codeql-analysis.yml

# For more infomation, please visit: https://github.com/github/codeql-action

name: "CodeQL"

on:
  push:
    branches:
      - 'master'
      - '202[0-9][0-9][0-9]'
  pull_request:
    branches:
      - 'master'
      - '202[0-9][0-9][0-9]'
  workflow_dispatch:

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-22.04
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'cpp' ]

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        config-file: ./.github/codeql/codeql-config.yml
        languages: ${{ matrix.language }}

    - name: prepare
      run: |
        sudo add-apt-repository -y ppa:mhier/libboost-latest
        sudo apt-get update
        sudo apt-get install -y libxml-simple-perl \
            aspell \
            aspell-en \
            libhiredis-dev \
            libnl-3-dev \
            libnl-genl-3-dev \
            libnl-route-3-dev \
            libnl-nf-3-dev \
            libyang-dev \
            libzmq3-dev \
            libzmq5 \
            swig3.0 \
            libpython3-dev \
            libgtest-dev \
            libgmock-dev \
            libboost1.83-dev \
            libboost-program-options1.83-dev \
            libboost-system1.83-dev \
            libboost-thread1.83-dev \
            libboost-atomic1.83-dev \
            libboost-chrono1.83-dev \
            libboost-container1.83-dev \
            libboost-context1.83-dev \
            libboost-contract1.83-dev \
            libboost-coroutine1.83-dev \
            libboost-date-time1.83-dev \
            libboost-fiber1.83-dev \
            libboost-filesystem1.83-dev \
            libboost-graph-parallel1.83-dev \
            libboost-log1.83-dev \
            libboost-regex1.83-dev \
            libboost-serialization1.83-dev \
            dh-exec \
            doxygen \
            cdbs \
            bison \
            flex \
            graphviz \
            autoconf-archive \
            uuid-dev \
            libjansson-dev \
            nlohmann-json3-dev \
            jq

    - name: install-swss-common
      id: swss
      run: |
        set -x
        # Determine the target branch (PR target or push branch)
        BRANCH="${GITHUB_BASE_REF:-${GITHUB_REF_NAME}}"
        echo "Downloading sonic-swss-common for branch: ${BRANCH}"

        # Query Azure DevOps for the latest successful sonic-swss-common build
        BUILD_INFO=$(curl -s "https://dev.azure.com/mssonic/build/_apis/build/builds?definitions=9&branchName=refs/heads/${BRANCH}&statusFilter=completed&resultFilter=succeeded&\$top=1&api-version=7.0")
        BUILD_ID=$(echo "${BUILD_INFO}" | jq -r '.value[0].id')

        if [ "${BUILD_ID}" = "null" ] || [ -z "${BUILD_ID}" ]; then
          echo "::warning::No successful swss-common build found for branch ${BRANCH} — skipping build step"
          echo "installed=false" >> "$GITHUB_OUTPUT"
          exit 0
        fi
        echo "Using build ID: ${BUILD_ID}"

        # libswsscommon is built against SONiC libyang3. Install the matching
        # common-lib artifact into the same workspace prefix used below.
        COMMON_LIB_BUILD_INFO=$(curl -s "https://dev.azure.com/mssonic/build/_apis/build/builds?definitions=465&branchName=refs/heads/${BRANCH}&statusFilter=completed&resultFilter=succeeded&\$top=1&api-version=7.0")
        COMMON_LIB_BUILD_ID=$(echo "${COMMON_LIB_BUILD_INFO}" | jq -r '.value[0].id')

        if [ "${COMMON_LIB_BUILD_ID}" = "null" ] || [ -z "${COMMON_LIB_BUILD_ID}" ]; then
          echo "::warning::No successful common-lib build found for branch ${BRANCH} — skipping build step"
          echo "installed=false" >> "$GITHUB_OUTPUT"
          exit 0
        fi
        echo "Using common-lib build ID: ${COMMON_LIB_BUILD_ID}"

