Skip to content

Commit 37a1f11

Browse files
woody-applewoody-apple
authored
Moving CodeQL into builds, and making the CodeQL job a re-usable flow (project-chip#27484)
1 parent eb2017e commit 37a1f11

File tree

2 files changed

+114
-125
lines changed

2 files changed

+114
-125
lines changed

‎.github/workflows/build.yaml

+111-15
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,12 @@ on:
1919
pull_request:
2020
merge_group:
2121
workflow_dispatch:
22-
22+
workflow_call:
23+
inputs:
24+
run-codeql:
25+
required: false
26+
type: boolean
27+
2328
concurrency:
2429
group: ${{ github.ref }}-${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.event.number) || (github.event_name == 'workflow_dispatch' && github.run_number) || github.sha }}
2530
cancel-in-progress: true
@@ -94,6 +99,11 @@ jobs:
9499
.environment/gn_out/.ninja_log
95100
.environment/pigweed-venv/*.log
96101
102+
- name: Initialize CodeQL
103+
if: ${{ inputs.run-codeql }}
104+
uses: github/codeql-action/init@v2
105+
with:
106+
languages: "cpp"
97107
- name: Setup Build
98108
run: scripts/build/gn_gen.sh --args="chip_config_memory_debug_checks=true chip_config_memory_debug_dmalloc=false"
99109
- name: Run Build
@@ -133,6 +143,36 @@ jobs:
133143
path: /tmp/cores/
134144
# Cores are big; don't hold on to them too long.
135145
retention-days: 5
146+
- name: Perform CodeQL Analysis
147+
if: ${{ inputs.run-codeql }}
148+
uses: github/codeql-action/analyze@v2
149+
with:
150+
category: "/language:cpp"
151+
upload: False
152+
output: sarif-results
153+
- name: filter-sarif
154+
if: ${{ inputs.run-codeql }}
155+
uses: advanced-security/filter-sarif@v1
156+
with:
157+
patterns: |
158+
-**/third_party/**
159+
-**/scripts/**
160+
input: "sarif-results/cpp.sarif"
161+
output: "sarif-results/cpp.sarif"
162+
163+
- name: Upload SARIF
164+
if: ${{ inputs.run-codeql }}
165+
uses: github/codeql-action/upload-sarif@v2
166+
with:
167+
sarif_file: "sarif-results/cpp.sarif"
168+
169+
- name: Upload loc as a Build Artifact
170+
if: ${{ inputs.run-codeql }}
171+
uses: actions/upload-artifact@v2.2.0
172+
with:
173+
name: sarif-results
174+
path: sarif-results
175+
retention-days: 1
136176
# OBJDIR on linux is > 10K files and takes more than 50 minutes to upload, usually
137177
# having the job timeout.
138178
#
@@ -178,11 +218,6 @@ jobs:
178218
token: ${{ github.token }}
179219
attempt_limit: 3
180220
attempt_delay: 2000
181-
# - name: Initialize CodeQL
182-
# if: ${{ github.event_name == 'push' && github.event.ref == 'refs/heads/master' }}
183-
# uses: github/codeql-action/init@v1
184-
# with:
185-
# languages: "cpp"
186221
- name: Checkout submodules
187222
run: scripts/checkout_submodules.py --allow-changing-global-git-config --shallow --platform linux
188223
- name: Try to ensure the directories for core dumping exist and we
@@ -215,7 +250,11 @@ jobs:
215250
path: |
216251
.environment/gn_out/.ninja_log
217252
.environment/pigweed-venv/*.log
218-
253+
- name: Initialize CodeQL
254+
if: ${{ inputs.run-codeql }}
255+
uses: github/codeql-action/init@v2
256+
with:
257+
languages: "cpp"
219258
- name: Setup and Build Simulated Device
220259
timeout-minutes: 20
221260
run: |
@@ -302,6 +341,36 @@ jobs:
302341
run: |
