Repository: X-rays5/gta_base
Pull request #60: Combine analyze pipelines
Author: login: X-rays5
Created: 2025-04-04T22:04:16Z | Merged: 2025-04-05T13:19:27Z

This pull request includes significant updates to the CI/CD workflows and configuration files to improve the build and analysis process. The changes involve renaming the workflow, adding concurrency control, enhancing the matrix strategy, and integrating CodeQL and SonarCloud for better code analysis.

### CI/CD Workflow Enhancements:

* [`.github/workflows/build.yml`](diffhunk://#diff-5c3fa597431eda03ac3339ae6bf7f05e1a50d6fc7333679ec38e21b337cb6721L1-R148): Renamed the workflow to "CI/CD" and added concurrency control to cancel in-progress runs. The matrix strategy was expanded to include different languages and build modes, and steps were added for caching, CodeQL initialization, and SonarCloud scanning.

### Removal of Redundant Workflow:

* [`.github/workflows/codeql.yml`](diffhunk://#diff-12783128521e452af0cfac94b99b8d250413c516ec71fe6d97dbea666ff7ba27L1-L44): Removed the separate CodeQL workflow as its functionality has been integrated into the main CI/CD workflow.

### SonarCloud Configuration:

* [`sonar-project.properties`](diffhunk://#diff-43ed9d31bea2a6d518d69836bcd1a8e6bd81bf4df96c4745792c220ca5aa549cR11-R19): Added exclusions for third-party libraries and build directories, and configured C++ specific settings for better analysis performance.


