CodeQL Advanced #18

	name: CodeQL Advanced

	on:
	workflow_dispatch:
	schedule:
	- cron: '0 0 * * 5'

	permissions:
	actions: read
	contents: read
	security-events: write

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	analyze:
	name: Analyze (${{ matrix.name }})
	runs-on: ubuntu-24.04
	timeout-minutes: 120
	strategy:
	fail-fast: false
	matrix:
	include:
	- name: C/C++
	language: cpp
	build-mode: manual
	steps:
	- uses: actions/checkout@v4

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: ${{ matrix.language }}
	build-mode: ${{ matrix.build-mode }}
	queries: security-extended,security-and-quality

	- name: Install native build dependencies
	if: ${{ matrix.language == 'cpp' }}
	run: \|
	sudo apt-get update
	sudo apt-get install -y ninja-build

	- name: Build native database targets
	if: ${{ matrix.language == 'cpp' }}
	run: \|
	# For compiled CodeQL languages, analysis scope follows the traced build.
	# Build only the shell and its core library dependencies.
	cmake -B build/codeql -G Ninja \
	-DCMAKE_BUILD_TYPE=Release \
	-DAUTO_UPDATE_GRAMMAR=FALSE \
	-DBUILD_SINGLE_FILE_HEADER=FALSE \
	-DBUILD_TESTS=FALSE \
	-DBUILD_BENCHMARK=FALSE \
	-DBUILD_EXAMPLES=FALSE \
	-DBUILD_JAVA=FALSE \
	-DBUILD_NODEJS=FALSE \
	-DBUILD_PYTHON=FALSE \
	-DBUILD_SHELL=TRUE \
	.
	cmake --build build/codeql --target lbug_shell -j 8

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v3
	with:
	category: /language:${{ matrix.language }}

Navigation Menu