mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-22 06:19:47 +08:00
127 lines
3.8 KiB
YAML
127 lines
3.8 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
name: CodeQL
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "29 5 * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
analyze:
|
|
name: CodeQL (${{ matrix.language }})
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 90
|
|
env:
|
|
# Keep Rust test fixtures out of production-focused security results.
|
|
CODEQL_EXTRACTOR_RUST_OPTION_CARGO_CFG_OVERRIDES: "-test"
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- language: rust
|
|
build-mode: none
|
|
- language: go
|
|
build-mode: manual
|
|
- language: python
|
|
build-mode: none
|
|
- language: javascript-typescript
|
|
build-mode: none
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up Go
|
|
if: matrix.language == 'go'
|
|
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
|
with:
|
|
go-version-file: sdk/go/go.mod
|
|
cache-dependency-path: sdk/go/go.sum
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: ${{ matrix.build-mode }}
|
|
config-file: ./.github/codeql/codeql-config.yml
|
|
|
|
- name: Build Go SDK
|
|
if: matrix.language == 'go'
|
|
working-directory: sdk/go
|
|
run: go build ./...
|
|
|
|
- name: Analyze
|
|
id: analyze
|
|
uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
|
|
with:
|
|
category: /language:${{ matrix.language }}
|
|
output: codeql-results
|
|
upload: never
|
|
|
|
- name: Summarize findings
|
|
if: always()
|
|
env:
|
|
LANGUAGE: ${{ matrix.language }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
shopt -s globstar nullglob
|
|
sarif_files=(codeql-results/**/*.sarif)
|
|
|
|
{
|
|
echo "### CodeQL: $LANGUAGE"
|
|
echo
|
|
if [ "${#sarif_files[@]}" -eq 0 ]; then
|
|
echo "No SARIF report was produced."
|
|
else
|
|
finding_count=$(jq -s '[.[].runs[]?.results[]?] | length' "${sarif_files[@]}")
|
|
echo "Findings: $finding_count"
|
|
echo
|
|
echo "Findings are informational and do not fail CI."
|
|
fi
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Upload SARIF to Code Scanning
|
|
if: steps.analyze.outcome == 'success'
|
|
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
|
|
with:
|
|
sarif_file: codeql-results
|
|
category: /language:${{ matrix.language }}
|
|
|
|
- name: Upload SARIF
|
|
if: always()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: codeql-${{ matrix.language }}-${{ github.run_id }}
|
|
path: codeql-results
|
|
if-no-files-found: ignore
|
|
retention-days: 14
|
|
|
|
result:
|
|
name: OpenShell / CodeQL (informational)
|
|
if: always()
|
|
needs: analyze
|
|
runs-on: ubuntu-latest
|
|
permissions: {}
|
|
steps:
|
|
- name: Evaluate analyzer execution
|
|
env:
|
|
ANALYZE_RESULT: ${{ needs.analyze.result }}
|
|
shell: bash
|
|
run: |
|
|
if [ "$ANALYZE_RESULT" != "success" ]; then
|
|
echo "::error::One or more CodeQL analyzers did not complete successfully."
|
|
exit 1
|
|
fi
|
|
echo "All CodeQL analyzers completed; findings remain informational."
|