name: "Code scanning"

on:
  push:
  pull_request:
  schedule:
    - cron: '0 0 * * 1'

jobs:
  build:
    name: ${{ matrix.name }}
    runs-on: ubuntu-20.04

    strategy:
      matrix:
        name: [CodeQL, Clang]

    steps:
    - name: Checkout repository
      uses: actions/checkout@v2

    - name: Install meson and ninja
      run: |
        sudo apt --assume-yes install python3-wheel python3-setuptools
        sudo pip3 install meson ninja PyYAML

    - name: Install microsoft/sarif-multitool
      run: |
        sudo apt --assume-yes install npm
        npm install @microsoft/sarif-multitool

    - name: Initialize CodeQL
      if: matrix.name == 'CodeQL'
      uses: github/codeql-action/init@v1
      with:
        setup-python-dependencies: false

    - name: Autobuild CodeQL
      if: matrix.name == 'CodeQL'
      uses: github/codeql-action/autobuild@v1

    - name: Perform CodeQL Analysis
      if: matrix.name == 'CodeQL'
      uses: github/codeql-action/analyze@v1
      with:
        output: "reports"
        upload: false

    - name: Merge all files (CodeQL)
      if: matrix.name == 'CodeQL'
      run: npx @microsoft/sarif-multitool merge reports/*.sarif

    - name: Install clang-tools-11 (Clang)
      if: matrix.name == 'Clang'
      run: |
        sudo apt --assume-yes install wget
        sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)"
        sudo apt --assume-yes install clang-tools-11

    - name: Analysis (Clang)
      if: matrix.name == 'Clang'
      run: |
        export PATH=${HOME}/Library/Python/3.8/bin:${HOME}/Library/Python/3.9/bin:${HOME}/.local/bin:${PATH}
        scan-build-11 -v -sarif -o reports "meson build && meson compile -C build"

    - name: Merge all files (Clang)
      if: matrix.name == 'Clang'
      run: npx @microsoft/sarif-multitool merge reports/**/*.sarif

    - name: Exclude external lib
      run: |
        jq 'del(.runs[].results[].locations[] | select(.physicalLocation.artifactLocation.uri | contains("subprojects/")))' merged.sarif > tmp0.sarif
        jq 'del(.runs[].results[] | select(.locations | length == 0))' tmp0.sarif > tmp1.sarif
        jq 'del(.runs[] | select(.results | length == 0))' tmp1.sarif > filtered.sarif

    - name: Treat warnings as errors
      run: |
        jq '.runs[].tool.driver.rules[] |= . + {"defaultConfiguration": {"level": "error"}}' filtered.sarif > final.sarif

    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v1
      with:
        sarif_file: final.sarif