Update CodeQL scan (#2049)

Author: Lord-Grey

.github/config/codeql.yml

@@ -1,5 +1,18 @@
 name: "CodeQL config"
+
+# 1. Used by Python & JavaScript (and uncompiled headers in C++)
 paths-ignore:
-  - 'dependencies/external/'
-  - 'assets/webconfig/js/lib'
-  - 'build/**'
+  - 'dependencies/**'
+  - '**/dependencies/**'
+  - 'assets/webconfig/js/lib/**'
+
+# 2. Used during Query Evaluation for C++ (and Python/JS)
+query-filters:
+  - exclude:
+      path: 'dependencies/**'
+  - exclude:
+      path: '**/dependencies/**'
+  - exclude:
+      path: 'build/**'
+  - exclude:
+      path: '**/build/**'

.github/workflows/codeql.yml

@@ -14,7 +14,7 @@ on:
 
 jobs:
   analyze:
-    name: 📊 Analyze
+    name: 📊 Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     permissions:
       actions: read
@@ -24,32 +24,44 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ python, javascript, cpp ]
+        include:
+          - language: python
+            build-mode: none
+            container: ~
+          - language: javascript
+            build-mode: none
+            container: ~
+          - language: cpp
+            build-mode: manual
+            container:
+              image: ghcr.io/hyperion-project/debian:bookworm-qt6
+              options: -v /__t/CodeQL:/__t/CodeQL -v /opt/hostedtoolcache/CodeQL:/opt/hostedtoolcache/CodeQL
 
-    container:
-      image: ghcr.io/hyperion-project/debian:bookworm-qt6
+    container: ${{ matrix.container }}
 
     steps:
       - name: ⬇ Checkout
         uses: actions/checkout@v7
         with:
           submodules: recursive
 
+      - name: ⚙️ Mark Workspace Safe for Git
+        if: ${{ matrix.language == 'cpp' }}
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - name: 🔁 Initialize CodeQL
         uses: github/codeql-action/init@v4.37.9
         with:
           languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
           queries: +security-and-quality
           config-file: ./.github/config/codeql.yml
 
-      - name: 👷 Build (Python & JavaScript)
-        if: ${{ matrix.language != 'cpp' }}
-        uses: github/codeql-action/autobuild@v4.37.9
-
-      - name: 📥 Install jq (C++)
+      - name: 📥 Install jq & Pre-Build Deps (C++)
         if: ${{ matrix.language == 'cpp' }}
         shell: bash
-        run: apt-get update && apt-get install -y jq
+        run: |
+          apt-get update && apt-get install -y jq
 
       - name: 💾 Download Pre-Build Dependencies (C++)
         if: ${{ matrix.language == 'cpp' }}
@@ -58,16 +70,29 @@ jobs:
         with:
           os: 'debian_bookworm'
           architecture: 'amd64'
-          qt_version: '6'
           build_type: ${{ github.event_name == 'pull_request' && 'debug' || 'release' }}
 
+      - name: ⚡ Setup ccache
+        if: ${{ matrix.language == 'cpp' }}
+        uses: hendrikmuhs/ccache-action@v1.2.24
+        with:
+          key: ${{ runner.os }}-codeql-ccache-${{ github.ref }}
+          restore-keys: |
+            ${{ runner.os }}-codeql-ccache-master
+            ${{ runner.os }}-codeql-ccache-
+
       - name: 👷 Build (C++)
         if: ${{ matrix.language == 'cpp' }}
         run: |
-          cmake --preset linux-${{ env.BUILD_TYPE }} ${{ steps.dependencies.outputs.cmakeArgs }}
+          # Ensure ccache uses the workspace directory shared with the host
+          export CCACHE_DIR="$GITHUB_WORKSPACE/.ccache"
+          mkdir -p "$CCACHE_DIR"
+          
+          cmake --preset linux-${{ env.BUILD_TYPE }} ${{ steps.dependencies.outputs.cmakeArgs }} -DCMAKE_CXX_COMPILER_LAUNCHER=ccache -DCMAKE_C_COMPILER_LAUNCHER=ccache
           cmake --build --preset linux-${{ env.BUILD_TYPE }}
         env:
           BUILD_TYPE: ${{ github.event_name == 'pull_request' && 'debug' || 'release' }}
+          CCACHE_DIR: ${{ github.workspace }}/.ccache
 
       - name: 🏃 Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4.37.9
@@ -80,8 +105,16 @@ jobs:
         uses: advanced-security/filter-sarif@v1
         with:
           patterns: |
-            -**/dependencies/**
-            -**/moc_*.cpp
+            -dependencies/**
+            -/**/dependencies/**
+            -moc_*.cpp
+            -/**/moc_*.cpp
+            -build/**
+            -/**/build/**
+            -*.pb.cc
+            -/**/*.pb.cc
+            -*.pb.h
+            -/**/*.pb.h
           input: sarif-results/${{ matrix.language }}.sarif
           output: sarif-results/${{ matrix.language }}.sarif
 
@@ -95,4 +128,4 @@ jobs:
         with:
           name: ${{ matrix.language }}.sarif
           path: sarif-results
-          retention-days: 1
+          retention-days: 1

CHANGELOG.md

@@ -49,6 +49,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - macOS bundle - Code signing identity is configurable via `MACOS_CODESIGN_IDENTITY` ('-' = ad-hoc). A stable identity keeps the macOS privacy permissions (e.g. Screen Recording) across rebuilds.
 - Housekeeping - GitHub builds
 - Script to validate translations files for common malformed placeholder/template tokens that may break the i18n parser
+- Update CodeQL runs to exclude external code, plus addressed CodeQL findings
 
