Repository navigation
131 lines (115 loc) · 4.28 KB
/
Copy pathcodeql.yml
File metadata and controls
131 lines (115 loc) · 4.28 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: 📊 CodeQL
run-name: |
${{ github.event_name == 'schedule' && '⏰ Scheduled CodeQL run' || '' }}
${{ github.event_name == 'push' && format('📊 Pushed CodeQL run - {0}', github.event.head_commit.message) || '' }}
${{ github.event_name == 'pull_request' && format('📊 CodeQL run for PR {0} - {1}', github.event.pull_request.number, github.event.pull_request.title) || '' }}
on:
push:
branches: [ "master" ]
pull_request:
branches: [ "master" ]
schedule:
- cron: "36 18 * * 4"
jobs:
analyze:
name: 📊 Analyze (${{ matrix.language }})
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
include:
- language: python
build-mode: none
container: ~
- language: javascript
build-mode: none
container: ~
- language: cpp
build-mode: manual
container:
image: ghcr.io/hyperion-project/debian:bookworm-qt6
options: -v /__t/CodeQL:/__t/CodeQL -v /opt/hostedtoolcache/CodeQL:/opt/hostedtoolcache/CodeQL
container: ${{ matrix.container }}
steps:
- name: ⬇ Checkout
uses: actions/checkout@v7
with:
submodules: recursive
- name: ⚙️ Mark Workspace Safe for Git
if: ${{ matrix.language == 'cpp' }}
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
- name: 🔁 Initialize CodeQL
uses: github/codeql-action/init@v4.38.2
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
queries: +security-and-quality
config-file: ./.github/config/codeql.yml
- name: 📥 Install jq & Pre-Build Deps (C++)
if: ${{ matrix.language == 'cpp' }}
shell: bash
run: |
apt-get update && apt-get install -y jq
- name: 💾 Download Pre-Build Dependencies (C++)
if: ${{ matrix.language == 'cpp' }}
id: dependencies
uses: ./.github/actions/download-pre-built-deps
with:
os: 'debian_bookworm'
architecture: 'amd64'
build_type: ${{ github.event_name == 'pull_request' && 'debug' || 'release' }}
- name: ⚡ Setup ccache
if: ${{ matrix.language == 'cpp' }}
uses: hendrikmuhs/ccache-action@v1.2.24
with:
key: ${{ runner.os }}-codeql-ccache-${{ github.ref }}
restore-keys: |
${{ runner.os }}-codeql-ccache-master
${{ runner.os }}-codeql-ccache-
- name: 👷 Build (C++)
if: ${{ matrix.language == 'cpp' }}
run: |
# Ensure ccache uses the workspace directory shared with the host
export CCACHE_DIR="$GITHUB_WORKSPACE/.ccache"
mkdir -p "$CCACHE_DIR"
cmake --preset linux-${{ env.BUILD_TYPE }} ${{ steps.dependencies.outputs.cmakeArgs }} -DCMAKE_CXX_COMPILER_LAUNCHER=ccache -DCMAKE_C_COMPILER_LAUNCHER=ccache
cmake --build --preset linux-${{ env.BUILD_TYPE }}
env:
BUILD_TYPE: ${{ github.event_name == 'pull_request' && 'debug' || 'release' }}
CCACHE_DIR: ${{ github.workspace }}/.ccache
- name: 🏃 Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4.38.2
with:
category: "/language:${{ matrix.language }}"
upload: False
output: sarif-results
- name: 🆔 Filter SARIF
uses: advanced-security/filter-sarif@v1
with:
patterns: |
-dependencies/**
-/**/dependencies/**
-moc_*.cpp
-/**/moc_*.cpp
-build/**
-/**/build/**
-*.pb.cc
-/**/*.pb.cc
-*.pb.h
-/**/*.pb.h
input: sarif-results/${{ matrix.language }}.sarif
output: sarif-results/${{ matrix.language }}.sarif
- name: 📦 Upload SARIF
uses: github/codeql-action/upload-sarif@v4.38.2
with:
sarif_file: sarif-results/${{ matrix.language }}.sarif
- name: 📦 Upload loc as a Build Artifact
uses: actions/upload-artifact@v7
with:
name: ${{ matrix.language }}.sarif
path: sarif-results
retention-days: 1