codeql-push.yml

name: CodeQL/push

permissions:
  contents: read

on:
  push:
    paths:
    - include/**
    - source/common/**
    branches-ignore:
    - dependabot/**
  pull_request:

concurrency:
  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
  cancel-in-progress: true

env:
  SEARCH_FOLDER: //source/common/...


jobs:
  CodeQL-Build:
    permissions:
      actions: read
      contents: read
      # for github/codeql-action/analyze to upload SARIF results
      security-events: write
      pull-requests: read
    runs-on: ubuntu-20.04
    if: github.repository == 'envoyproxy/envoy'
    steps:
    - name: Checkout repository
      uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b  # v4.1.4
      with:
        fetch-depth: 2

    - name: Get build targets
      run: |
        # TODO(phlax): Shift this to an action
        compare_head () {
            while IFS= read -r line; do
                if [[ -n "$line" ]]; then
                    bazel query "rdeps($SEARCH_FOLDER, $line, 1)"  2> /dev/null
                fi
            done < <(git diff --name-only HEAD "${1}" -- source/* include/*)
        }
        if [[ "$GIT_EVENT" == "pull_request" ]]; then
            git fetch "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" main 2> /dev/null
            TO_OTHER=FETCH_HEAD
        else
            TO_OTHER=HEAD^1
        fi
        BUILD_TARGETS="$(compare_head "$TO_OTHER" | grep -v '\.cc\|\.h' | sort -u | head -n 3)"
        echo 'BUILD_TARGETS<<EOF' >> $GITHUB_ENV
        echo "$BUILD_TARGETS" >> $GITHUB_ENV
        echo 'EOF' >> $GITHUB_ENV
      env:
        GIT_EVENT: ${{ github.event_name }}

    - name: Free disk space
      if: ${{ env.BUILD_TARGETS != '' }}
      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.30
      with:
        to_remove: |
          /usr/local/lib/android

    - name: Initialize CodeQL
      if: ${{ env.BUILD_TARGETS != '' }}
      uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a  # codeql-bundle-v2.13.4
      with:
        languages: cpp

    - name: Install deps
      if: ${{ env.BUILD_TARGETS != '' }}
      shell: bash
      run: |
       sudo apt-get update --error-on=any
       sudo apt-get install --yes libtool cmake automake autoconf make ninja-build curl unzip virtualenv openjdk-11-jdk build-essential libc++1
       # Note: the llvm/clang version should match the version specifed in:
       #  - bazel/repository_locations.bzl
       #  - .github/workflows/codeql-daily.yml
       #  - https://github.com/envoyproxy/envoy-build-tools/blob/main/build_container/build_container_ubuntu.sh#L84
       mkdir -p bin/clang14
       cd bin/clang14
       wget https://github.com/llvm/llvm-project/releases/download/llvmorg-14.0.0/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04.tar.xz
       tar -xf clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04.tar.xz --strip-components 1
       export PATH=bin/clang14/bin:$PATH

    - name: Build
      if: ${{ env.BUILD_TARGETS != '' }}
      run: |
       bazel/setup_clang.sh bin/clang14
       bazel shutdown
       bazel build \
           -c fastbuild \
           --spawn_strategy=local \
           --discard_analysis_cache \
           --nouse_action_cache \
           --config clang \
           --config libc++ \
           $BUILD_TARGETS
       echo -e "Built targets...\n$BUILD_TARGETS"

    - name: Clean Artifacts
      if: ${{ env.BUILD_TARGETS != '' }}
      run: |
        git clean -xdf

    - name: Perform CodeQL Analysis
      if: ${{ env.BUILD_TARGETS != '' }}
      uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a  # codeql-bundle-v2.13.4