ci: simplify codeql

.github/workflows/codeql.yml

@@ -1,14 +1,3 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
 name: "CodeQL"
 
 on:
@@ -54,77 +43,59 @@ jobs:
         # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
         # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
-    env:
-      VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
 
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
       with:
           submodules: recursive
-
-    - name: Setup vcpkg
-      run: |
-        git clone https://github.com/microsoft/vcpkg.git
-        cd vcpkg
-        ./bootstrap-vcpkg.sh
-        ./vcpkg integrate install
-        # add vcpkg to PATH
-        echo "${{ github.workspace }}/vcpkg" >> $GITHUB_PATH
 
-    - name: Setup Ninja
-      uses: imesense/[email protected]
-      with:
-        version: '1.12.1'
-
-    - name: Export GitHub Actions cache environment variables
-      uses: actions/github-script@v7
+    - name: Setup Rust toolchain
+      uses: moonrepo/setup-rust@v1
       with:
-        script: |
-          core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
-          core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
+        channel: stable
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
 
-    - name: Cache
-      uses: actions/cache@v4
-      with:
-        path: |
-          ${{ github.workspace }}/build/_deps
-          ${{ github.workspace }}/build/cargo
-          ${{ github.workspace }}/build/vcpkg_installed
-          ${{ github.workspace }}/build/corrosion
-          ${{ github.workspace }}/build/lib
-          ${{ github.workspace }}/build/3rdpart
-        key: ${{ runner.os }}-${{ hashFiles('**/lockfiles') }}
+    - name: Setup CMake
+      uses: lukka/get-cmake@latest
+
+    - name: Setup vcpkg
+      uses: lukka/run-vcpkg@v11
 
-    # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-
-        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
 
-    # If the analyze step fails for one of the languages you are analyzing with
-    # "We were unable to automatically build your code", modify the matrix above
-    # to set the build mode to "manual" for that language. Then modify this step
-    # to build your code.
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
     - if: matrix.build-mode == 'manual'
-      shell: bash
-      run: |
-        cmake -DCMAKE_TOOLCHAIN_FILE=${{ github.workspace }}/vcpkg/scripts/buildsystems/vcpkg.cmake -B build -G Ninja
-        cmake --build build
+      name: Build with CMake
+      uses: lukka/run-cmake@v10
+      with:
+        configurePreset: 'native'
+        buildPreset: 'native'
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v3
       with:
         category: "/language:${{matrix.language}}"
+        output: sarif-results
+        upload: failure-only
+
+    - name: Filter CodeQL Analysis Results
+      uses: advanced-security/filter-sarif@v1
+      with:
+        patterns: |
+          -**/*
+          +src/**/*
+        input: sarif-results/${{ matrix.language }}.sarif
+        output: sarif-results/${{ matrix.language }}.sarif
+
+    - name: Upload CodeQL Analysis Results
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: sarif-results/${{ matrix.language }}.sarif
 
     - name: Send message to feishu
       if: ${{ failure() }}