codeql-push.yml

name: CodeQL/push

permissions:
  contents: read

on:
  push:
    branches:
    - main
  pull_request:
    branches:
    - main

concurrency:
  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
  cancel-in-progress: true

env:
  SEARCH_FOLDER: //source/common/...


jobs:
  CodeQL-Build:
    permissions:
      actions: read
      contents: read
      # for github/codeql-action/analyze to upload SARIF results
      security-events: write
      pull-requests: read
    runs-on: ubuntu-22.04
    if: github.repository == 'envoyproxy/envoy'
    steps:
    - uses: envoyproxy/toolshed/actions/bind-mounts@1f5b552c6749502b885cb8cf23549b929e745547  # actions-v0.4.17
      if: ! github.event.repository.private
      with:
        mounts: |
          - src: /mnt/workspace
            target: GITHUB_WORKSPACE
            chown: "runner:runner"
          - src: /mnt/runner-cache
            target: /home/runner/.cache
            chown: "runner:runner"

    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      with:
        fetch-depth: 2

    - name: Detect C++ changes
      run: |
        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            git fetch --depth=1 "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" main 2>/dev/null
            TO_OTHER=FETCH_HEAD
        else
            TO_OTHER=HEAD^1
        fi
        if git diff --name-only HEAD "${TO_OTHER}" -- source/common/ include/ | grep -q .; then
            echo "CPP_CHANGED=true" >> "$GITHUB_ENV"
        else
            echo "CPP_CHANGED=false" >> "$GITHUB_ENV"
        fi

    - name: Free disk space
      if: |
        env.CPP_CHANGED == 'true'
        && github.event.repository.private
      uses: envoyproxy/toolshed/actions/diskspace@1f5b552c6749502b885cb8cf23549b929e745547  # actions-v0.4.17
      with:
        to_remove: |
          /usr/local/.ghcup
          /usr/local/lib/android

    - name: Get build targets
      if: env.CPP_CHANGED == 'true'
      run: |
        # TODO(phlax): Shift this to an action
        compare_head () {
            while IFS= read -r line; do
                if [[ -n "$line" ]]; then
                    bazel query "rdeps($SEARCH_FOLDER, $line, 1)"  2> /dev/null
                fi
            done < <(git diff --name-only HEAD "${1}" -- source/common/* include/*)
        }
        if [[ "$GIT_EVENT" == "pull_request" ]]; then
            git fetch "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" main 2> /dev/null
            TO_OTHER=FETCH_HEAD
        else
            TO_OTHER=HEAD^1
        fi
        BUILD_TARGETS="$(compare_head "$TO_OTHER" | grep -v '\.cc\|\.h' | sort -u | head -n 3)"
        echo 'BUILD_TARGETS<<EOF' >> $GITHUB_ENV
        echo "$BUILD_TARGETS" >> $GITHUB_ENV
        echo 'EOF' >> $GITHUB_ENV
      env:
        GIT_EVENT: ${{ github.event_name }}

    - name: Set default build target
      if: env.CPP_CHANGED == 'true' && env.BUILD_TARGETS == ''
      run: |
        echo "MINIMAL_BUILD_TARGET=//source/common/common:assert_lib" > $GITHUB_ENV

    - name: Initialize CodeQL
      if: env.CPP_CHANGED == 'true'
      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225  # codeql-bundle-v4.35.2
      with:
        languages: cpp
        trap-caching: false

    # No-op analysis to satisfy Scorecard SAST check when no C++ changes are present.
    # Running codeql-action/analyze unconditionally ensures every merge commit gets
    # a github-code-scanning check run with conclusion 'success', which Scorecard
    # requires to award full SAST score.
    - name: Initialize CodeQL (noop)
      if: env.CPP_CHANGED != 'true'
      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225  # codeql-bundle-v4.35.2
      with:
        languages: javascript
        trap-caching: false

    - name: Install deps
      if: env.CPP_CHANGED == 'true'
      shell: bash
      run: |
       sudo apt-get -qq update --error-on=any
       sudo apt-get -qq install --yes \
           libtool libtinfo5 automake autoconf curl unzip
       # Note: the llvm/clang version should match the version specifed in:
       #  - bazel/repository_locations.bzl
       #  - .github/workflows/codeql-daily.yml
       #  - https://github.com/envoyproxy/envoy-build-tools/blob/main/build_container/build_container_ubuntu.sh#L84
       #
       # IMPORTANT: the clang bundle MUST be unpacked outside $GITHUB_WORKSPACE (we use $RUNNER_TEMP).
       # The CodeQL C++ extractor treats anything under the source root as project code, so headers
       # under a checkout subdirectory would be analysed as Envoy source and produce false positives
       # (e.g. cpp/new-free-mismatch in <vector>, alert #1881). Keeping it under $RUNNER_TEMP makes
       # CodeQL classify those headers as system headers — same as /usr/include/c++/** on a normal
       # build. Do NOT move this back into the checkout tree.
       mkdir -p "${RUNNER_TEMP}/clang18.1.8"
       cd "${RUNNER_TEMP}/clang18.1.8"
       wget -q https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.8/clang+llvm-18.1.8-x86_64-linux-gnu-ubuntu-18.04.tar.xz
       tar -xf clang+llvm-18.1.8-x86_64-linux-gnu-ubuntu-18.04.tar.xz --strip-components 1

    - name: Build
      if: env.CPP_CHANGED == 'true'
      run: |
        bazel shutdown
        bazel build \
            -c fastbuild \
            --repo_env=BAZEL_LLVM_PATH="${RUNNER_TEMP}/clang18.1.8" \
            --spawn_strategy=local \
            --discard_analysis_cache \
            --nouse_action_cache \
            --features="-layering_check" \
            --config=clang \
            --config=ci \
            ${BUILD_TARGETS:-${MINIMAL_BUILD_TARGET}}
        echo -e "Built targets...\n${BUILD_TARGETS:-${MINIMAL_BUILD_TARGET}}"

    - name: Clean Artifacts
      if: env.CPP_CHANGED == 'true'
      run: |
        git clean -xdf

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225  # codeql-bundle-v4.35.2