codeql.yml

name: CodeQL

on:
  schedule:
    # Weekly, Tuesday 05:23 UTC. Off-peak; avoids top-of-hour scheduling congestion.
    - cron: '23 5 * * 2'
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - '**/*.py'
      - '.github/workflows/**'
  pull_request:
    branches: [main]
    paths:
      - '**/*.py'
      - '.github/workflows/**'

permissions: read-all

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # Interpreted languages and workflow files. These need no build, so they are cheap
  # enough to run on every push and pull request.
  analyze:
    name: Analyze (${{ matrix.language }})
    # Public repo only.
    if: github.repository == 'intel/mlir-extensions'
    runs-on: ubuntu-22.04
    timeout-minutes: 30

    permissions:
      security-events: write   # required to upload SARIF
      contents: read
      actions: read

    strategy:
      fail-fast: false
      matrix:
        language: [actions, python]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: none
          config-file: ./.github/codeql/codeql-config.yml
          # Uncomment once the initial backlog is cleared.
          # queries: security-extended

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:${{ matrix.language }}

  # C++ needs a traced build, which means a full LLVM/MLIR build whenever the cache
  # written by build.yml has been evicted (~2 h). Restrict it to the weekly schedule and
  # to manual runs so that ordinary pull requests -- which only ever match the .py and
  # workflow path filters above -- are not billed for it.
  analyze-cpp:
    name: Analyze (c-cpp)
    if: >-
      github.repository == 'intel/mlir-extensions'
      && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
    runs-on: ubuntu-22.04
    timeout-minutes: 360

    permissions:
      security-events: write   # required to upload SARIF
      contents: read
      actions: read

    defaults:
      run:
        shell: bash -leo pipefail {0}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup cache vars
        run: echo "LLVM_SHA=$(cat build_tools/llvm_version.txt)" | tee -a $GITHUB_ENV

      - name: Restore LLVM-MLIR install (shared with build.yml)
        id: cache-llvm
        uses: actions/cache/restore@v4
        with:
          path: ${{ github.workspace }}/mlir
          # Must match the key written by build.yml (bump LLVM_CACHE_NUMBER there in lockstep).
          key: ${{ runner.os }}-build-llvm-2-${{ env.LLVM_SHA }}

      - name: Install build tools
        run: |
          sudo apt-get update
          sudo apt-get install -y cmake ninja-build binutils

      - name: Build LLVM-MLIR (cache miss only)
        if: steps.cache-llvm.outputs.cache-hit != 'true'
        run: |
          git clone https://github.com/llvm/llvm-project --branch main --single-branch
          cd llvm-project
          git checkout "$LLVM_SHA"
          git apply ../build_tools/patches/*.patch
          cmake -G Ninja -B build -S llvm \
            -DCMAKE_BUILD_TYPE=MinSizeRel \
            -DLLVM_ENABLE_PROJECTS=mlir \
            -DLLVM_ENABLE_ASSERTIONS=ON \
            -DLLVM_USE_LINKER=gold \
            -DLLVM_INSTALL_UTILS=ON \
            -DLLVM_TARGETS_TO_BUILD="X86;SPIRV" \
            -DLLVM_ENABLE_BINDINGS=OFF \
            -DLLVM_ENABLE_ZSTD=OFF \
            -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/mlir
          cmake --build build --target install
          rm -rf build   # reclaim runner disk before CodeQL DB creation

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: c-cpp
          build-mode: manual
          config-file: ./.github/codeql/codeql-config.yml
          # Uncomment once the initial backlog is cleared.
          # queries: security-extended

      # Standalone (out-of-tree) IMEX build: puts ONLY IMEX C++ in the database.
      # Do NOT use scripts/compile.sh here -- it configures LLVM with
      # LLVM_EXTERNAL_PROJECTS=Imex and would pull all of LLVM into the DB.
      - name: Build IMEX
        run: |
          pip install lit
          cmake -S . -B _build -GNinja \
            -DCMAKE_BUILD_TYPE=Release \
            -DLLVM_EXTERNAL_LIT="$(which lit)" \
            -DMLIR_DIR=${{ github.workspace }}/mlir/lib/cmake/mlir \
            -DLLVM_LIT_ARGS=-a
          cmake --build _build   # build targets only; lit tests are not needed for CodeQL

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:c-cpp