ci: simplify macos build, fix codeql workflow

.github/workflows/codeql-analysis.yml

@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: '0 8 * * 6'
 
+permissions:
+  security-events: write
+
 jobs:
   CodeQL-Build:
 

.github/workflows/macos_builds.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
     - uses: actions/checkout@v3
     - name: dependencies
-      run: brew install check cmake help2man mandoc [email protected] pkg-config automake
+      run: brew install check cmake help2man libfido2 mandoc pkg-config automake
     - name: build
       env:
         CC: ${{ matrix.cc }}

build-aux/ci/build-osx.sh

@@ -1,30 +1,13 @@
 #!/usr/bin/env bash
 set -ex
 
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-pushd "/tmp" &>/dev/null
-  # Build and install libcbor
-  git clone https://github.com/pjk/libcbor
-  pushd "/tmp/libcbor" &>/dev/null
-    git checkout v0.5.0
-    cmake -Bbuild -H.
-    cmake --build build -- --jobs=2 VERBOSE=1
-    sudo make -j $(sysctl -n hw.logicalcpu) -C build install
-  popd &>/dev/null
-
-  # Build and install libfido2
-  export PKG_CONFIG_PATH=/usr/local/opt/[email protected]/lib/pkgconfig
-  git clone https://github.com/Yubico/libfido2
-  pushd "/tmp/libfido2" &>/dev/null
-    cmake -Bbuild -H.
-    cmake --build build -- --jobs=2 VERBOSE=1
-    sudo make -j $(sysctl -n hw.logicalcpu) -C build install
-  popd &>/dev/null
-popd &>/dev/null
-
-pushd "$BUILDROOT" &>/dev/null
-  ./autogen.sh
-  ./configure --disable-silent-rules --disable-man
-  make -j $(sysctl -n hw.logicalcpu)
-popd &>/dev/null
+# Link to the same OpenSSL version as libfido2.
+OPENSSL="$(brew deps --installed libfido2 | grep openssl)"
+LIBFIDO2_PKGCONF="$(brew --prefix libfido2)/lib/pkgconfig"
+OPENSSL_PKGCONF="$(brew --prefix "${OPENSSL}")/lib/pkgconfig"
+export PKG_CONFIG_PATH="${LIBFIDO2_PKGCONF}:${OPENSSL_PKGCONF}"
+
+./autogen.sh
+./configure --disable-silent-rules --disable-man
+make -j $(sysctl -n hw.logicalcpu)
+make check