feat(silo): add codeql workflow #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: clang-tidy | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| jobs: | |
| tidy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| # 1) Build the same Docker "builder" stage your tests use | |
| - name: Build unit test/builder image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| target: builder | |
| tags: builder:latest | |
| load: true | |
| cache-from: type=gha,ref=image-cache-${{ github.ref_name }}-${{ runner.arch }} | |
| cache-to: type=gha,mode=min,ref=image-cache-${{ github.ref_name }}-${{ runner.arch }} | |
| build-args: | | |
| DEPENDENCY_IMAGE=${{ env.DOCKER_DEPENDENCY_IMAGE_NAME }}:commit-${{ env.HEAD_SHA }}-${{ runner.arch }} | |
| # 2) Run clang-tidy inside that image, bind mounting the workspace. | |
| # We install clang-tidy in the container (in case the builder image doesn't have it). | |
| - name: Run clang-tidy inside builder | |
| run: | | |
| docker run --rm \ | |
| -v "$GITHUB_WORKSPACE:/src" \ | |
| -w /src \ | |
| builder:latest \ | |
| bash -eo pipefail -c ' | |
| # Install tools needed for the analysis (kept inside container) | |
| if command -v apt-get >/dev/null 2>&1; then | |
| apt-get update -y | |
| # clang-tidy + helpers. jq used to read compile_commands.json | |
| apt-get install -y --no-install-recommends clang clang-tidy jq python3 | |
| fi | |
| # 2a) Ensure deps are generated (your Makefile would do this, but do it here explicitly) | |
| conan --version >/dev/null 2>&1 || { echo "Conan missing in builder image"; exit 1; } | |
| # Generate CMake files and compile_commands.json (explicitly set export flag) | |
| cmake -S . -B build/Debug \ | |
| -D CMAKE_BUILD_TYPE=Debug \ | |
| -D CMAKE_EXPORT_COMPILE_COMMANDS=ON | |
| # Optional: build to materialize any generated headers if your project needs them | |
| cmake --build build/Debug -j "$(nproc)" | |
| # Sanity check | |
| test -f build/Debug/compile_commands.json || { echo "compile_commands.json not found"; exit 2; } | |
| # Choose checks. Start strict but practical. | |
| CHECKS="-*,bugprone-*,clang-analyzer-*,cppcoreguidelines-*,cert-*,performance-*,readability-*" | |
| # Treat every diagnostic as error to block merges | |
| WARNERR="*" | |
| # Run clang-tidy over all TU paths from the compile database. | |
| # This avoids missing files and respects per-target flags. | |
| FILES=$(jq -r ".[].file" build/Debug/compile_commands.json | sort -u) | |
| if [ -z "$FILES" ]; then | |
| echo "No files in compile_commands.json"; exit 3; | |
| fi | |
| # Use parallelism; fall back if run-clang-tidy isn’t present. | |
| if command -v run-clang-tidy >/dev/null 2>&1; then | |
| run-clang-tidy \ | |
| -p build/Debug \ | |
| -j "$(nproc)" \ | |
| -header-filter="^src/|^include/" \ | |
| -checks="$CHECKS" \ | |
| -warnings-as-errors="$WARNERR" | |
| else | |
| # Manual loop if run-clang-tidy isn’t available | |
| failed=0 | |
| for f in $FILES; do | |
| echo "=== clang-tidy: $f ===" | |
| clang-tidy "$f" \ | |
| -p build/Debug \ | |
| -checks="$CHECKS" \ | |
| -warnings-as-errors="$WARNERR" \ | |
| || failed=1 | |
| done | |
| exit $failed | |
| fi | |
| ' |