codeql.yml

name: CodeQL

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  workflow_dispatch:

permissions:
  contents: read
  security-events: write
  actions: read

jobs:
  analyze:
    name: Analyze (cpp, security-and-quality)
    runs-on: ubuntu-24.04
    timeout-minutes: 120

    # GCC 14 / libstdc++ 14 is the floor for this project (std::chrono::parse,
    # used for timestamp deserialization, does not exist in libstdc++ 13 - see
    # AGENTS.md). The ubuntu-24.04 default `g++` is 13, which made the analysis
    # fail at StringifyService.h:53 and produce no result.
    env:
      CC: gcc-14
      CXX: g++-14
      BUILD_DIR: build/build/Release

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      # The manual build compiles the whole dependency graph from source
      # (Boost, OpenSSL, libpq), so without this the cache is cold every run.
      - name: Cache Conan packages
        uses: actions/cache@v6
        with:
          path: ~/.conan2
          key: conan-${{ runner.os }}-codeql-manual-${{ hashFiles('conanfile.txt') }}
          restore-keys: |
            conan-${{ runner.os }}-codeql-manual-

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: cpp
          queries: security-and-quality
          build-mode: manual
          config: |
            # Only `query-filters` here. `paths-ignore` is deliberately NOT used:
            # GitHub documents it as effective only for analyses that do not
            # build the code (`build-mode: none`). This workflow builds the code,
            # so directories must instead be excluded from the build. The
            # cpp/include-non-header alert on build/**/Unity/unity_*_cxx.cxx
            # (243 per run) was a CMake amalgamation that #includes .cpp files;
            # the configure step passes -DENABLE_UNITY_BUILD=OFF, so those files
            # are never compiled and never enter the compilation database.
            #
            # The three unused-entity queries are excluded repo-wide. In this
            # codebase they only ever fire on two macro/template mechanisms and
            # never on a defect:
            #
            #   - Catch2's TEST_CASE and Google Benchmark's BENCHMARK() emit a
            #     static function plus a static registrar that references it.
            #     CodeQL does not treat that reference as a use, so every test
            #     case (and every helper only called from one) is reported as an
            #     unused static function.
            #   - a parameter pack forwarded straight into a variadic helper
            #     (std::forward, std::make_format_args) is not seen as read, so
            #     `args` in SchedulerService/ExecutorService/LoggerService is
            #     reported as an unused local/static variable.
            #
            # The compiler already covers every real case: -Wall -Wunused with
            # -Werror turns an unused static function or variable into a build
            # failure, so a genuine defect can never reach a CodeQL alert here.
            query-filters:
              - exclude:
                  id: cpp/unused-static-function
              - exclude:
                  id: cpp/unused-local-variable
              - exclude:
                  id: cpp/unused-static-variable

      - name: Set up build tools
        # Hard backstop above install-deps.sh's own budget. A throttled mirror
        # node must not be killed and restarted here (see AGENTS.md).
        timeout-minutes: 40
        run: |
          ./scripts/install-deps.sh \
            build-essential g++-14 cmake ninja-build ccache \
            pkg-config python3 python3-pip \
            libpq-dev libsqlite3-dev libssl-dev

      - name: Install dependencies with Conan
        run: |
          pipx install 'conan>=2.0,<3.0'
          conan profile detect --force
          conan install . \
            --output-folder=build \
            --build=missing \
            -s build_type=Release \
            -c tools.cmake.cmaketoolchain:generator=Ninja

      # Full instrumented build: resolves macro/constexpr/template contexts
      # across translation-unit boundaries. Without a compilation database
      # CodeQL falls back to heuristic extraction, which reports findings at
      # lines that do not contain the reported construct at all (see
      # docs/code-scanning.md).
      - name: Configure CMake
        run: |
          cmake -S . -B "$BUILD_DIR" \
            -DCMAKE_TOOLCHAIN_FILE=build/build/Release/generators/conan_toolchain.cmake \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
            -DENABLE_UNITY_BUILD=OFF \
            -G Ninja

      - name: Build
        run: cmake --build "$BUILD_DIR" --parallel "$(nproc)"

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4