Merge pull request #5 from Progmasoft/ci/qualityHEADmain

Add CodeQL, Codecov, Codacy, Renovate and actionlint

8 files changed, 170 insertions, 6 deletions

diff --git a/.codacy.yml b/.codacy.yml
new file mode 100644
index 0000000..0fe70f5
--- /dev/null
+++ b/.codacy.yml
@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-2.0
+
+# The rules_cc patch is the one of the Tala repository.
+exclude_paths:
+  - "bazel-*/**"
+  - "Build/*.patch"
diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 0000000..cb10f53
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-2.0
+
+name: Tazelish owned sources
+paths-ignore:
+  - bazel-*
diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000..f92441e
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,37 @@
+// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+// SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-2.0
+
+// Renovate proposes the version updates of this repository: the Bazel modules
+// of MODULE.bazel, Bazel itself in .bazelversion, and the GitHub Actions.
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: ["config:recommended", "helpers:pinGitHubActionDigests"],
+
+  timezone: "Europe/Istanbul",
+  // Once a week, before the working day.
+  schedule: ["before 6am on monday"],
+
+  // A release is taken a week after it is published: one that turns out to
+  // be broken or malicious is usually withdrawn within days.
+  minimumReleaseAge: "7 days",
+
+  // A pull request is rebased when it conflicts, not whenever the default
+  // branch moves.
+  rebaseWhen: "conflicted",
+  prConcurrentLimit: 2,
+  prHourlyLimit: 2,
+  dependencyDashboard: true,
+
+  // Security fixes come from Dependabot security updates.
+  vulnerabilityAlerts: { enabled: false },
+
+  enabledManagers: ["github-actions", "bazel-module", "bazelisk"],
+
+  packageRules: [
+    { matchManagers: ["github-actions"], groupName: "GitHub Actions" },
+    { matchManagers: ["bazel-module", "bazelisk"], groupName: "Bazel" },
+    // rules_cc carries a patch for clang-cl; a new version needs the patch
+    // checked against it, so it is never merged on its own.
+    { matchPackageNames: ["rules_cc"], automerge: false, dependencyDashboardApproval: true },
+  ],
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7d357e0..4e96a45 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,6 +36,50 @@ jobs:
       - run: bazelisk test //...
       - run: bazelisk build //:tazelish
 
+  coverage-report:
+    name: Coverage report
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # Clang's own coverage, read by the LLVM tools of the runner's Clang.
+      - run: >-
+          bazelisk coverage //Tests:tests
+          --combined_report=lcov
+          --instrumentation_filter=^//:
+          --repo_env=BAZEL_USE_LLVM_NATIVE_COVERAGE=1
+          --repo_env=BAZEL_LLVM_PROFDATA=/usr/bin/llvm-profdata-18
+          --repo_env=BAZEL_LLVM_COV=/usr/bin/llvm-cov-18
+      - run: cp "$(bazelisk info output_path)/_coverage/_coverage_report.dat" lcov.info
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: tazelish-coverage
+          path: lcov.info
+          if-no-files-found: error
+          retention-days: 1
+
+  coverage:
+    # Fork PRs cannot receive the OIDC token required for Codecov uploads.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    needs: coverage-report
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      # Keep the OIDC-capable job apart from the build.
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: tazelish-coverage
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          use_oidc: true
+          files: lcov.info
+          fail_ci_if_error: true
+
   required:
     name: CI Required
     if: always()
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..616e96d
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,36 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-2.0
+
+name: CodeQL
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "29 5 * * 1"
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+jobs:
+  analyze:
+    name: ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, c-cpp]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config-file: ./.github/codeql/codeql-config.yml
+          queries: security-extended
+      - uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          category: /language:${{ matrix.language }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index b81dac0..7b9a0e7 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -36,3 +36,24 @@ jobs:
 
       - name: Audit the workflows
         uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: 1.26.10
+          cache: false
+      # actionlint checks the syntax, the expressions and the shell steps of
+      # every workflow; zizmor above checks what makes one unsafe.
+      - name: Lint the workflows
+        run: |
+          go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+          "$(go env GOPATH)/bin/actionlint" -color
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 0000000..0923200
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-2.0
+
+coverage:
+  precision: 2
+  round: nearest
+  status:
+    project:
+      default:
+        threshold: 2%
+    patch:
+      default:
+        target: 80%
+
+codecov:
+  branch: main
+
+comment:
+  layout: "diff"
diff --git a/renovate.json b/renovate.json
deleted file mode 100644
index 5db72dd..0000000
--- a/renovate.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended"
-  ]
-}