Skip to content

chore(ci) move CodeQL analysis to its own recurring workflow #4

chore(ci) move CodeQL analysis to its own recurring workflow

chore(ci) move CodeQL analysis to its own recurring workflow #4

Workflow file for this run

name: CodeQL
on:
pull_request:
branches: '**'
schedule:
- cron: '0 9 * * *' # 9am UTC, 2am PST
workflow_dispatch:
defaults:
run:
shell: bash
jobs:
codeql:
name: 'CodeQL analyzer'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
include:
- language: c-cpp
build-mode: manual
openresty: 1.25.3.1
runtime: v8 # v8bridge
steps:
- uses: actions/checkout@v4
- name: Setup CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
- name: 'Setup cache - work/ dir'
uses: actions/cache@v4
if: ${{ !env.ACT }}
with:
path: |
work/downloads
work/runtimes
work/openssl
key: codeql-work-${{ matrix.os }}-${{ matrix.cc }}-${{ matrix.ngx }}-${{ matrix.openresty }}-${{ matrix.runtime }}-${{ hashFiles('util/**/*.sh', 'util/**/*.pl', 'util/**/*.awk', '.github/**/*.yml', '.github/**/*.sh', '.github/**/*.js', 'rust-toolchain', 'Makefile') }}
- name: Setup Wasm runtime
run: ./util/runtime.sh -R ${{ matrix.runtime }} -V ${{ matrix[matrix.runtime] }}
- run: make setup
- run: make
env:
NGX_WASM_RUNTIME: ${{ matrix.runtime }}
NGX_BUILD_OPENRESTY: ${{ matrix.openresty }}
NGX_BUILD_DYNAMIC_MODULE: 1
NGX_BUILD_DEBUG: 1
NGX_BUILD_SSL: 1
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
upload: false
output: sarif-results
- id: sarif-filename
run: |
if [ "${{ matrix.language }}" = "c-cpp" ]; then
echo "name=cpp" >> $GITHUB_OUTPUT
else
echo "name=${{ matrix.language }}" >> $GITHUB_OUTPUT
fi
- name: Filter SARIF
uses: advanced-security/filter-sarif@v1
with:
patterns: |
-**/* # exclusion: DENY ALL
+src/**/* # inclusion
+lib/**/* # inclusion
input: sarif-results/${{ steps.sarif-filename.outputs.name }}.sarif
output: sarif-results/${{ steps.sarif-filename.outputs.name }}.sarif
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: sarif-results
- uses: actions/upload-artifact@v4
with:
name: sarif-results-${{ matrix.runtime }}
path: sarif-results
retention-days: ${{ github.retention_days }}