Diff:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 10fe8c44..fca13288 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,30 +1,148 @@
-name: build
+name: CI/CD
 on:
   push:
     branches:
       - master
   pull_request:
-    types: [ opened, synchronize, reopened ]
+    branches:
+      - master
+  schedule:
+    - cron: 17 7 * * 0
+  workflow_dispatch: null
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    name: Build and analyze
+    name: Build & Analyze
     runs-on: windows-2025
+    permissions:
+      security-events: write
+      packages: read
+      contents: write
+
     env:
-      BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory # Directory where build-wrapper output will be placed
+      BUILD_DIR: ${{ github.workspace }}/build
+      BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory
+      ALL_EXE_ARTIFACTS: ${{ github.workspace }}/build/**/*.exe
+      ALL_DLL_ARTIFACTS: ${{ github.workspace }}/build/**/*.dll
+      CMAKE_BUILD_CONFIG: Release
+      GIT_MAIN_BRANCH: master
+      SONAR_USER_HOME: ${{ github.workspace }}/.sonar
+    
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: c-cpp
+            build-mode: manual
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Fetch SonarCloud comparison branch
+        if: matrix.language == 'c-cpp'
+        run: >
+          if ($Env:GITHUB_EVENT_NAME -eq "pull_request") {
+            $TARGET_BRANCH="${{ github.base_ref }}"
+            Write-Host "PR detected. Fetching target branch: $TARGET_BRANCH"
+            git fetch origin ${TARGET_BRANCH}:refs/remotes/origin/${TARGET_BRANCH}
+          } else {
+            Write-Host "Fetching ${{ env.GIT_MAIN_BRANCH }} branch"
+            git fetch origin ${{ env.GIT_MAIN_BRANCH }}:refs/remotes/origin/${{ env.GIT_MAIN_BRANCH }}
+          }
+
+      - name: Cache CMake build files
+        if: matrix.language == 'c-cpp'
+        uses: actions/cache@v4.2.3
+        with:
+          path: ${{ env.BUILD_DIR }}
+          key: ${{ runner.os }}-cmake-${{ hashFiles('CMakeLists.txt', '**/CMakeLists.txt', '**/*.hpp', '**/*.cpp') }}
+      - name: Cache vendor
+        if: matrix.language == 'c-cpp'
+        uses: actions/cache@v4.2.3
         with:
-          fetch-depth: 500  # Shallow clones should be disabled for a better relevancy of analysis
-      - name: Install sonar-scanner and build-wrapper
-        uses: SonarSource/sonarcloud-github-c-cpp@v3
+          path: ${{ env.BUILD_DIR }}/_deps
+          key: ${{ runner.os }}-vendor-${{ hashFiles('vendor/**/*.*') }}
+          restore-keys: |
+            ${{ runner.os }}-vendor-
+      - name: Cache SonarCloud scanner
+        if: matrix.language == 'c-cpp'
+        uses: actions/cache@v4.2.3
+        with:
+          path: ${{ env.SONAR_USER_HOME }}
+          key: ${{ runner.os }}-sonar-${{ github.ref_name }}
+          restore-keys: |
+            ${{ runner.os }}-sonar-
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Install build-wrapper
+        if: matrix.language == 'c-cpp'
+        uses: SonarSource/sonarqube-scan-action/install-build-wrapper@v5.1.0
+
       - name: Build with build-wrapper
+        if: matrix.language == 'c-cpp'
         run: |
-          New-Item -ItemType directory -Path build
-          cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
-          build-wrapper-win-x86-64 --out-dir ${{ env.BUILD_WRAPPER_OUT_DIR }} cmake --build build/ --config Release
-      - name: Run sonar-scanner
+          New-Item -ItemType directory -Path ${{ env.BUILD_DIR }} -Force
+          cmake -S . -B ${{ env.BUILD_DIR }} -DCMAKE_BUILD_TYPE=${{ env.CMAKE_BUILD_CONFIG }}
+          build-wrapper-win-x86-64 --out-dir ${{ env.BUILD_WRAPPER_OUT_DIR }} cmake --build ${{ env.BUILD_DIR }} --config ${{ env.CMAKE_BUILD_CONFIG }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: /language:${{matrix.language}}
+          output: ${{ github.workspace }}/results/codeql
+          upload: failure-only
+      - name: Filter CPP SARIF to exclude build directory
+        if: matrix.language == 'c-cpp'
+        uses: advanced-security/filter-sarif@v1
+        with:
+          input: ${{ github.workspace }}/results/codeql/cpp.sarif
+          output: ${{ github.workspace }}/results/codeql/cpp.sarif
+          patterns: |
+            -build/**
+      - name: Upload CodeQL SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: ${{ github.workspace }}/results/codeql
+
+      - name: Run SonarCloud scan
+        if: matrix.language == 'c-cpp'
+        uses: SonarSource/sonarqube-scan-action@v5.1.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        run: |
-          sonar-scanner --define sonar.cfamily.compile-commands="${{ env.BUILD_WRAPPER_OUT_DIR }}/compile_commands.json"
+        with:
+          args: |
+            -Dsonar.cfamily.compile-commands=${{ env.BUILD_WRAPPER_OUT_DIR }}/compile_commands.json -Dsonar.scm.provider=git
+
+      - name: Upload Build Artifacts
+        if: matrix.language == 'c-cpp'
+        uses: actions/upload-artifact@v4.6.2
+        with:
+          name: build-artifacts
+          path: |
+            ${{ env.ALL_EXE_ARTIFACTS }}
+            ${{ env.ALL_DLL_ARTIFACTS }}
+          retention-days: 7
+
+      - name: Create Release
+        if: matrix.language == 'c-cpp' && startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v2.2.1
+        with:
+          files: |
+            ${{ env.ALL_EXE_ARTIFACTS }}
+            ${{ env.ALL_DLL_ARTIFACTS }}
+          generate_release_notes: true
\ No newline at end of file
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index 62f5f2c2..00000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,44 +0,0 @@
-name: "CodeQL"
-on:
-  push:
-    branches: [ "master", "**legacy**" ]
-  pull_request:
-    branches: [ "master", "**legacy**" ]
-  schedule:
-    - cron: '17 7 * * 0'
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: windows-2025
-    permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - language: actions
-          build-mode: none
-        - language: c-cpp
-          build-mode: manual
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: ${{ matrix.build-mode }}
-    - if: matrix.build-mode == 'manual' && matrix.language == 'c-cpp'
-      run: |
-        New-Item -ItemType directory -Path build
-        cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
-        cmake --build build/ --config Release
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
-      with:
-        category: "/language:${{matrix.language}}"
diff --git a/sonar-project.properties b/sonar-project.properties
index faaff8b0..313b72cf 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -8,5 +8,14 @@ sonar.projectVersion=2.0
 # Path is relative to the sonar-project.properties file. Replace "\" by "/" on Windows.
 sonar.sources=.
 
