Upgrade github/codeql-action from 3 to 4 version (#1759)

Additionally:
- fix missing NSIS for Windows on CI
- replace macOS 13 with 26 on CI

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Kai Ren <tyranron@gmail.com>

.github/workflows/cifuzz.yml

@@ -1,42 +1,53 @@
 name: CIFuzz
+
 on:
-  [pull_request]
+  pull_request:
+    branches: ["master"]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions: {}
+
 jobs:
-  Fuzzing:
+  fuzz:
     runs-on: ubuntu-latest
     permissions:
       security-events: write
     strategy:
       fail-fast: false
       matrix: 
-        sanitizer: [address, memory, undefined]
+        sanitizer: ["address", "memory", "undefined"]
     steps:
-    - name: checkout repository
-      uses: actions/checkout@v5
-    - name: build fuzzers (${{ matrix.sanitizer }})
-      id: build
-      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
-      with:
-        oss-fuzz-project-name: 'coturn'
-        language: c
-        sanitizer: ${{ matrix.sanitizer }}
-    - name: run fuzzers (${{ matrix.sanitizer }})
-      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
-      with:
-        oss-fuzz-project-name: 'coturn'
-        language: c
-        sanitizer: ${{ matrix.sanitizer }}
-        fuzz-seconds: 600
-        output-sarif: true
-    - name: upload crash
-      uses: actions/upload-artifact@v4
-      if: failure() && steps.build.outcome == 'success'
-      with:
-        name: ${{ matrix.sanitizer }}_artifacts
-        path: ./out/artifacts
-    - name: upload sarif
-      if: always() && steps.build.outcome == 'success'
-      uses: github/codeql-action/upload-sarif@v3
-      with:
-        sarif_file: cifuzz-sarif/results.sarif
+      - uses: actions/checkout@v5
+
+      - name: build fuzzers (${{ matrix.sanitizer }})
+        id: build
+        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+        with:
+          oss-fuzz-project-name: coturn
+          language: c
+          sanitizer: ${{ matrix.sanitizer }}
+
+      - name: run fuzzers (${{ matrix.sanitizer }})
+        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+        with:
+          oss-fuzz-project-name: coturn
+          language: c
+          sanitizer: ${{ matrix.sanitizer }}
+          fuzz-seconds: 600
+          output-sarif: true
+
+      - name: upload crash
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.sanitizer }}_artifacts
+          path: ./out/artifacts
+        if: ${{ failure() && steps.build.outcome == 'success' }}
+
+      - name: upload sarif
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: cifuzz-sarif/results.sarif
+        if: ${{ always() && steps.build.outcome == 'success' }}

.github/workflows/codeql.yml

@@ -30,7 +30,7 @@ jobs:
           SUDO: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: cpp
 
@@ -40,4 +40,4 @@ jobs:
         run: cmake --build ${{github.workspace}}/build --config ${{env.BUILD_TYPE}}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4

.github/workflows/macos.yml

@@ -17,7 +17,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ver: ["13", "14", "15"]
+        ver: ["14", "15", "26"]
     runs-on: macos-${{ matrix.ver }}
     steps:
       - uses: actions/checkout@v5
@@ -35,7 +35,7 @@ jobs:
              | while read formula; do brew unlink $formula; brew link --overwrite $formula; done
 
       - run: brew update
-      - run: brew install wget pkg-config libevent openssl@1.1 sqlite hiredis mongo-c-driver libmicrohttpd
+      - run: brew install wget pkg-config libevent openssl sqlite hiredis mongo-c-driver libmicrohttpd
 
       - run: ./configure
         env:
@@ -54,7 +54,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ver: ["15"]
+        ver: ["15", "26"]
     runs-on: macos-${{ matrix.ver }}
     steps:
       - uses: actions/checkout@v5
@@ -72,7 +72,7 @@ jobs:
               | while read formula; do brew unlink $formula; brew link --overwrite $formula; done
 
       - run: brew update
-      - run: brew install wget pkg-config libevent openssl@1.1 sqlite hiredis mongo-c-driver libmicrohttpd
+      - run: brew install wget pkg-config libevent openssl sqlite hiredis mongo-c-driver libmicrohttpd
 
       - name: Configure
         run: cmake -B ${{github.workspace}}/build

.github/workflows/mingw.yml

@@ -106,6 +106,9 @@ jobs:
           copy /Y ${{ env.RUNVCPKG_VCPKG_ROOT }}\installed\${{ env.RUNVCPKG_VCPKG_TRIPLET_OUT }}\bin\*.dll install\bin
           7z a coturn_windows_mingw.zip ${{ github.workspace }}\build\install\*
           cmake --build . --config ${{ matrix.BUILD_TYPE }} --target package
+        env:
+          MSYSTEM: MINGW64
+          PATH: C:\msys64\mingw64\bin;C:\msys64\usr\bin
         working-directory: ${{ github.workspace }}\build
         if: ${{ matrix.BUILD_TYPE == 'Release' }}
 

.github/workflows/msvc.yml

@@ -76,7 +76,7 @@ jobs:
 
       # Upload SARIF file to GitHub Code Scanning Alerts
       - name: Upload SARIF to GitHub
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: ${{ steps.run-analysis.outputs.sarif }}
 
@@ -114,6 +114,12 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
+      - name: Install NSIS for packaging
+        uses: repolevedavaj/install-nsis@v1.1.0
+        with:
+          nsis-version: "3.11"
+        if: ${{ matrix.BUILD_TYPE == 'Release' }}
+
       - name: Create directories
         run: |
           cmake -E make_directory ${{ env.SOURCE_DIR }}