ci.yml

name: C++ Professional CI

# When should the workflow run?
on:
  push:
    branches: [ "main", "master" ]
  pull_request:
    branches: [ "main", "master" ]

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    
    env:
      CXX: clang++
      CC: clang
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

    steps:
    - name: Checkout Code
      uses: actions/checkout@v4

    - name: Install Dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y \
          clang \
          clang-tidy \
          clang-format \
          llvm \
          ninja-build \
          cppcheck \
          python3-pip \
          libgtest-dev
        
        pip3 install flawfinder

    - name: Install Snyk
      uses: snyk/actions/setup@master

    - name: Cache CMake dependencies
      uses: actions/cache@v3
      with:
        path: build/_deps
        key: ${{ runner.os }}-cmake-${{ hashFiles('**/CMakeLists.txt') }}
        restore-keys: |
          ${{ runner.os }}-cmake-

    - name: Configure CMake
      run: make reconfig

    - name: Clang-Tidy Check
      run: make lint

    - name: Cppcheck Analysis
      run: make analyze

    - name: Flawfinder Security Scan
      run: make security-code

    - name: Build and Test
      run: make test

    - name: Generate Coverage Report
      run: make coverage

    - name: Verify Code Formatting
      run: make check-format

    - name: Snyk Dependency Scan
      if: env.SNYK_TOKEN != ''
      run: make security-check