From a14fff4a6b4e4bdcd0302ddd0af4c24a689d308c Mon Sep 17 00:00:00 2001 From: dutor <440396+dutor@users.noreply.github.com> Date: Wed, 14 Aug 2024 16:21:55 +0800 Subject: [PATCH] Enabled CodeQL scanning --- .github/workflows/codeql-analysis.yml | 127 ++++++++++++++++++-------- .github/workflows/pull_request.yml | 2 +- 2 files changed, 88 insertions(+), 41 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index d85086f4479..301b85801c3 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -12,58 +12,105 @@ name: "CodeQL" on: + pull_request: + types: [synchronize, reopened, labeled] + branches: + - master + - 'release-**' schedule: - - cron: '20 21 * * 6' + - cron: '45 22 * * 5' + +concurrency: + group: ${{ github.head_ref }} + cancel-in-progress: true + +defaults: + run: + shell: bash jobs: analyze: - name: Analyze - runs-on: ubuntu-latest + name: CodeQL Scan (${{ matrix.language }}) + # Runner size impacts CodeQL analysis time. To learn more, please see: + # - https://gh.io/recommended-hardware-resources-for-running-codeql + # - https://gh.io/supported-runners-and-hardware-resources + # - https://gh.io/using-larger-runners (GitHub.com only) + # Consider using larger runners or machines with greater resources for possible analysis time improvements. + runs-on: [self-hosted, nebula] + timeout-minutes: 60 permissions: + # required for all workflows + security-events: write + + # required to fetch internal or private CodeQL packs + packages: read + + # only required for workflows in private repositories actions: read contents: read - security-events: write strategy: fail-fast: false matrix: - language: - - 'cpp' - - 'python' - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] - # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support - + os: + - ubuntu2004 + compiler: + - gcc-9.3 + include: + - language: c-cpp + build-mode: "manual" + env: + CCACHE_DIR: /tmp/ccache/nebula/${{ matrix.os }}-${{ matrix.compiler }} + CCACHE_MAXSIZE: 8G + container: + image: vesoft/nebula-dev:${{ matrix.os }} + volumes: + - /tmp/ccache/nebula/${{ matrix.os }}-${{ matrix.compiler }}:/tmp/ccache/nebula/${{ matrix.os }}-${{ matrix.compiler }} + options: --cap-add=SYS_PTRACE steps: - - name: Checkout repository - uses: actions/checkout@v3 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v2 - with: - languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - - # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality - - - # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@v2 - - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + - uses: webiny/action-post-run@3.0.0 + with: + run: sh -c "find . -mindepth 1 -delete" + - uses: actions/checkout@v3 + - name: Prepare environment + id: prepare + run: | + [ -d build/ ] && rm -rf build/* || mkdir -p build + make init -C tests + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + working-directory: build/ + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. - # If the Autobuild fails above, remove it and uncomment the following three lines. - # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality - # - run: | - # echo "Run, Build Application using script" - # ./location_of_script_within_repo/buildscript.sh + - name: CMake + id: cmake + run: | + cmake \ + -DCMAKE_CXX_COMPILER=$TOOLSET_GCC_DIR/bin/g++ \ + -DCMAKE_C_COMPILER=$TOOLSET_GCC_DIR/bin/gcc \ + -DNEBULA_USE_LINKER=gold \ + -DCMAKE_BUILD_TYPE=Debug \ + -DENABLE_TESTING=on \ + -GNinja \ + -B build + - name: Make + run: | + ccache -z + ninja -j $(nproc) + ccache -s + working-directory: build/ - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" + working-directory: build/ diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml index 5fe41712136..e5b42fae57d 100644 --- a/.github/workflows/pull_request.yml +++ b/.github/workflows/pull_request.yml @@ -28,7 +28,7 @@ jobs: with: clean: false - name: Check License Header - uses: apache/skywalking-eyes/header@main + uses: apache/skywalking-eyes/header@main - name: Ensure clang-format-10 is available run: | command -v clang-format-10 > /dev/null || (sudo apt update && sudo apt install -y clang-format-10)