codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Run weekly on Sunday at 00:00 UTC
    - cron: '0 0 * * 0'

# Cancel in-progress runs for the same PR/branch
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  security-events: write

jobs:
  analyze:
    runs-on: ubuntu-24.04
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Cache toolchain
        uses: actions/cache@v5
        id: cache-toolchain
        with:
          path: riscv
          # Share cache with main CI workflow
          key: riscv32-gnu-${{ hashFiles('.ci/setup-toolchain.sh') }}

      - name: Setup toolchain
        if: steps.cache-toolchain.outputs.cache-hit != 'true'
        run: .ci/setup-toolchain.sh gnu

      - name: Configure toolchain environment
        run: |
          echo "$PWD/riscv/bin" >> "$GITHUB_PATH"
          echo "CROSS_COMPILE=riscv32-unknown-elf-" >> "$GITHUB_ENV"

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: cpp

      - name: Build
        run: make -j$(nproc)

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4