Add GitHub code-scanning CI integration; document SARIF/header-filter #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| LLVM_VERSION: 22 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| build-and-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install build prerequisites | |
| run: sudo apt-get update -qq && sudo apt-get install -y -qq ninja-build | |
| - name: Install LLVM/Clang ${{ env.LLVM_VERSION }} | |
| run: | | |
| wget -q https://apt.llvm.org/llvm.sh | |
| chmod +x llvm.sh | |
| sudo ./llvm.sh "${LLVM_VERSION}" all | |
| - name: Configure | |
| run: | | |
| cmake -S . -B build -G Ninja \ | |
| -DCMAKE_BUILD_TYPE=Release \ | |
| -DCMAKE_PREFIX_PATH=/usr/lib/llvm-${LLVM_VERSION} \ | |
| -DCMAKE_CXX_COMPILER=clang++-${LLVM_VERSION} \ | |
| -DCMAKE_C_COMPILER=clang-${LLVM_VERSION} | |
| - name: Build | |
| run: cmake --build build -j"$(nproc)" | |
| - name: Test | |
| run: ctest --test-dir build --output-on-failure | |
| - name: clang-format check | |
| run: | | |
| find include lib tools tests/unit tests/support \ | |
| -regex '.*\.\(h\|cpp\)' \ | |
| | xargs clang-format-${LLVM_VERSION} --dry-run --Werror | |
| # Dogfoods cpp-sentinel on its own source and uploads results to | |
| # GitHub code scanning (Security tab). Gated to push (not | |
| # pull_request) since GITHUB_TOKEN on a fork PR can't be granted | |
| # security-events: write. --exclude skips the vendored | |
| # FetchContent'd dependencies (googletest, yaml-cpp) built alongside | |
| # our own code -- those aren't ours to fix. | |
| - name: Analyze cpp-sentinel's own source (SARIF) | |
| if: github.event_name == 'push' | |
| continue-on-error: true | |
| run: | | |
| ./build/tools/cpp-sentinel/cpp-sentinel analyze \ | |
| --compile-commands build/compile_commands.json \ | |
| --exclude '*/_deps/*' \ | |
| --format sarif --output cpp-sentinel.sarif | |
| - name: Upload SARIF to code scanning | |
| if: github.event_name == 'push' | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: cpp-sentinel.sarif |