code-scanning-pack-gen.yml

name: Code Scanning Query Pack Generation
permissions:
  contents: read

on:
  merge_group:
    types: [checks_requested]
  pull_request:
    branches:
      - main
      - next
      - "rc/**"
  push:
    branches:
      - main
      - next
      - "rc/**"

env:
  XARGS_MAX_PROCS: 4

jobs:
  prepare-code-scanning-pack-matrix:
    name: Prepare CodeQL Code Scanning pack matrix
    runs-on: ubuntu-22.04
    outputs:
      matrix: ${{ steps.export-code-scanning-pack-matrix.outputs.matrix }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Export Code Scanning pack matrix
        id: export-code-scanning-pack-matrix
        run: |
          echo "matrix=$(
            jq --compact-output '.supported_environment | {include: .}' supported_codeql_configs.json
          )" >> $GITHUB_OUTPUT

  create-code-scanning-pack:
    name: Create Code Scanning pack
    needs: prepare-code-scanning-pack-matrix
    runs-on: ubuntu-latest-xl
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.prepare-code-scanning-pack-matrix.outputs.matrix) }}
    steps:
      - uses: actions/checkout@v6

      - name: Cache CodeQL
        id: cache-codeql
        uses: actions/cache@v5
        with:
          path: ${{ github.workspace }}/codeql_home
          key: codeql-home-${{ matrix.os }}-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library }}

      - name: Install CodeQL
        if: steps.cache-codeql.outputs.cache-hit != 'true'
        uses: ./.github/actions/install-codeql
        with:
          codeql-cli-version: ${{ matrix.codeql_cli }}
          codeql-stdlib-version: ${{ matrix.codeql_standard_library }}
          codeql-home: ${{ github.workspace }}/codeql_home
          add-to-path: false

      - name: Cache queries compilation
        id: cache-queries-compilation
        uses: actions/cache/restore@v6
        with:
          path: ${{ github.workspace }}/codeql_cache
          key: ${{ runner.os }}-codeql-compilation-code-scanning-pack-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library }}-${{ github.run_id }}
          restore-keys: ${{ runner.os }}-codeql-compilation-code-scanning-pack-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library }}

      - name: Install CodeQL packs
        uses: ./.github/actions/install-codeql-packs
        with:
          cli_path: ${{ github.workspace }}/codeql_home/codeql
          common_caches: ${{ github.workspace }}/codeql_cache

      - name: Determine ref for external help files
        id: determine-ref
        run: |
          if [[ $GITHUB_EVENT_NAME == "pull_request" ]]; then
            EXTERNAL_HELP_REF="${{ github.event.pull_request.base.ref }}"
          elif [[ $GITHUB_EVENT_NAME == "merge_group" ]]; then
            EXTERNAL_HELP_REF="${{ github.event.merge_group.base_ref }}"
          else
            EXTERNAL_HELP_REF="$GITHUB_REF"
          fi
          echo "EXTERNAL_HELP_REF=$EXTERNAL_HELP_REF" >> "$GITHUB_ENV"
          echo "Using ref $EXTERNAL_HELP_REF for external help files."

      - name: Checkout external help files
        id: checkout-external-help-files
        # PRs from forks and dependabot do not have access to an appropriate token for cloning the help files repos
        if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' }}
        uses: actions/checkout@v6
        with:
          ssh-key: ${{ secrets.CODEQL_CODING_STANDARDS_HELP_KEY }}
          repository: "github/codeql-coding-standards-help"
          ref: ${{ env.EXTERNAL_HELP_REF }}
          path: external-help-files

      - name: Include external help files
        if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]'&& steps.checkout-external-help-files.outcome == 'success' }}
        run: |
          pushd external-help-files
          find . -name '*.md' -exec rsync -av --relative {} "$GITHUB_WORKSPACE" \;
          popd

      - name: Pre-compiling queries
        env:
          CODEQL_HOME: ${{ github.workspace }}/codeql_home
        run: |
          PATH=$PATH:$CODEQL_HOME/codeql
          # Precompile all queries, and use a compilation cache larger than default
          # to ensure we cache all the queries for later steps
          codeql query compile \
            --common-caches=${{ github.workspace }}/codeql_cache \
            --precompile \
            --threads 0 \
            --compilation-cache-size=1024 \
            cpp c

          cd ..
          zip -r codeql-coding-standards/code-scanning-cpp-query-pack.zip codeql-coding-standards/c/ codeql-coding-standards/cpp/ codeql-coding-standards/.codeqlmanifest.json codeql-coding-standards/supported_codeql_configs.json codeql-coding-standards/scripts/configuration codeql-coding-standards/scripts/reports codeql-coding-standards/scripts/shared codeql-coding-standards/scripts/guideline_recategorization codeql-coding-standards/schemas

      - name: Save queries compilation cache
        uses: actions/cache/save@v6
        with:
          path: ${{ github.workspace }}/codeql_cache
          key: ${{ steps.cache-queries-compilation.outputs.cache-primary-key }}

      - name: Upload GHAS Query Pack
        uses: actions/upload-artifact@v7
        with:
          name: code-scanning-cpp-query-pack.zip
          path: code-scanning-cpp-query-pack.zip

      - name: Create qlpack bundles
        env:
          CODEQL_HOME: ${{ github.workspace }}/codeql_home
          CODEQL_CACHE: ${{ github.workspace }}/codeql_cache
        run: |
          PATH=$PATH:$CODEQL_HOME/codeql

          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=common-cpp-coding-standards.tgz cpp/common/src
          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=common-c-coding-standards.tgz c/common/src
          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=misra-c-coding-standards.tgz c/misra/src
          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=cert-c-coding-standards.tgz c/cert/src
          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=cert-cpp-coding-standards.tgz cpp/cert/src
          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=autosar-cpp-coding-standards.tgz cpp/autosar/src
          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=misra-cpp-coding-standards.tgz cpp/misra/src
          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=report-coding-standards.tgz cpp/report/src

      - name: Upload qlpack bundles
        uses: actions/upload-artifact@v7
        with:
          name: coding-standards-codeql-packs
          path: "*-coding-standards.tgz"