ci-clang-scan.yml

name: clang-scan

on:
  push:
    branches: [ '**' ]
  pull_request:
    branches: [ '**' ]

permissions:
  contents: read

jobs:
  build:

    runs-on: ci-clang-scan
    if: ${{ github.repository != 'intel/pcm' }}

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
      with:
        egress-policy: audit

    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
      with:
        submodules: recursive
    - name: Configure CMake
      run: |
        cmake --version
        rm -rf ${{ github.workspace }}/build
        scan-build cmake -B ${{ github.workspace }}/build
    - name: Scan build
      run: |
        cd ${{ github.workspace }}/build
        scan-build --exclude src/simdjson --status-bugs make -j