generated SARIF report should be automatically uploaded.
+    default: 'false'
+  xcode-version:
+    description: An Xcode version number to select a specific Xcode version pre-installed on the runner.
+    default: ''
+  github-token:
+    description: >
+      The GitHub token required to upload the SARIF file as CodeQL report.
+      The provided token needs to have the 'security-events: write' permission.
+    default: ${{ github.token }}
+runs:
+  using: composite
+  steps:
+    - name: Check Runner
+      uses: ./.github/actions/check-runner
+      with:
+        os: |
+          macOS
+          Linux
+        custom-error: analyze-obs/run-clang-analyze action requires a macOS or Linux runner.
+
+    - name: Build OBS Studio
+      id: build
+      uses: ./.github/actions/build-obs
+      with:
+        config: Debug
+        architecture: ${{ inputs.architecture }}
+        analyze: true
+        xcode-version: ${{ inputs.xcode-version }}
+
+    - name: Gather Xcode SARIF files
+      if: runner.os == 'macOS'
+      shell: bash --noprofile --norc -eo errexit -eo pipefail -eo nounset {0}
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        ANALYTICS_PATH: ${{ steps.build.outputs.analyzer-output-path }}
+      run: zsh --errexit --pipefail --no-rcs ${GITHUB_ACTION_PATH}/gather-xcode-sarif-files.zsh
+
+    - name: Merge SARIF files
+      id: merge
+      uses: ./.github/actions/analyze-obs/merge-clang-sarif
+      with:
+        path: ${{ steps.build.outputs.analyzer-output-path }}
+        output-name: ${{ format('obs-studio-{0}-{1}.sarif', runner.os, inputs.architecture) }}
+
+    - name: Upload CodeQL Report
+      uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+      if: ${{ fromJSON(inputs.upload-codeql) }}
+      with:
+        token: ${{ inputs.github-token }}
+        sarif_file: ${{ steps.merge.outputs.path }}
+        category: ${{ format('clang-analyze ({0} {1}', runner.os, inputs.architecture) }}

.github/actions/analyze-obs/run-clang-analyze/gather-xcode-sarif-files.zsh

@@ -0,0 +1,28 @@
+#!/usr/bin/env zsh
+
+builtin emulate -L zsh
+setopt PUSHD_SILENT
+setopt EXTENDED_GLOB
+setopt ERR_EXIT
+setopt ERR_RETURN
+setopt NO_UNSET
+setopt PIPE_FAIL
+setopt NO_AUTO_PUSHD
+setopt NO_PUSHD_IGNORE_DUPS
+setopt NO_GLOB_SUBST
+setopt WARN_CREATE_GLOBAL
+setopt WARN_NESTED_VAR
+
+: ${CI:?}
+if (( ${+RUNNER_DEBUG} )) setopt XTRACE
+
+gather-xcode-sarif-files() {
+  local -a analytics_files=(${ANALYTICS_PATH}/StaticAnalyzer/obs-studio/**/*.plist)
+
+  local file
+  for file (${analytics_files}) {
+    mv ${file} ${ANALYTICS_PATH}/${${file:t}//plist/sarif}
+  }
+}
+
+gather-xcode-sarif-files

.github/actions/analyze-obs/run-pvs-studio/README.md

@@ -0,0 +1,48 @@
+# run-pvs-studio Action
+
+The run-pvs-studio action uses PVS-Studio to run static code analysis on an existing OBS Studio Visual Studio project and uploads the generated SARIF file as a CodeQL report.
+
+## Documentation
+
+### Inputs
+
+| Input | Description | Default |
+|:-----:|-------------|:-------:|
+| `architecture` | The CPU architecture used for building OBS Studio Available values are `x64` and `arm64`. | `REQUIRED` |
+| `upload-codeql` | A boolean value to indicate whether the generated SARIF report should be automatically uploaded. |`false`|
+| `github-token`| The GitHub token required to upload the SARIF file as CodeQL report. The provided token needs to have the `security-events: write` permission. | `github.token`|
+
+### Outputs
+
+The action has no outputs.
+
+## Common Usage
+
+The action requires no prior setup and can be invoked directly on a checkout of the repository:
+
+```yaml
+      - name: Analyze OBS Studio
+        id: analyze
+        uses: ./.github/actions/analyze-obs/run-pvs-studio
+        with:
+          architecture: x64
+          upload-codeql: true
+
+```
+
+Be aware that just like the `build-obs` action, environment variables can influence project generation by CMake and code paths might not be included in the build and analysis without them. Thus it should be ensured that a "maximalist" build of OBS Studio can be configured to achieve the highest possible coverage of source code.
+
+## Notes
+
+> [!IMPORTANT]
+> The action requires a Windows GitHub Actions runner.
+
+* The action does not do any setup or installation of PVS Studio, this needs to be done in preparation before calling the action.
+* The generated PVS-Studio log is uploaded as a workflow artifact by default. The CodeQL report is only optionally uploaded.
+
+## Developer Notes
+
+Under the hood the action uses the `build-obs` action to generate a Visual Studio project and builds the project once before passing the generated solution file to PVS Studio. As Microsoft changed the file extension of Visual Studio solution files with Visual Studio 19 2026 to `slnx` the action tries to pick up (and pass along) either variant inside the automatically selected directory path.
+
+* PVS-Studio is capable of converting its own report into a single SARIF tool report by itself, so no merging or fix-up is necessary.
+* File paths are handled in their UNIX variant and converted from and to Windows format at the input/output edge of the Bash script.