codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly scan on Sundays
    - cron: '0 0 * * 0'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze
    runs-on: cachekit
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Initialize CodeQL
        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
        with:
          languages: cpp
          # Analyze generated C FFI headers and cross-language test code

      - name: Build and compile C FFI test
        run: |
          # Build Rust library with FFI to generate C header
          cargo build --release --features ffi,encryption
          # Verify header was generated
          ls -la include/cachekit.h
          # Compile C FFI test (CodeQL traces compilation)
          cd tests/cross_language
          cc -std=c99 -Wall -Wextra -I../../include -c test_c.c -o test_c.o

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
        with:
          category: "/language:cpp"