fix(anan): calibrate DDC0 droop behind the backend seam. Principle II… #5498
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # NO pull_request TRIGGER — deliberate (#4655). | |
| # | |
| # Analyzing C++ means building the whole project with no compiler cache (ccache | |
| # is unusable here: a cache hit means the compiler is never invoked, so the | |
| # extractor sees no translation unit and coverage silently drops). That measured | |
| # 39 min mean / 77 min max per run, making CodeQL the longest pole on every PR — | |
| # longer than the entire CI matrix. It also ran twice per merged PR, since | |
| # push:main re-scans the identical content ~10 min later. | |
| # | |
| # CodeQL is not a required status check and never blocked a merge, so the | |
| # pre-merge run bought "surfaced on the PR" over "surfaced on main shortly | |
| # after". We took the trade: scan once per merge, plus the weekly full sweep. | |
| # Re-adding `pull_request:` here is a one-line change if the posture call | |
| # changes — mirror the paths: block below when you do. | |
| on: | |
| push: | |
| branches: [main] | |
| # Positive `paths:`, NOT `paths-ignore:`. GitHub skips a run only when EVERY | |
| # changed file matches an ignore pattern, so a single unlisted file re-arms | |
| # the whole workflow — and `tools/**` was never on the old ignore list. | |
| # #4585 changed exactly two files, a workflow YAML and a Python script, and | |
| # paid 58 min for a full Qt build to analyze neither of them. A positive | |
| # filter fires when ANY file matches, which is the rule we actually want. | |
| # | |
| # Scope = what `cmake --build build` actually compiles, because CodeQL can | |
| # only analyze translation units the build emits. tools/ is listed by | |
| # EXTENSION so a change to one of its Python scripts does not re-arm this; | |
| # tools/kiwi_directory_poc.cpp is a default target and does need coverage. | |
| # hal-plugin/ is deliberately absent — it is a separate CMake project built | |
| # only by packaging/macos/build-installer.sh, so this workflow never sees it. | |
| paths: | |
| - 'src/**' | |
| - 'third_party/**' | |
| - 'tools/**.cpp' | |
| - 'tools/**.h' | |
| - 'CMakeLists.txt' | |
| # Test registration moved out of the root file into tests/tests.cmake. | |
| # Before that split, adding a test target touched CMakeLists.txt and | |
| # re-armed this workflow; without this line that trigger is lost. | |
| - 'tests/tests.cmake' | |
| - '.github/codeql/**' | |
| - '.github/workflows/codeql.yml' | |
| schedule: | |
| - cron: '0 6 * * 1' # weekly Monday 06:00 UTC | |
| # Every trigger above resolves to refs/heads/main, so each run gets its own | |
| # group (run_id suffix) and nothing is ever cancelled — the post-merge scan and | |
| # the weekly scheduled scan stay fully parallel. The ref guard is retained | |
| # verbatim so the block still behaves correctly if a pull_request trigger is | |
| # ever restored. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}${{ github.ref == 'refs/heads/main' && format('-{0}', github.run_id) || '' }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| # Workflow-level least-privilege GITHUB_TOKEN. CodeQL's official guidance | |
| # (https://github.com/github/codeql-action#permissions) is: | |
| # actions: read — needed by the CodeQL action to inspect this | |
| # workflow's metadata for category info. | |
| # contents: read — needed by actions/checkout to fetch the repo. | |
| # security-events: write — needed by the analyze step to upload SARIF. | |
| # Previously the block sat at job level and declared only | |
| # `security-events: write`, which (per GitHub's "specify any → unspecified | |
| # default to none" rule) dropped contents and actions to none. It worked | |
| # only because the repo is public; tightening to documented scopes makes | |
| # the intent explicit and survives a hypothetical visibility change. | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| jobs: | |
| analyze: | |
| runs-on: ubuntu-latest | |
| container: ghcr.io/aethersdr/aethersdr-ci:latest | |
| strategy: | |
| matrix: | |
| language: [cpp] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - name: Fix git ownership for container | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@7c1e4cf0b20d7c1872b26569c00ba908797a59bf | |
| with: | |
| languages: ${{ matrix.language }} | |
| config-file: ./.github/codeql/codeql-config.yml | |
| - name: Configure | |
| run: cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo | |
| - name: Build | |
| run: cmake --build build -j$(nproc) | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@7c1e4cf0b20d7c1872b26569c00ba908797a59bf |