static-analysis.yml

name: Static Code Analysis

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
    paths:
      - "CMakeLists.txt"
      - "src/*.c"
      - "src/*.h"
      - "src/*.h.in"
      - "cmake/*"
      - ".github/workflows/static-analysis.yml"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  clang-analyze:
    name: Run scan-build
    runs-on: ubuntu-latest
    if: ${{ !contains(github.event.head_commit.message, '[ci skip]') || github.event_name != 'push' }}
    env:
      CC: clang
      CCC_CC: clang
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Check out source code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install dependencies
        run: sudo apt-get -qq update && sudo apt-get install -y libev-dev clang-tools

      - name: Install libassh
        run: |
          mkdir libassh
          cd libassh
          wget -q http://download.savannah.nongnu.org/releases/libassh/libassh-1.1.tar.gz -O - | tar -xz --strip-components=1 -f -
          ./configure --quiet --enable-silent-rules --disable-client --disable-examples --without-gcrypt --without-openssl --without-sodium --without-zlib --disable-dependency-tracking
          make -j2
          sudo make install

      - name: Configure
        run: scan-build cmake -S . -B build

      - name: Build
        run: scan-build --force-analyze-debug-code -sarif --status-bugs -o ../results cmake --build build
        continue-on-error: true
        id: build

      - name: Upload scan results
        uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3

      - name: Set exit code
        run: exit 1
        if: steps.build.outcome == 'failure'