+# Exclude third-party libraries, tests, and build directories
+sonar.exclusions=build/**/*,vendor/**/*
+
+# C++ specific settings
+sonar.cfamily.gcov.reportsPath=build/coverage
+sonar.cfamily.threads=4
+sonar.cfamily.cache.enabled=true
+sonar.cfamily.cache.path=.sonar/cache
+
 # Encoding of the source code. Default is default system encoding
-sonar.sourceEncoding=UTF-8
\ No newline at end of file
+sonar.sourceEncoding=UTF-8


Reviews:
user: login: copilot-pull-request-reviewer[bot]
body: 

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

<details>
<summary>Files not reviewed (1)</summary>

* **.github/workflows/codeql.yml**: Language not supported
</details>

<details>
<summary>Comments suppressed due to low confidence (2)</summary>

**.github/workflows/build.yml:56**
* The CodeQL analysis step uses matrix.language for the 'category' input, which could cause unintended behavior if matrix.language is set to a value (e.g., 'actions') that is not supported by CodeQL. Consider adding a condition to run this step only when the language is supported.
```
          category: "/language:${{matrix.language}}"
```
**.github/workflows/build.yml:25**
* [nitpick] The matrix includes an entry with language 'actions' that may be ambiguous given its usage with conditional steps. Consider clarifying its role or renaming it if it is not intended for CodeQL and Sonar analysis.
```
          - language: actions
```
</details>


state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-04T22:04:48Z
user: login: copilot-pull-request-reviewer[bot]
body: 

Copilot reviewed 1 out of 3 changed files in this pull request and generated 1 comment.

<details>
<summary>Files not reviewed (2)</summary>

* **.github/workflows/codeql.yml**: Language not supported
* **sonar-project.properties**: Language not supported
</details>



state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-05T13:18:11Z
user: login: X-rays5
state: COMMENTED
author_association: OWNER
submitted_at: 2025-04-05T13:19:21Z

