ROCm · tomk-amd · Dec 17, 2025 · Dec 17, 2025 · Dec 17, 2025 · Dec 17, 2025
@@ -0,0 +1,10 @@
+# CodeQL configuration
+# Exclude third-party and build outputs to reduce noise and improve performance
+paths-ignore:
+  - thirdparty/**
+  - build/**
+  - Installer/**
+  - docs/**
+
+queries:
+  - uses: security-and-quality
@@ -0,0 +1,63 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ main, dev ]
+  pull_request:
+    # Run on PRs targeting protected branches
+    branches: [ main, dev ]
+  schedule:
+    - cron: '0 2 * * 0' # Weekly
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze (CodeQL)
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      security-events: write
+      contents: read
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5
+      with:
+        fetch-depth: 0
+        submodules: true
+
+    - name: Install Dependencies
+      run: |
+        sudo apt update
+        sudo apt install -y \
+        cmake build-essential \
+        libwayland-bin \
+        libwayland-dev libxkbcommon-dev wayland-protocols \
+        pkg-config \
+        libdbus-1-dev
+        echo "✅ Dependencies Installed!"
+
+    - name: Install Vulkan SDK
+      run: |
+        wget -qO- https://packages.lunarg.com/lunarg-signing-key-pub.asc | sudo tee /etc/apt/trusted.gpg.d/lunarg.asc
-        libdbus-1-dev
-        echo "✅ Dependencies Installed!"
-
-    - name: Install Vulkan SDK
-      run: |
-        wget -qO- https://packages.lunarg.com/lunarg-signing-key-pub.asc | sudo tee /etc/apt/trusted.gpg.d/lunarg.asc
+        libdbus-1-dev \
+        gnupg
+        echo "✅ Dependencies Installed!"
+
+    - name: Install Vulkan SDK
+      run: |
+        set -euo pipefail
+
+        # Download Lunarg public signing key to a temporary file
+        LUNARG_KEY_TMP="$(mktemp)"
+        wget -qO "$LUNARG_KEY_TMP" https://packages.lunarg.com/lunarg-signing-key-pub.asc
+
+        # Expected Lunarg GPG key fingerprint (update this to the official Lunarg key fingerprint)
+        EXPECTED_LUNARG_FPR="REPLACE_WITH_OFFICIAL_LUNARG_KEY_FINGERPRINT"
+
+        # Extract actual fingerprint from downloaded key
+        ACTUAL_LUNARG_FPR="$(gpg --show-keys --with-colons "$LUNARG_KEY_TMP" | awk -F: '/^fpr:/ {print $10; exit}')"
+
+        if [ -z "$ACTUAL_LUNARG_FPR" ]; then
+          echo "Failed to extract Lunarg GPG key fingerprint." >&2
+          rm -f "$LUNARG_KEY_TMP"
+          exit 1
+        fi
+
+        if [ "$ACTUAL_LUNARG_FPR" != "$EXPECTED_LUNARG_FPR" ]; then
+          echo "Lunarg GPG key fingerprint mismatch!" >&2
+          echo "Expected: $EXPECTED_LUNARG_FPR" >&2
+          echo "Actual:   $ACTUAL_LUNARG_FPR" >&2
+          rm -f "$LUNARG_KEY_TMP"
+          exit 1
+        fi
+
+        # Install verified key into APT trusted keyring
+        sudo gpg --dearmor < "$LUNARG_KEY_TMP" | sudo tee /etc/apt/trusted.gpg.d/lunarg.gpg >/dev/null
+        rm -f "$LUNARG_KEY_TMP"
+
+        # Configure Lunarg Vulkan APT repository
-        libdbus-1-dev
-        echo "✅ Dependencies Installed!"
-
-    - name: Install Vulkan SDK
-      run: |
-        wget -qO- https://packages.lunarg.com/lunarg-signing-key-pub.asc | sudo tee /etc/apt/trusted.gpg.d/lunarg.asc
+        libdbus-1-dev \
+        gnupg
+        echo "✅ Dependencies Installed!"
+
+    - name: Install Vulkan SDK
+      run: |
+        set -euo pipefail
+
+        # Download Lunarg public signing key to a temporary file
+        LUNARG_KEY_TMP="$(mktemp)"
+        wget -qO "$LUNARG_KEY_TMP" https://packages.lunarg.com/lunarg-signing-key-pub.asc
+
+        # Expected Lunarg GPG key fingerprint (update this to the official Lunarg key fingerprint)
+        EXPECTED_LUNARG_FPR="REPLACE_WITH_OFFICIAL_LUNARG_KEY_FINGERPRINT"
+
+        # Extract actual fingerprint from downloaded key
+        ACTUAL_LUNARG_FPR="$(gpg --show-keys --with-colons "$LUNARG_KEY_TMP" | awk -F: '/^fpr:/ {print $10; exit}')"
+
+        if [ -z "$ACTUAL_LUNARG_FPR" ]; then
+          echo "Failed to extract Lunarg GPG key fingerprint." >&2
+          rm -f "$LUNARG_KEY_TMP"
+          exit 1
+        fi
+
+        if [ "$ACTUAL_LUNARG_FPR" != "$EXPECTED_LUNARG_FPR" ]; then
+          echo "Lunarg GPG key fingerprint mismatch!" >&2
+          echo "Expected: $EXPECTED_LUNARG_FPR" >&2
+          echo "Actual:   $ACTUAL_LUNARG_FPR" >&2
+          rm -f "$LUNARG_KEY_TMP"
+          exit 1
+        fi
+
+        # Install verified key into APT trusted keyring
+        sudo gpg --dearmor < "$LUNARG_KEY_TMP" | sudo tee /etc/apt/trusted.gpg.d/lunarg.gpg >/dev/null
+        rm -f "$LUNARG_KEY_TMP"
+
+        # Configure Lunarg Vulkan APT repository
+        sudo wget -qO /etc/apt/sources.list.d/lunarg-vulkan-noble.list http://packages.lunarg.com/vulkan/lunarg-vulkan-noble.list
+        sudo apt update
+        sudo apt install -y vulkan-sdk xorg-dev libx11-dev libxrandr-dev libxinerama-dev libxcursor-dev libxi-dev
+        echo "✅ Vulkan SDK Installed!"
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: cpp
+        config-file: .github/codeql/codeql-config.yml
+
+    - name: Build with CMake
+      run: |
+        mkdir -p build/codeql
+        cmake -B build/codeql --preset "linux-release"
+        cmake --build build/codeql --preset "Linux Release Build" --parallel $(nproc)
+
+    - name: Run CodeQL analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "security-and-quality"