        COMMON_LIB_DOWNLOAD_URL=$(curl -s "https://dev.azure.com/mssonic/build/_apis/build/builds/${COMMON_LIB_BUILD_ID}/artifacts?artifactName=common-lib&api-version=7.0" | jq -r '.resource.downloadUrl')

        if [ "${COMMON_LIB_DOWNLOAD_URL}" = "null" ] || [ -z "${COMMON_LIB_DOWNLOAD_URL}" ]; then
          echo "::warning::No common-lib artifact found for build ${COMMON_LIB_BUILD_ID} — skipping build step"
          echo "installed=false" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        curl -sL -o /tmp/common-lib.zip "${COMMON_LIB_DOWNLOAD_URL}"
        unzip -o /tmp/common-lib.zip -d /tmp/common-lib

        shopt -s nullglob
        LIBYANG_DEBS=(/tmp/common-lib/common-lib/target/debs/bookworm/libyang3_*_amd64.deb /tmp/common-lib/common-lib/target/debs/bookworm/libyang-dev_*_amd64.deb)
        if [ "${#LIBYANG_DEBS[@]}" -eq 0 ]; then
          echo "::warning::No libyang packages found in common-lib artifact — skipping build step"
          echo "installed=false" >> "$GITHUB_OUTPUT"
          exit 0
        fi
        for deb in "${LIBYANG_DEBS[@]}"; do
          dpkg-deb -x "${deb}" $(dirname $GITHUB_WORKSPACE)
        done

        # Get artifact download URL
        DOWNLOAD_URL=$(curl -s "https://dev.azure.com/mssonic/build/_apis/build/builds/${BUILD_ID}/artifacts?artifactName=sonic-swss-common-bookworm&api-version=7.0" | jq -r '.resource.downloadUrl')

        if [ "${DOWNLOAD_URL}" = "null" ] || [ -z "${DOWNLOAD_URL}" ]; then
          echo "::warning::No sonic-swss-common-bookworm artifact found for build ${BUILD_ID} — skipping build step"
          echo "installed=false" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        # Download and extract
        curl -sL -o /tmp/swss-common.zip "${DOWNLOAD_URL}"
        unzip -o /tmp/swss-common.zip -d /tmp/swss-common

        # Install into the workspace prefix (same layout as before)
        dpkg-deb -x /tmp/swss-common/sonic-swss-common-bookworm/libswsscommon_${SWSSCOMMON_VER}_amd64.deb $(dirname $GITHUB_WORKSPACE)
        dpkg-deb -x /tmp/swss-common/sonic-swss-common-bookworm/libswsscommon-dev_${SWSSCOMMON_VER}_amd64.deb $(dirname $GITHUB_WORKSPACE)

        # Verify cfg_schema.h has real content (not an empty stub)
        CFG_COUNT=$(grep -c 'CFG_.*_TABLE_NAME' $(dirname $GITHUB_WORKSPACE)/usr/include/swss/cfg_schema.h || true)
        echo "cfg_schema.h contains ${CFG_COUNT} CFG_* macros"
        if [ "${CFG_COUNT}" -lt 10 ]; then
          echo "::warning::cfg_schema.h appears to be empty or a stub — skipping build step"
          echo "installed=false" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        rm -rf /tmp/common-lib /tmp/common-lib.zip /tmp/swss-common /tmp/swss-common.zip
        echo "installed=true" >> "$GITHUB_OUTPUT"
      env:
        SWSSCOMMON_VER: "1.0.0"

    - name: build
      if: steps.swss.outputs.installed == 'true'
      run: |
        set -x
        sed -i "/JOBS := \$(subst -j,,\$(JOB_FLAG))/a JOBS := 1" Makefile
        sed -i -e "s/ -flto//g" Makefile
        sed -i '/-include objects.mk/a LIBS := -L'"$(dirname $GITHUB_WORKSPACE)"'/usr/lib/x86_64-linux-gnu -Wl,-rpath-link,'"$(dirname $GITHUB_WORKSPACE)"'/usr/lib/x86_64-linux-gnu \$(LIBS)' Makefile
        make all INCLUDES="-L$(dirname $GITHUB_WORKSPACE)/usr/lib/x86_64-linux-gnu -I$(dirname $GITHUB_WORKSPACE)/usr/include"

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{matrix.language}}"