Review comments:
diff_hunk: @@ -1,30 +1,148 @@
-name: build
+name: CI/CD
 on:
   push:
     branches:
       - master
   pull_request:
-    types: [ opened, synchronize, reopened ]
+    branches:
+      - master
+  schedule:
+    - cron: 17 7 * * 0
+  workflow_dispatch: null
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    name: Build and analyze
+    name: Build & Analyze
     runs-on: windows-2025
+    permissions:
+      security-events: write
+      packages: read
+      contents: write
+
     env:
-      BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory # Directory where build-wrapper output will be placed
+      BUILD_DIR: ${{ github.workspace }}/build
+      BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory
+      ALL_EXE_ARTIFACTS: ${{ github.workspace }}/build/**/*.exe
+      ALL_DLL_ARTIFACTS: ${{ github.workspace }}/build/**/*.dll
+      CMAKE_BUILD_CONFIG: Release
+      GIT_MAIN_BRANCH: master
+      SONAR_USER_HOME: ${{ github.workspace }}/.sonar
+    
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: c-cpp
+            build-mode: manual
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Fetch SonarCloud comparison branch
+        if: matrix.language == 'c-cpp'
+        run: >
+          if ($Env:GITHUB_EVENT_NAME -eq "pull_request") {
+            $TARGET_BRANCH="${{ github.base_ref }}"
+            Write-Host "PR detected. Fetching target branch: $TARGET_BRANCH"
+            git fetch origin ${TARGET_BRANCH}:refs/remotes/origin/${TARGET_BRANCH}
+          } else {
+            Write-Host "Fetching ${{ env.GIT_MAIN_BRANCH }} branch"
+            git fetch origin ${{ env.GIT_MAIN_BRANCH }}:refs/remotes/origin/${{ env.GIT_MAIN_BRANCH }}
+          }
+
+      - name: Cache CMake build files
+        if: matrix.language == 'c-cpp'
+        uses: actions/cache@v4.2.3
+        with:
+          path: ${{ env.BUILD_DIR }}
+          key: ${{ runner.os }}-cmake-${{ hashFiles('CMakeLists.txt', '**/CMakeLists.txt', '**/*.hpp', '**/*.cpp') }}
+      - name: Cache vendor
+        if: matrix.language == 'c-cpp'
+        uses: actions/cache@v4.2.3
         with:
-          fetch-depth: 500  # Shallow clones should be disabled for a better relevancy of analysis
-      - name: Install sonar-scanner and build-wrapper
-        uses: SonarSource/sonarcloud-github-c-cpp@v3
+          path: ${{ env.BUILD_DIR }}/_deps
+          key: ${{ runner.os }}-vendor-${{ hashFiles('vendor/**/*.*') }}
+          restore-keys: |
+            ${{ runner.os }}-vendor-
+      - name: Cache SonarCloud scanner
+        if: matrix.language == 'c-cpp'
+        uses: actions/cache@v4.2.3
+        with:
+          path: ${{ env.SONAR_USER_HOME }}
+          key: ${{ runner.os }}-sonar-${{ github.ref_name }}
+          restore-keys: |
+            ${{ runner.os }}-sonar-
+
+      - name: Initialize CodeQL
path: .github/workflows/build.yml
user: login: Copilot
body: Consider adding a condition to only initialize CodeQL for the 'c-cpp' build mode, as running it for the 'actions' language may be unnecessary.
```suggestion
      - name: Initialize CodeQL
        if: matrix.language == 'c-cpp'
```
created_at: 2025-04-05T13:18:11Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,30 +1,148 @@
-name: build
+name: CI/CD
 on:
   push:
     branches:
       - master
   pull_request:
-    types: [ opened, synchronize, reopened ]
+    branches:
+      - master
+  schedule:
+    - cron: 17 7 * * 0
+  workflow_dispatch: null
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    name: Build and analyze
+    name: Build & Analyze
     runs-on: windows-2025
+    permissions:
+      security-events: write
+      packages: read
+      contents: write
+
     env:
-      BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory # Directory where build-wrapper output will be placed
+      BUILD_DIR: ${{ github.workspace }}/build
+      BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory
+      ALL_EXE_ARTIFACTS: ${{ github.workspace }}/build/**/*.exe
+      ALL_DLL_ARTIFACTS: ${{ github.workspace }}/build/**/*.dll
+      CMAKE_BUILD_CONFIG: Release
+      GIT_MAIN_BRANCH: master
+      SONAR_USER_HOME: ${{ github.workspace }}/.sonar
+    
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: c-cpp
+            build-mode: manual
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Fetch SonarCloud comparison branch
+        if: matrix.language == 'c-cpp'
+        run: >
+          if ($Env:GITHUB_EVENT_NAME -eq "pull_request") {
+            $TARGET_BRANCH="${{ github.base_ref }}"
+            Write-Host "PR detected. Fetching target branch: $TARGET_BRANCH"
+            git fetch origin ${TARGET_BRANCH}:refs/remotes/origin/${TARGET_BRANCH}
+          } else {
+            Write-Host "Fetching ${{ env.GIT_MAIN_BRANCH }} branch"
+            git fetch origin ${{ env.GIT_MAIN_BRANCH }}:refs/remotes/origin/${{ env.GIT_MAIN_BRANCH }}
+          }
+
+      - name: Cache CMake build files
+        if: matrix.language == 'c-cpp'
+        uses: actions/cache@v4.2.3
+        with:
+          path: ${{ env.BUILD_DIR }}
+          key: ${{ runner.os }}-cmake-${{ hashFiles('CMakeLists.txt', '**/CMakeLists.txt', '**/*.hpp', '**/*.cpp') }}
+      - name: Cache vendor
+        if: matrix.language == 'c-cpp'
+        uses: actions/cache@v4.2.3
         with:
-          fetch-depth: 500  # Shallow clones should be disabled for a better relevancy of analysis
-      - name: Install sonar-scanner and build-wrapper
-        uses: SonarSource/sonarcloud-github-c-cpp@v3
+          path: ${{ env.BUILD_DIR }}/_deps
+          key: ${{ runner.os }}-vendor-${{ hashFiles('vendor/**/*.*') }}
+          restore-keys: |
+            ${{ runner.os }}-vendor-
+      - name: Cache SonarCloud scanner
+        if: matrix.language == 'c-cpp'
+        uses: actions/cache@v4.2.3
+        with:
+          path: ${{ env.SONAR_USER_HOME }}
+          key: ${{ runner.os }}-sonar-${{ github.ref_name }}
+          restore-keys: |
+            ${{ runner.os }}-sonar-
+
+      - name: Initialize CodeQL
path: .github/workflows/build.yml
user: login: X-rays5
body: Init should always be done
created_at: 2025-04-05T13:19:21Z
author_association: OWNER

PR comments:
user: login: sonarqubecloud[bot]
created_at: 2025-04-05T13:15:54Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=X-rays5_gta_base&pullRequest=60) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=X-rays5_gta_base&pullRequest=60&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=X-rays5_gta_base&pullRequest=60&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=X-rays5_gta_base&pullRequest=60&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=X-rays5_gta_base&pullRequest=60&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=X-rays5_gta_base&pullRequest=60&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=X-rays5_gta_base&pullRequest=60)


author_association: NONE