@@ -82,73 +82,35 @@ jobs:
8282 # Set CodeQL extractor options for better C++ analysis accuracy (no protobuf)
8383 CODEQL_EXTRACTOR_CPP_OPTION_INCLUDE_DIRECTORIES : " generated/config:/usr/include:/usr/local/include:services:api:third_party"
8484 CODEQL_EXTRACTOR_CPP_OPTION_DEFINE : " ENABLE_CORE_DUMPS=1,ENABLE_PROTECTED_AUDIENCE=1,CODEQL_ANALYSIS=1"
85- - name : Setup comprehensive C++ dependencies for maximum CodeQL accuracy
85+ - name : Install C++ compiler and essential headers for CodeQL analysis
8686 if : matrix.language == 'cpp'
8787 run : |
88- echo "Setting up comprehensive C++ dependencies for maximum CodeQL accuracy ..."
89- echo "Installing complete development environment for better dependency resolution "
88+ echo "Installing C++ compiler and headers for CodeQL template/macro resolution ..."
89+ echo "Note: CodeQL uses compiler for preprocessing only - no actual compilation occurs "
9090
9191 # Update package lists
9292 sudo apt-get update
9393
94- # Install comprehensive C++ development environment
95- echo "Installing complete C++ toolchain and standard libraries ..."
94+ # Install minimal C++ toolchain for CodeQL reference compilation
95+ echo "Installing C++ compiler for CodeQL preprocessing ..."
9696 sudo apt-get install -y \
97- build-essential \
98- gcc-multilib \
99- g++-multilib \
100- libc6-dev \
97+ gcc \
98+ g++ \
10199 libc++-dev \
102- libc++abi-dev \
103- libstdc++-12-dev \
104- linux-libc-dev \
105- manpages-dev
100+ libstdc++-12-dev
106101
107- # Install system libraries commonly used in the project
108- echo "Installing system and networking libraries..."
109- sudo apt-get install -y \
110- libssl-dev \
111- libcurl4-openssl-dev \
112- libz-dev \
113- libzstd-dev \
114- liblz4-dev \
115- libsnappy-dev \
116- libunwind-dev \
117- libevent-dev \
118- libatomic1
119-
120- # Install Google libraries and protobuf ecosystem
121- echo "Installing Google libraries and protobuf ecosystem..."
102+ # Install key library headers that the project uses
103+ echo "Installing project-specific library headers..."
122104 sudo apt-get install -y \
123105 libprotobuf-dev \
124- protobuf-compiler \
125106 libgrpc++-dev \
126- protobuf-compiler-grpc \
127107 libabsl-dev \
128108 libgoogle-glog-dev \
129109 libgflags-dev \
130- libgtest-dev \
131- libbenchmark-dev || echo "⚠️ Some Google libraries not available via apt"
132-
133- # Install AWS SDK dependencies
134- echo "Installing AWS and cloud service dependencies..."
135- sudo apt-get install -y \
136- libaws-* \
137- libcrypto++-dev \
138- libcpprest-dev || echo "⚠️ Some AWS libraries not available via apt"
139-
140- # Install additional development tools
141- echo "Installing development and analysis tools..."
142- sudo apt-get install -y \
143- pkg-config \
144- cmake \
145- ninja-build \
146- git \
147- ca-certificates \
148- curl \
149- wget
110+ libssl-dev \
111+ libcurl4-openssl-dev || echo "⚠️ Some libraries not available - CodeQL will continue without them"
150112
151- echo "✅ Comprehensive C++ environment prepared for maximum CodeQL accuracy "
113+ echo "✅ C++ compiler and headers installed for CodeQL template/macro analysis "
152114
153115 - name : Create configuration header for C++ macro resolution
154116 if : matrix.language == 'cpp'
@@ -208,27 +170,18 @@ jobs:
208170
209171 echo "✅ C++ source structure verified - CodeQL ready to analyze without protobuf dependencies"
210172
211- - name : Create compilation database for enhanced accuracy
173+ - name : Verify CodeQL configuration for direct source analysis
212174 if : matrix.language == 'cpp'
213175 run : |
214- echo "Creating compilation database to guide CodeQL analysis..."
215-
216- # Create a simple compilation database to help CodeQL understand the project
217- echo '[' > compile_commands.json
218- echo ' {' >> compile_commands.json
219- echo ' "directory": "'$(pwd)'",' >> compile_commands.json
220- echo ' "command": "clang++ -std=c++17 -I. -Igenerated/config -Igenerated/proto -Iservices -Iapi -I/usr/include -I/usr/local/include -DENABLE_CORE_DUMPS=1 -DENABLE_PROTECTED_AUDIENCE=1 -DCODEQL_ANALYSIS=1 -c services/auction_service/auction_main.cc",' >> compile_commands.json
221- echo ' "file": "services/auction_service/auction_main.cc"' >> compile_commands.json
222- echo ' }' >> compile_commands.json
223- echo ']' >> compile_commands.json
176+ echo "Verifying CodeQL configuration for 'none' build mode analysis..."
177+ echo "Note: Compilation database not needed - CodeQL analyzes source directly"
224178
225- # Verify the compilation database was created
226- echo "Compilation database created:"
227- ls -la compile_commands.json
228- echo "Sample content:"
229- head -5 compile_commands.json
179+ echo "CodeQL extractor configuration:"
180+ echo "- Include directories: generated/config:/usr/include:/usr/local/include:services:api:third_party"
181+ echo "- Preprocessor defines: ENABLE_CORE_DUMPS=1,ENABLE_PROTECTED_AUDIENCE=1,CODEQL_ANALYSIS=1"
182+ echo "- Build mode: none (direct source analysis)"
230183
231- echo "✅ Compilation database created to enhance CodeQL analysis accuracy "
184+ echo "✅ CodeQL configured for optimal direct source code analysis "
232185
233186 - name : Verify CodeQL database preparation
234187 if : matrix.language == 'cpp'
0 commit comments