msvc-analysis.yml

name: msvc analysis

on:
  pull_request:
    branches:
      - '**'
    paths-ignore:
      - '**/*.md'

jobs:
  # We use the presence of the sonar token to detect if the PR comes from a fork
  condition-check:
    runs-on: ubuntu-latest
    outputs:
      ok: ${{ steps.check-secrets.outputs.ok }}
    steps:
      - name: Secret guard
        id: check-secrets
        run: |
          if [ ! -z "${{ secrets.SONAR_TOKEN }}" ]; then
            echo "ok=true" >> $GITHUB_OUTPUT
          fi
  vs2022:
    needs:
      - condition-check
    runs-on: windows-2022
    steps:
      - name: Git checkout
        uses: actions/checkout@v4
        with:
          submodules: 'recursive'
      - name: Generate solution (release-x64)
        run: python3 make.py -ci -compiler vs2022 -config Release -cpu x64
      - name: Run MSVC Code Analysis
        uses: microsoft/msvc-code-analysis-action@v0.1.1
        id: run-analysis
        with:
          cmakeBuildDirectory: ${{ github.workspace }}/build
          buildConfiguration: Release
          ruleset: NativeRecommendedRules.ruleset
          ignoredPaths: ${{ github.workspace }}/external
      - name: Upload SARIF to GitHub
        # Can only upload SARIF if we don't come from a fork
        if: ${{ needs.condition-check.outputs.ok == 'true' }}
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: ${{ steps.run-analysis.outputs.sarif }}
      - name: Upload SARIF as an Artifact
        uses: actions/upload-artifact@v2
        with:
          name: sarif-file
          path: ${{ steps.run-analysis.outputs.sarif }}