ci: fix sast from forked repos (#142)

.github/workflows/build.yml

@@ -0,0 +1,110 @@
+# .github/workflows/build.yml
+# UNTRUSTED CONTEXT. This workflow runs fork-authored code.
+# It must never reference `secrets.*` (other than the default GITHUB_TOKEN,
+# which is read-only here). Do not add SONAR_TOKEN to this file.
+
+name: Build
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    types: [ opened, reopened, synchronize ]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build under Build Wrapper
+    runs-on: ubuntu-24.04
+    env:
+      BUILD_WRAPPER_OUT_DIR: bw-output
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set up Python 3.14
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.14'
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y \
+            build-essential \
+            libgl1-mesa-dev libglew-dev libglfw3-dev \
+            libpng-dev libopenal-dev libluajit-5.1-dev \
+            libserialport-dev libsndfile1-dev \
+            xorg-dev libxkbcommon-dev libwayland-dev wayland-protocols
+
+      - name: Build current OpenAL Soft
+        run: |
+          git clone --depth 1 --branch 1.24.2 https://github.com/kcat/openal-soft.git /tmp/openal-soft
+          cmake -S /tmp/openal-soft -B /tmp/openal-soft/build \
+            -DCMAKE_BUILD_TYPE=Release -DALSOFT_EXAMPLES=OFF -DALSOFT_UTILS=OFF
+          cmake --build /tmp/openal-soft/build -j"$(nproc)"
+          sudo cmake --install /tmp/openal-soft/build
+          sudo ldconfig
+
+      # A little bit of magic for unbreaking GCC. Not an issue for Clang and MSVC.
+      # Fix for specific hard-errors for a combo of: varargs and always_inline
+      - name: Patch GLM for GCC
+        run: |
+          sed -i 's/GLM_FUNC_QUALIFIER std::string format(const char\* message, \.\.\.)/inline std::string format(const char* message, ...)/' \
+            ref/glm/glm/gtx/string_cast.inl
+          grep -n "std::string format(const char\* message" ref/glm/glm/gtx/string_cast.inl
+
+      - name: Install SonarQube Cloud Build Wrapper
+        uses: SonarSource/sonarqube-scan-action/install-build-wrapper@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0
+
+      - name: Configure (CMake)
+        run: |
+          cmake -S . -B build \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DWITH_BETTER_RENDERER=OFF \
+            -DWITH_ZMQ=OFF -DWITH_OPENVR=OFF -DUSE_LTO=OFF \
+            -DCMAKE_CXX_FLAGS="-Wno-attributes -fno-inline-functions-called-once" \
+            -DPython3_EXECUTABLE="$(which python3)"
+
+      - name: Build under Build Wrapper
+        run: |
+          build-wrapper-linux-x86-64 \
+            --out-dir "${BUILD_WRAPPER_OUT_DIR}" \
+            cmake --build build --config Release -j"$(nproc)"
+
+      # Metadata the trusted workflow needs to identify the PR.
+      # Treated as UNVERIFIED input there and re-checked against the API.
+      - name: Record event metadata
+        run: |
+          mkdir -p .sonar-meta
+          echo "${{ github.event_name }}"                     > .sonar-meta/event
+          echo "${{ github.event.pull_request.number }}"       > .sonar-meta/pr_number
+          echo "${{ github.event.pull_request.head.sha }}"     > .sonar-meta/head_sha
+          echo "${{ github.event.pull_request.base.ref }}"     > .sonar-meta/base_ref
+          echo "${{ github.event.pull_request.head.ref }}"     > .sonar-meta/head_ref
+          echo "${{ github.sha }}"                             > .sonar-meta/sha
+
+      # The C/C++ analyzer needs the sources AND the build-wrapper output.
+      # compile_commands.json holds absolute paths, so the trusted workflow must
+      # unpack this at the same $GITHUB_WORKSPACE path — same repo, so it matches.
+      - name: Pack analysis input
+        run: |
+          tar -czf /tmp/workspace.tar.gz \
+            --exclude='./build/CMakeFiles' \
+            --exclude='*.o' \
+            --exclude='*.a' \
+            --exclude='*.so' \
+            -C "$GITHUB_WORKSPACE" .
+
+      - name: Upload analysis input
+        uses: actions/upload-artifact@v4
+        with:
+          name: sonar-input
+          path: /tmp/workspace.tar.gz
+          retention-days: 1
+          if-no-files-found: error