msvc-code-analysis.yml

name: Microsoft C++ Code Analysis

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions: {}

jobs:
  analyze:
    env:
      BUILD: ${{ github.workspace }}\out\build\windows-x64
      CONFIG: Debug
      VCPKG_BINARY_SOURCES: clear;x-gha,readwrite
    permissions:
      contents: read
      security-events: write
      actions: read
    name: Analyze
    runs-on: windows-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Check out vcpkg
        uses: actions/checkout@v4
        with:
          repository: microsoft/vcpkg
          path: ${{ github.workspace }}\vcpkg
          persist-credentials: false

      - name: Export GitHub Actions cache environment variables
        uses: actions/github-script@v7
        with:
          script: |-
            core.exportVariable(
              'ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || ''
            );
            core.exportVariable(
              'ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || ''
            );

      - name: Bootstrap vcpkg
        run: .\vcpkg\bootstrap-vcpkg.bat -disableMetrics

      - name: Configure CMake
        env:
          CMAKE_CONFIGURE_PRESET_NAME: windows-x64
        run: >-
          cmake
          --preset '${{ env.CMAKE_CONFIGURE_PRESET_NAME }}'

      - name: Initialize MSVC Code Analysis
        uses: microsoft/msvc-code-analysis-action@24c285ab36952c9e9182f4b78dfafbac38a7e5ee
        id: run-analysis
        env:
          CL: /DCATCH_CONFIG_EXPERIMENTAL_STATIC_ANALYSIS_SUPPORT %CL%
        with:
          buildConfiguration: ${{ env.CONFIG }}
          cmakeBuildDirectory: ${{ env.BUILD }}
          ruleset: NativeRecommendedRules.ruleset

      - name: Upload SARIF to GitHub
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.run-analysis.outputs.sarif }}

      - name: Upload SARIF as an Artifact
        uses: actions/upload-artifact@v4
        with:
          name: sarif-file
          path: ${{ steps.run-analysis.outputs.sarif }}