Repository navigation
.github/workflows: Migrate workflows to Blacksmith runners #4925
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| # Always trigger on PRs so required checks appear and can succeed fast via a no-op. | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| push: | |
| branches: [ main ] # scan after merge too | |
| paths: | |
| - 'volume-cartographer/**' | |
| - '.github/codeql/**' | |
| - '.github/workflows/vc3d-codeql.yml' | |
| # Keep an on-demand lever now that schedule (which can't be path-filtered) is removed. | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| changes: | |
| name: Detect changes | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| pull-requests: read | |
| contents: read | |
| outputs: | |
| vc: ${{ steps.filter.outputs.vc }} | |
| steps: | |
| # On push events paths-filter uses git and needs a checkout. | |
| - name: Checkout (non-PR events) | |
| if: github.event_name != 'pull_request' | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Paths filter | |
| id: filter | |
| uses: dorny/paths-filter@v3 | |
| with: | |
| filters: | | |
| vc: | |
| - 'volume-cartographer/**' | |
| - '.github/codeql/**' | |
| - '.github/workflows/vc3d-codeql.yml' | |
| # Fast PR scans use independent source databases so extraction and queries | |
| # run concurrently. The post-merge deep scan remains monolithic to retain | |
| # cross-component data-flow analysis. | |
| analyze_fast_shards: | |
| name: PR scan (${{ matrix.name }}) | |
| if: github.event_name == 'pull_request' && needs.changes.outputs.vc == 'true' | |
| needs: [changes] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: core | |
| id: core | |
| config: .github/codeql/codeql-pr-core.yml | |
| - name: VC3D controllers | |
| id: vc3d-controllers | |
| config: .github/codeql/codeql-pr-vc3d-controllers.yml | |
| - name: VC3D components | |
| id: vc3d-components | |
| config: .github/codeql/codeql-pr-vc3d-components.yml | |
| - name: tools and libraries | |
| id: tools-libs | |
| config: .github/codeql/codeql-pr-tools-libs.yml | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL (no build) | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: c-cpp | |
| build-mode: none | |
| queries: security-extended | |
| config-file: ${{ matrix.config }} | |
| - name: Analyze | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:c-cpp/shard:${{ matrix.id }}" | |
| # Preserve the existing required-check name while making it reflect every | |
| # parallel PR shard. Unrelated PRs still receive a successful no-op result. | |
| analyze_fast: | |
| if: always() && github.event_name == 'pull_request' | |
| needs: [changes, analyze_fast_shards] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Verify change detection | |
| env: | |
| CHANGES_RESULT: ${{ needs.changes.result }} | |
| run: | | |
| if [[ "$CHANGES_RESULT" != "success" ]]; then | |
| echo "Change detection failed: $CHANGES_RESULT" >&2 | |
| exit 1 | |
| fi | |
| - name: No-op (unrelated changes) | |
| if: needs.changes.outputs.vc != 'true' | |
| run: echo "No volume-cartographer or CodeQL changes; PR scan skipped." | |
| - name: Verify PR scan shards | |
| if: needs.changes.outputs.vc == 'true' | |
| env: | |
| SHARDS_RESULT: ${{ needs.analyze_fast_shards.result }} | |
| run: | | |
| if [[ "$SHARDS_RESULT" != "success" ]]; then | |
| echo "One or more CodeQL PR shards failed: $SHARDS_RESULT" >&2 | |
| exit 1 | |
| fi | |
| # 🧪 Deep scan for push/schedule: compiles with fast settings | |
| analyze_deep: | |
| if: github.event_name == 'push' | |
| needs: [changes] | |
| # Pin to Ubuntu 26.04 (resolute) rather than ubuntu-latest (still 24.04). | |
| # install_build_deps.sh — the single source of truth for the VC3D | |
| # toolchain, shared with the Dockerfile (FROM ubuntu:26.04) — pulls | |
| # flang-21 / libclang-rt-21-dev, which only exist in 26.04's default | |
| # repos. On noble the deps install failed with "Unable to locate package". | |
| # NOTE: ubuntu-26.04 is currently a *preview* runner image; revisit once | |
| # ubuntu-latest migrates to 26.04 (GA), at which point this pin can drop. | |
| runs-on: ubuntu-26.04 | |
| timeout-minutes: 360 | |
| container: | |
| image: ghcr.io/scrollprize/vc3d-deps/linux:sha-0c371b1d472c5281b703d65517e980d945da693f | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| permissions: | |
| security-events: write | |
| contents: read | |
| packages: read | |
| steps: | |
| - name: No-op (unrelated changes) | |
| if: needs.changes.outputs.vc != 'true' | |
| run: echo "✅ No volume-cartographer changes — skipping CodeQL deep scan." | |
| - name: Checkout | |
| if: needs.changes.outputs.vc == 'true' | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # history-aware queries if needed | |
| # Keep this until the next published dependency image includes the | |
| # libsqlite3-dev entry in scripts/install_build_deps.sh. | |
| - name: Install SQLite headers | |
| if: needs.changes.outputs.vc == 'true' | |
| run: | | |
| apt-get update | |
| apt-get install -y --no-install-recommends libsqlite3-dev | |
| - name: Initialize CodeQL | |
| if: needs.changes.outputs.vc == 'true' | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: c-cpp | |
| build-mode: manual | |
| queries: security-extended,security-and-quality | |
| config-file: .github/codeql/codeql-config.yml | |
| - name: Configure (Ninja, fast flags) | |
| if: needs.changes.outputs.vc == 'true' | |
| working-directory: ./volume-cartographer | |
| run: | | |
| cmake -S . -B build -G Ninja \ | |
| -DVC_TESTING=OFF \ | |
| -DCMAKE_BUILD_TYPE=Debug \ | |
| -DCMAKE_C_COMPILER=gcc \ | |
| -DCMAKE_CXX_COMPILER=g++ | |
| - name: Build (fast) | |
| if: needs.changes.outputs.vc == 'true' | |
| working-directory: ./volume-cartographer | |
| run: ninja -C build | |
| - name: Analyze | |
| if: needs.changes.outputs.vc == 'true' | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:c-cpp" |