303342
./scripts/run_in_build_env.sh \
304343
"./scripts/build/build_examples.py --target linux-fake-tests build"
344+
- name: Perform CodeQL Analysis
345+
if: ${{ inputs.run-codeql }}
346+
uses: github/codeql-action/analyze@v2
347+
with:
348+
category: "/language:cpp"
349+
upload: False
350+
output: sarif-results
351+
- name: filter-sarif
352+
if: ${{ inputs.run-codeql }}
353+
uses: advanced-security/filter-sarif@v1
354+
with:
355+
patterns: |
356+
-**/third_party/**
357+
-**/scripts/**
358+
input: "sarif-results/cpp.sarif"
359+
output: "sarif-results/cpp.sarif"
360+
361+
- name: Upload SARIF
362+
if: ${{ inputs.run-codeql }}
363+
uses: github/codeql-action/upload-sarif@v2
364+
with:
365+
sarif_file: "sarif-results/cpp.sarif"
366+
367+
- name: Upload loc as a Build Artifact
368+
if: ${{ inputs.run-codeql }}
369+
uses: actions/upload-artifact@v2.2.0
370+
with:
371+
name: sarif-results
372+
path: sarif-results
373+
retention-days: 1
305374
- name: Uploading core files
306375
uses: actions/upload-artifact@v3
307376
if: ${{ failure() && !env.ACT }}
@@ -411,11 +480,6 @@ jobs:
411480
token: ${{ github.token }}
412481
attempt_limit: 3
413482
attempt_delay: 2000
414-
#- name: Initialize CodeQL
415-
# if: ${{ github.event_name == 'push' && github.event.ref == 'refs/heads/master' }}
416-
# uses: github/codeql-action/init@v1
417-
# with:
418-
# languages: "cpp"
419483
- name: Checkout submodules
420484
run: scripts/checkout_submodules.py --allow-changing-global-git-config --shallow --platform darwin
421485
- name: Try to ensure the directory for diagnostic log collection exists
@@ -447,6 +511,11 @@ jobs:
447511
.environment/gn_out/.ninja_log
448512
.environment/pigweed-venv/*.log
449513
514+
- name: Initialize CodeQL
515+
if: ${{ inputs.run-codeql }}
516+
uses: github/codeql-action/init@v2
517+
with:
518+
languages: "cpp"
450519
- name: Setup and Build Simulated Device
451520
timeout-minutes: 20
452521
run: |
@@ -495,9 +564,36 @@ jobs:
495564
with:
496565
name: crash-log-darwin
497566
path: ~/Library/Logs/DiagnosticReports/
498-
# - name: Perform CodeQL Analysis
499-
# if: ${{ github.event_name == 'push' && github.event.ref == 'refs/heads/master' }}
500-
# uses: github/codeql-action/analyze@v1
567+
- name: Perform CodeQL Analysis
568+
if: ${{ inputs.run-codeql }}
569+
uses: github/codeql-action/analyze@v2
570+
with:
571+
category: "/language:cpp"
572+
upload: False
573+
output: sarif-results
574+
- name: filter-sarif
575+
if: ${{ inputs.run-codeql }}
576+
uses: advanced-security/filter-sarif@v1
577+
with:
578+
patterns: |
579+
-**/third_party/**
580+
-**/scripts/**
581+
input: "sarif-results/cpp.sarif"
582+
output: "sarif-results/cpp.sarif"
583+
584+
- name: Upload SARIF
585+
if: ${{ inputs.run-codeql }}
586+
uses: github/codeql-action/upload-sarif@v2
587+
with:
588+
sarif_file: "sarif-results/cpp.sarif"
589+
590+
- name: Upload loc as a Build Artifact
591+
if: ${{ inputs.run-codeql }}
592+
uses: actions/upload-artifact@v2.2.0
593+
with:
594+
name: sarif-results
595+
path: sarif-results
596+
retention-days: 1
501597
# TODO Log Upload https://github.com/project-chip/connectedhomeip/issues/2227
502598
# TODO https://github.com/project-chip/connectedhomeip/issues/1512
503599

