static-analysis.yml

---
name: Static Analysis

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read

concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}
  cancel-in-progress: true

jobs:
  sonar:
    name: SonarCloud
    runs-on: ubuntu-latest
    env:
      SONAR_SCANNER_VERSION: 4.7.0.2747
      SONAR_SERVER_URL: "https://sonarcloud.io"
    steps:
      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
        with:
          fetch-depth: 0 # Disable shallow clone to enable blame information
          persist-credentials: false
      - run: sudo apt-get update && sudo apt-get install --no-install-recommends jq ninja-build xsltproc
      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
      - uses: BSFishy/pip-action@8f2d471d809dc20b6ada98c91910b6ae6243f318
        with:
          packages: gcovr==5.2
      - name: Install Sonar Scanner & Mull
        run: |
          wget -qN "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${{ env.SONAR_SCANNER_VERSION }}-linux.zip"
          unzip -qqo "sonar-scanner-cli-${{ env.SONAR_SCANNER_VERSION }}-linux.zip"
          echo "${PWD}/sonar-scanner-${{ env.SONAR_SCANNER_VERSION }}-linux/bin" >> "$GITHUB_PATH"
          wget -qN https://github.com/mull-project/mull/releases/download/0.18.0/Mull-12-0.18.0-LLVM-12.0-ubuntu-20.04.deb
          sudo dpkg -i Mull-12-0.18.0-LLVM-12.0-ubuntu-20.04.deb
      - uses: hendrikmuhs/ccache-action@6d1841ec156c39a52b1b23a810da917ab98da1f4 # v1.2.10
        with:
          key: ${{ github.job }}
          max-size: 2G
      - name: Build & Collect Coverage
        run: |
          cmake --preset Coverage -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
          cmake --build --preset Coverage
          GTEST_OUTPUT="xml:${PWD}/testresults/" ctest --preset Coverage
          gcovr --sonarqube=coverage.xml --exclude-lines-by-pattern '.*assert\(.*\);|.*really_assert\(.*\);|.*std::abort();' --exclude-unreachable-branches --exclude-throw-branches -j 2 --exclude=.*/generated/.* --exclude=.*/examples/.* --exclude=.*/tracing/.* --exclude=.*/test/.*
      - name: Convert Results
        run: |
          { echo '<testExecutions version="1">'; xsltproc .github/formatters/gtest-to-generic-execution.xslt testresults/*.xml; echo '</testExecutions>'; } | tee execution.xml > /dev/null
          cp build/Coverage/compile_commands.json compile_commands.json
      - name: Run Analysis
        env:
          # to get access to secrets.SONAR_TOKEN, provide GITHUB_TOKEN
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: sonar-scanner -D sonar.host.url="${{ env.SONAR_SERVER_URL }}"
  codeql:
    name: CodeQL
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
        with:
          persist-credentials: false
      - run: sudo apt-get update && sudo apt-get install ninja-build
      - uses: hendrikmuhs/ccache-action@6d1841ec156c39a52b1b23a810da917ab98da1f4 # v1.2.10
        with:
          key: ${{ github.job }}
      - uses: github/codeql-action/init@ddccb873888234080b77e9bc2d4764d5ccaaccf9 # v2.21.9
        with:
          languages: cpp
      - run: |
          cmake --preset ContinuousIntegration -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
          cmake --build --preset ContinuousIntegration
      - uses: github/codeql-action/analyze@ddccb873888234080b77e9bc2d4764d5ccaaccf9 # v2.21.9