name: CodeQL

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]
  schedule:
    - cron: '23 4 * * 1'

permissions:
  actions: read
  contents: read
  security-events: write

jobs:
  analyze:
    name: Analyze C sources
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install PostgreSQL build dependencies
        run: |
          sudo apt-get update
          # Do not use postgresql-server-dev-all here: on the GitHub runner it
          # is the Ubuntu metapackage, which pins postgresql-common to the
          # Ubuntu version and conflicts with the PGDG repository already
          # configured on the image.
          sudo apt-get install -y postgresql-server-dev-16 build-essential

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: c-cpp

      - name: Build extension for analysis
        run: |
          PG_CONFIG="$(find /usr/lib/postgresql -name pg_config | sort -V | tail -1)"
          echo "Using $PG_CONFIG"
          # PostgreSQL packages built with LLVM try to emit .bc files and may
          # require a clang version that is not installed on the runner.
          # Bitcode is not needed for CodeQL, so disable it.
          make PG_CONFIG="$PG_CONFIG" with_llvm=no clean all

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:c-cpp"