ci: replace gh CLI with github-script in release-PR assign step (LAB-899) #175

	name: CodeQL

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	# Weekly scan on Sundays
	- cron: '0 0 * * 0'

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	env:
	# cargo's available_parallelism() reads the node's 32 threads, not the pod's
	# cgroup CPU quota, so the cold release build below can OOM-kill the linker in
	# the 5Gi cachekit runner (cachekit-rs #25/#26). Cap parallel jobs to fit.
	CARGO_BUILD_JOBS: "4"

	jobs:
	analyze:
	name: Analyze
	runs-on: cachekit
	timeout-minutes: 30
	permissions:
	actions: read
	contents: read
	security-events: write

	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

	- name: Install Rust toolchain
	uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

	- name: Initialize CodeQL
	uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
	with:
	languages: cpp
	# Analyze generated C FFI headers and cross-language test code

	- name: Build and compile C FFI test
	run: \|
	# Build Rust library with FFI to generate C header
	cargo build --release --features ffi,encryption
	# Verify header was generated
	ls -la include/cachekit.h
	# Compile C FFI test (CodeQL traces compilation)
	cd tests/cross_language
	cc -std=c99 -Wall -Wextra -I../../include -c test_c.c -o test_c.o

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
	with:
	category: "/language:cpp"

Navigation Menu