codeql.yml

name: CodeQL

on:
  push:
    branches: [main, 'release/**']
  pull_request:
  schedule:
    - cron: '0 7 * * 1'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  security-events: write

jobs:
  analyze:
    name: CodeQL (C, security)
    runs-on: ubuntu-latest
    timeout-minutes: 45
    container:
      image: ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.15
    steps:
      - uses: actions/checkout@v4
      - name: Initialize dependencies
        timeout-minutes: 10
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          git config --global url."https://github.com/".insteadOf git@github.com:
          git submodule update --init --recursive --depth 1 --jobs 4
      - name: Check build toolchains
        run: |
          cc --version
          arm-none-eabi-gcc --version
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: c-cpp
          build-mode: manual
          queries: security-extended
      - name: Build wolfTrust
        run: sh tools/ci-static-analysis-build.sh
      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:c-cpp