# This workflow runs the latest CodeQL CLI and checks against CodeQL's Cpp library.
# This is the source for the GitHub Security Code Scanning job.
# On push/schedule: samples are split across 4 parallel shards to reduce wall-clock
# time while keeping ThrottleLimit 1 per shard (required for accurate CodeQL tracing).
# On pull_request: only changed samples are built in a single job (no sharding needed).

name: "CodeQL Analysis"

on:
  push:
    branches:
      - main
      - develop
    paths-ignore:
      - '**.md'
      - 'LICENSE'
  pull_request:
    # The branches below must be a subset of the branches above
    branches:
      - main
      - develop
    paths-ignore:
      - '**.md'
      - 'LICENSE'
    
  # Allow manual scheduling
  workflow_dispatch:

jobs:
  # -----------------------------------------------------------------------
  # PR job: single runner, builds only changed samples
  # -----------------------------------------------------------------------
  analyze-pr:
    name: Analysis (PR)
    if: github.event_name == 'pull_request'
    runs-on: windows-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [c-cpp]
        build-mode: [manual]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: 'recursive'

      - name: Install Nuget Packages
        run: nuget restore .\packages.config -PackagesDirectory .\packages\

      - name: Get changed files
        id: get-changed-files
        uses: tj-actions/changed-files@v41
        with:
          separator: ","

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          config-file: microsoft/Windows-Driver-Developer-Supplemental-Tools/config/codeql-config.yml@development

      - name: Build changed samples (PR)
        run: |
          $changedFiles = "${{ steps.get-changed-files.outputs.all_changed_files }}".Split(',')
          .\.github\scripts\Build-ChangedSamples.ps1 -ChangedFiles $changedFiles -Verbose
        env:
          WDS_Configuration: Debug
          WDS_Platform: x64
          WDS_WipeOutputs: ${{ true }}

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"

  # -----------------------------------------------------------------------
  # Push/schedule job: 4 parallel shards, each builds a slice of all samples
  # -----------------------------------------------------------------------
  analyze:
    name: Analysis (shard ${{ matrix.shard }} of 4)
    if: github.event_name != 'pull_request'
    runs-on: windows-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [c-cpp]
        build-mode: [manual]
        shard: [1, 2, 3, 4]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: 'recursive'

      - name: Install Nuget Packages
        run: nuget restore .\packages.config -PackagesDirectory .\packages\

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          config-file: microsoft/Windows-Driver-Developer-Supplemental-Tools/config/codeql-config.yml@development

      - name: Build sample shard ${{ matrix.shard }} of 4
        run: |
          $totalShards = 4
          $shardIndex  = ${{ matrix.shard }} - 1
          $allSamples  = .\ListAllSamples.ps1
          $shardSize   = [Math]::Ceiling($allSamples.Count / $totalShards)
          $start       = $shardIndex * $shardSize
          $mySamples   = $allSamples | Select-Object -Skip $start -First $shardSize
          Write-Output "Shard ${{ matrix.shard }}/$totalShards — building $($mySamples.Count) of $($allSamples.Count) samples (indices $start..$($start + $mySamples.Count - 1))"
          .\Build-Samples.ps1 -Samples $mySamples -Verbose -ThrottleLimit 1
        env:
          WDS_Configuration: Debug
          WDS_Platform: x64
          WDS_WipeOutputs: ${{ true }}

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}/shard-${{ matrix.shard }}"