From f82598d10e523e3b19d2f937467e2a9b6a4d4e50 Mon Sep 17 00:00:00 2001
From: PatTheMav <PatTheMav@users.noreply.github.com>
Date: Fri, 2 Aug 2024 17:21:53 +0200
Subject: [PATCH] CI: Add clang-analyze analytics for macOS builds

---
 .github/scripts/.build.zsh             | 36 +++++++++----
 .github/workflows/analyze-project.yaml | 74 ++++++++++++++++++++++++++
 2 files changed, 101 insertions(+), 9 deletions(-)

diff --git a/.github/scripts/.build.zsh b/.github/scripts/.build.zsh
index 1f9d69033..4746caa19 100755
--- a/.github/scripts/.build.zsh
+++ b/.github/scripts/.build.zsh
@@ -63,6 +63,7 @@ build() {
   local config='RelWithDebInfo'
   local -r -a _valid_configs=(Debug RelWithDebInfo Release MinSizeRel)
   local -i codesign=0
+  local -i analyze=0
 
   local -a args
   while (( # )) {
@@ -76,6 +77,7 @@ build() {
     }
     case ${1} {
       --) shift; args+=($@); break ;;
+      -a|--analyze) analyze=1; shift ;;
       -t|--target)
         if (( ! ${_valid_targets[(Ie)${2}]} )) {
           log_error "Invalid value %B${2}%b for option %B${1}%b"
@@ -176,16 +178,32 @@ build() {
         -exportPath ${project_root}/build_macos
       )
 
-      pushd build_macos
-      if [[ ${GITHUB_EVENT_NAME} == push && ${GITHUB_REF_NAME} =~ [0-9]+.[0-9]+.[0-9]+(-(rc|beta).+)? ]] {
-        run_xcodebuild ${archive_args}
-        run_xcodebuild ${export_args}
-      } else {
-        run_xcodebuild ${build_args}
+      local -a analyze_args=(
+        CLANG_ANALYZER_OUTPUT=sarif
+        CLANG_ANALYZER_OUTPUT_DIR=${project_root}/analytics
+        -project obs-studio.xcodeproj
+        -target obs-studio
+        -destination "generic/platform=macOS,name=Any Mac"
+        -configuration ${config}
+        -parallelizeTargets
+        -hideShellScriptEnvironment
+        analyze
+      )
 
-        rm -rf OBS.app
-        mkdir OBS.app
-        ditto UI/${config}/OBS.app OBS.app
+      pushd build_macos
+      if (( analyze )) {
+        run_xcodebuild ${analyze_args}
+      } else {
+        if [[ ${GITHUB_EVENT_NAME} == push && ${GITHUB_REF_NAME} =~ [0-9]+.[0-9]+.[0-9]+(-(rc|beta).+)? ]] {
+          run_xcodebuild ${archive_args}
+          run_xcodebuild ${export_args}
+        } else {
+          run_xcodebuild ${build_args}
+
+          rm -rf OBS.app
+          mkdir OBS.app
+          ditto UI/${config}/OBS.app OBS.app
+        }
       }
       popd
       ;;
diff --git a/.github/workflows/analyze-project.yaml b/.github/workflows/analyze-project.yaml
index 3bc5d3a8b..45b08ee60 100644
--- a/.github/workflows/analyze-project.yaml
+++ b/.github/workflows/analyze-project.yaml
@@ -38,3 +38,77 @@ jobs:
           pvsKey: ${{ secrets.PVS_KEY }}
           target: x64
           config: Debug
+
+  macos:
+    name: macOS 🍏 (clang-analyze)
+    runs-on: macos-14
+    defaults:
+      run:
+        shell: zsh --no-rcs --errexit --pipefail {0}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Set Up Code Signing 🔑
+        uses: ./.github/actions/setup-macos-codesigning
+        id: codesign
+        with:
+          codesignIdentity: ${{ secrets.MACOS_SIGNING_IDENTITY }}
+          codesignCertificate: ${{ secrets.MACOS_SIGNING_CERT }}
+          certificatePassword: ${{ secrets.MACOS_SIGNING_CERT_PASSWORD }}
+          keychainPassword: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
+          provisioningProfile: ${{ secrets.MACOS_SIGNING_PROVISIONING_PROFILE }}
+          notarizationUser: ${{ secrets.MACOS_NOTARIZATION_USERNAME }}
+          notarizationPassword: ${{ secrets.MACOS_NOTARIZATION_PASSWORD }}
+
+      - name: Build OBS Studio 🧱
+        env:
+          TWITCH_CLIENTID: ${{ secrets.TWITCH_CLIENT_ID }}
+          TWITCH_HASH: ${{ secrets.TWITCH_HASH }}
+          RESTREAM_CLIENTID: ${{ secrets.RESTREAM_CLIENTID }}
+          RESTREAM_HASH: ${{ secrets.RESTREAM_HASH }}
+          YOUTUBE_CLIENTID: ${{ secrets.YOUTUBE_CLIENTID }}
+          YOUTUBE_CLIENTID_HASH: ${{ secrets.YOUTUBE_CLIENTID_HASH }}
+          YOUTUBE_SECRET: ${{ secrets.YOUTUBE_SECRET }}
+          YOUTUBE_SECRET_HASH: ${{ secrets.YOUTUBE_SECRET_HASH }}
+          CODESIGN_IDENT: ${{ steps.codesign.outputs.codesignIdent }}
+          CODESIGN_TEAM: ${{ steps.codesign.outputs.codesignTeam }}
+          PROVISIONING_PROFILE: ${{ steps.codesign.outputs.provisioningProfileUUID }}
+        run: |
+          : Run macOS Build
+
+          local -a build_args=(
+            --config Debug
+            --target macos-arm64
+            --codesign
+            --analyze
+          )
+          if (( ${+RUNNER_DEBUG} )) build_args+=(--debug)
+
+          git fetch origin --no-tags --no-recurse-submodules -q
+          .github/scripts/build-macos ${build_args}
+      - name: Compile Analytics Data 📊
+        run: |
+          : Compile Analytics Data 📊
+
+          local analytics_root='${{ github.workspace }}/analytics'
+
+          local -a analytics_files=(${analytics_root}/StaticAnalyzer/obs-studio/**/*.plist)
+
+          for file (${analytics_files}) {
+            mv ${file} ${analytics_root}/${${file:t}//plist/sarif}
+          }
+
+          pushd ${analytics_root}
+
+          npx @microsoft/sarif-multitool merge *.sarif
+
+          popd
+
+      - name: Upload SARIF report files 📦
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: "${{ github.workspace }}/analytics/merged.sarif"
+          category: 'clang-analyze (macOS Apple Silicon)'