codeql-push.yml

name: CodeQL

on:
  push:
    paths:
    - 'source/common/**'
    branches-ignore:
    - 'dependabot/**'
  pull_request:

jobs:
  CodeQL-Build:

    permissions:
      security-events: write  # for github/codeql-action/analyze to upload SARIF results
    strategy:
      fail-fast: false

    # CodeQL runs on ubuntu-latest and windows-latest
    runs-on: ubuntu-latest
    if: github.repository == 'envoyproxy/envoy'

    steps:
    - name: Checkout repository
      uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
      with:
        # We must fetch at least the immediate parents so that if this is
        # a pull request then we can checkout the head.
        fetch-depth: 2

    - name: Get build targets
      run: |
       . .github/workflows/get_build_targets.sh
       echo 'BUILD_TARGETS<<EOF' >> $GITHUB_ENV
       echo $BUILD_TARGETS_LOCAL >> $GITHUB_ENV
       echo 'EOF' >> $GITHUB_ENV
    # If this run was triggered by a pull request event, then checkout
    # the head of the pull request instead of the merge commit.
    - run: git checkout HEAD^2
      if: ${{ github.event_name == 'pull_request' }}

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@0182a2c78c8a55b763909348834ed54d735ab3e2
      # Override language selection by uncommenting this and choosing your languages
      with:
        languages: cpp

    - name: Install deps
      shell: bash
      run: |
       sudo apt-get update --error-on=any
       sudo apt-get install --yes libtool cmake automake autoconf make ninja-build curl unzip virtualenv openjdk-11-jdk build-essential libc++1
       mkdir -p bin/clang11
       cd bin/clang11
       wget https://github.com/llvm/llvm-project/releases/download/llvmorg-11.0.1/clang+llvm-11.0.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz
       tar -xf clang+llvm-11.0.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz --strip-components 1
       export PATH=bin/clang11/bin:$PATH


    - name: Build
      run: |
       bazel/setup_clang.sh bin/clang11
       bazelisk shutdown
       bazelisk build -c fastbuild --spawn_strategy=local --discard_analysis_cache --nouse_action_cache --config clang --config libc++ $BUILD_TARGETS
       echo -e "Built targets...\n$BUILD_TARGETS"

    - name: Clean Artifacts
      run: |
        git clean -xdf

    - name: Perform CodeQL Analysis
      if: env.BUILD_TARGETS != ''
      uses: github/codeql-action/analyze@0182a2c78c8a55b763909348834ed54d735ab3e2