 ## [2.2.1](https://github.com/hyperion-project/hyperion.ng/releases/tag/2.2.1) - 2026-04-06
 

assets/firmware/arduino/network_bridge/udpraw_serialadalight.py

@@ -16,13 +16,13 @@
 #
 # SPDX-License-Identifier:    BSD-3-Clause
 
+from __future__ import division
+
 import sys
 import socket
 import serial
 import serial.threaded
 
-from __future__ import division
-
 class SerialToNet(serial.threaded.Protocol):
     """serial->socket"""
 
@@ -119,6 +119,11 @@ def data_received(self, data):
         help='local UDP port',
         default=2801)
 
+    group.add_argument(
+        '-I', '--listen',
+        default='0.0.0.0',
+        help='local IP address to listen on, default: %(default)s')
+
     args = parser.parse_args()
 
     # connect to serial port
@@ -137,7 +142,7 @@ def data_received(self, data):
     if not args.quiet:
         sys.stderr.write(
             '--- UDP to Serial redirector\n'
-            '--- listening on udp port {a.localport}\n'
+            '--- listening on udp {a.listen}:{a.localport}\n'
             '--- sending to {p.name}  {p.baudrate},{p.bytesize}{p.parity}{p.stopbits}\n'
             '--- type Ctrl-C / BREAK to quit\n'.format(p=ser, a=args))
 
@@ -153,7 +158,7 @@ def data_received(self, data):
 
     srv = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
     srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-    srv.bind(('0.0.0.0', args.localport))
+    srv.bind((args.listen, args.localport))
 
     try:
         while True:

assets/webconfig/js/ui_utils.js

@@ -1552,13 +1552,13 @@ function isValidIPv6(value) {
 
 function isValidHostname(value) {
   return !!(value.match(
-    '^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9])(.([a-zA-Z0-9]|[_a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]))*$'
+    /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.\w([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/
   ));
 }
 
 function isValidServicename(value) {
   return !!(value.match(
-    '^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9 -]{0,61}[a-zA-Z0-9])(.([a-zA-Z0-9]|[_a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]))*$'
+    /^[a-zA-Z0-9]([a-zA-Z0-9 -]{0,61}[a-zA-Z0-9])?(\.\w([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/
   ));
 }
 

assets/webconfig/tools/scan_i18n.py

@@ -22,7 +22,6 @@
 
 from __future__ import annotations
 import re
-import os
 import json
 from pathlib import Path
 from typing import List, Dict, Any

effects/mood-blobs.py

@@ -34,7 +34,7 @@
 # Calculate the color data
 baseHsv = colorsys.rgb_to_hsv(color[0]/255.0, color[1]/255.0, color[2]/255.0)
 if colorRandom:
-    baseHsv = (random(), baseHsv[1], baseHsv[2])
+    baseHsv = (random(), baseHsv[1], baseHsv[2]) # NOSONAR
 
 colorData = bytearray()
 for i in range(hyperion.ledCount):

effects/pacman.py

@@ -86,15 +86,15 @@ def shift_led(led_data, increment, limit, light_pos=None):
 	ledData = ledDataEscape
 	shift_led(ledData, increment, hyperion.ledCount)
 
-	random = randint(10,hyperion.ledCount)
+	random_pos = randint(10, hyperion.ledCount) # NOSONAR
 
 	# escape mode + power pellet
-	s = slice(3*random, 3*random+3)
-	shift_led(ledData, increment, hyperion.ledCount - random, s)
+	s = slice(3 * random_pos, 3 * random_pos + 3)
+	shift_led(ledData, increment, hyperion.ledCount - random_pos, s)
 
 	# chase mode
-	shift   = 3*(hyperion.ledCount - random)
-	ledData = ledDataChase[shift:]+ledDataChase[:shift]
-	shift_led(ledData, -increment, 2*hyperion.ledCount-random)
+	shift   = 3 * (hyperion.ledCount - random_pos)
+	ledData = ledDataChase[shift:] + ledDataChase[:shift]
+	shift_led(ledData, -increment, 2 * hyperion.ledCount - random_pos)
 	time.sleep(sleepTime)
 

effects/random.py

@@ -1,4 +1,8 @@
-import hyperion, time, colorsys, random, math
+import hyperion, time, colorsys, math, importlib
+
+_stdlib_random = importlib.import_module('random')
+random = _stdlib_random.random
+randrange = _stdlib_random.randrange
 
 # get args
 sleepTime  = float(hyperion.args.get('speed', 1.0))/1000.0
@@ -23,8 +27,8 @@
 		ledDataBuf[i] = ledData[i]
 
 	for i in range(hyperion.ledCount):
-		if random.randrange(10) == 1:
-			rgb = colorsys.hsv_to_rgb(random.random(), saturation, random.random())
+		if randrange(10) == 1:
+			rgb = colorsys.hsv_to_rgb(random(), saturation, random())
 			ledData[i*3  ] = int(255*rgb[0])
 			ledData[i*3+1] = int(255*rgb[1])
 			ledData[i*3+2] = int(255*rgb[2])

effects/sparks.py

@@ -1,4 +1,5 @@
-import hyperion, time, colorsys, random
+import hyperion, time, colorsys
+from random import random
 
 # Get the parameters
 rotationTime = float(hyperion.args.get('rotation-time', 3.0))
@@ -23,10 +24,10 @@
 while not hyperion.abort():
 	ledData[:] = bytearray(3*hyperion.ledCount)
 	for i in range(hyperion.ledCount):
-		if random.random() < 0.005:
+		if random() < 0.005: # NOSONAR
 
 			if randomColor:
-				rgb = colorsys.hsv_to_rgb(random.random(), saturation, brightness)
+				rgb = colorsys.hsv_to_rgb(random(), saturation, brightness) # NOSONAR
 				for n in range(3):
 					color[n] = int(rgb[n]*255)