codeql-daily.yml

name: CodeQL/daily

permissions:
  contents: read

on:
  schedule:
  - cron: '0 12 * * 4'

concurrency:
  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
  cancel-in-progress: true


jobs:
  CodeQL-Build:

    permissions:
      security-events: write  # for github/codeql-action/analyze to upload SARIF results
      pull-requests: read
    strategy:
      fail-fast: false

    # CodeQL runs on ubuntu-20.04
    runs-on: ubuntu-20.04
    if: github.repository == 'envoyproxy/envoy'

    steps:
    - name: Checkout repository
      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4.1.6

    - name: Free disk space
      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.30
      with:
        to_remove: |
          /usr/local/lib/android

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@4fa2a7953630fd2f3fb380f21be14ede0169dd4f  # codeql-bundle-v3.25.12
      # Override language selection by uncommenting this and choosing your languages
      with:
        languages: cpp

    - name: Install deps
      shell: bash
      run: |
       sudo apt-get update --error-on=any
       sudo apt-get install --yes \
           libtool cmake automake autoconf make ninja-build curl unzip \
           virtualenv openjdk-11-jdk build-essential libc++1
       # Note: the llvm/clang version should match the version specifed in:
       #  - bazel/repository_locations.bzl
       #  - .github/workflows/codeql-push.yml
       #  - https://github.com/envoyproxy/envoy-build-tools/blob/main/build_container/build_container_ubuntu.sh#L84
       mkdir -p bin/clang14
       cd bin/clang14
       wget https://github.com/llvm/llvm-project/releases/download/llvmorg-14.0.0/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04.tar.xz
       tar -xf clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04.tar.xz --strip-components 1
       export PATH=bin/clang14/bin:$PATH

    - name: Build
      run: |
       bazel/setup_clang.sh bin/clang14
       bazelisk shutdown
       bazelisk build -c fastbuild --spawn_strategy=local --discard_analysis_cache --nouse_action_cache --config clang --config libc++ \
           //source/common/http/...

    - name: Clean Artifacts
      run: |
        git clean -xdf

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@4fa2a7953630fd2f3fb380f21be14ede0169dd4f  # codeql-bundle-v3.25.12