‎.github/workflows/codeql.yml

+3-110
Original file line numberDiff line numberDiff line change
@@ -25,116 +25,9 @@ concurrency:
2525
group: ${{ github.ref }}-${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.event.number) || (github.event_name == 'workflow_dispatch' && github.run_number) || github.sha }}
2626
cancel-in-progress: true
2727

28-
env:
29-
CHIP_NO_LOG_TIMESTAMPS: true
30-
# XXX: Workaround for https://github.com/actions/cache/issues/1141
31-
SEGMENT_DOWNLOAD_TIMEOUT_MINS: 3
32-
3328
jobs:
3429
analyze:
35-
name: CodeQL Analysis
36-
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
37-
timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
38-
permissions:
39-
actions: read
40-
contents: read
41-
security-events: write
42-
43-
container:
44-
image: connectedhomeip/chip-build:0.7.3
45-
volumes:
46-
- "/tmp/log_output:/tmp/test_logs"
47-
options: --privileged --sysctl "net.ipv6.conf.all.disable_ipv6=0
48-
net.ipv4.conf.all.forwarding=1 net.ipv6.conf.all.forwarding=1"
49-
50-
strategy:
51-
fail-fast: false
52-
matrix:
53-
language: [ 'cpp' ]
54-
# language: [ 'cpp', 'java', 'javascript', 'python' ]
55-
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
56-
# Use only 'java' to analyze code written in Java, Kotlin or both
57-
# Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
58-
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
59-
60-
61-
steps:
62-
- name: Dump GitHub context
63-
env:
64-
GITHUB_CONTEXT: ${{ toJSON(github) }}
65-
run: echo "$GITHUB_CONTEXT"
66-
- name: Dump Concurrency context
67-
env:
68-
CONCURRENCY_CONTEXT: ${{ github.ref }}-${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.event.number) || (github.event_name == 'workflow_dispatch' && github.run_number) || github.sha }}
69-
run: echo "$CONCURRENCY_CONTEXT"
70-
- uses: Wandalen/wretry.action@v1.3.0
71-
name: Checkout
72-
with:
73-
action: actions/checkout@v3.5.2
74-
with: |
75-
token: ${{ github.token }}
76-
attempt_limit: 3
77-
attempt_delay: 2000
78-
- name: Checkout submodules
79-
run: scripts/checkout_submodules.py --allow-changing-global-git-config --shallow --platform linux
80-
- name: Try to ensure the directories for core dumping exist and we
81-
can write them.
82-
run: |
83-
mkdir /tmp/cores || true
84-
sysctl -w kernel.core_pattern=/tmp/cores/core.%u.%p.%t || true
85-
86-
- uses: Wandalen/wretry.action@v1.3.0
87-
name: Bootstrap cache
88-
continue-on-error: true
89-
timeout-minutes: 10
90-
with:
91-
action: buildjet/cache@v3
92-
attempt_limit: 3
93-
attempt_delay: 2000
94-
with: |
95-
key: ${{ runner.os }}-env-${{ hashFiles('scripts/setup/*', 'third_party/pigweed/**') }}
96-
path: |
97-
.environment
98-
build_overrides/pigweed_environment.gni
99-
- name: Bootstrap
100-
run: bash scripts/bootstrap.sh
101-
102-
- name: Initialize CodeQL
103-
uses: github/codeql-action/init@v2
104-
with:
105-
languages: ${{ matrix.language }}
106-
107-
- name: Setup Build
108-
run: scripts/build/gn_gen.sh --args="chip_config_memory_debug_checks=true chip_config_memory_debug_dmalloc=false"
109-
- name: Run Build
110-
run: scripts/run_in_build_env.sh "ninja -C ./out"
111-
- name: Run Tests
112-
run: scripts/tests/gn_tests.sh
113-
- name: Perform CodeQL Analysis
114-
uses: github/codeql-action/analyze@v2
115-
with:
116-
category: "/language:${{matrix.language}}"
117-
upload: False
118-
output: sarif-results
119-
120-
- name: filter-sarif
121-
uses: advanced-security/filter-sarif@v1
122-
with:
123-
patterns: |
124-
-**/app/tests/**
125-
-**/third_party/**
126-
-**/scripts/**
127-
input: "sarif-results/${{matrix.language}}.sarif"
128-
output: "sarif-results/${{matrix.language}}.sarif"
129-
130-
- name: Upload SARIF
131-
uses: github/codeql-action/upload-sarif@v2
132-
with:
133-
sarif_file: "sarif-results/${{matrix.language}}.sarif"
30+
uses: project-chip/connectedhomeip/.github/workflows/build.yml@main
31+
with:
32+
run-codeql: true
13433

135-
- name: Upload loc as a Build Artifact
136-
uses: actions/upload-artifact@v2.2.0
137-
with:
138-
name: sarif-results
139-
path: sarif-results
140-
retention-days: 1

0 commit comments

Comments
 (0)