From df37838b76c147cab36bdfbf5535de1cfce1a986 Mon Sep 17 00:00:00 2001 From: Alain Nicolas Date: Mon, 16 Jun 2025 17:55:31 +0200 Subject: [PATCH] chore(ci): improve CodeQL analysis (#1160) --- .github/workflows/codeql.yml | 102 +++++++++++------------------------ .github/workflows/main.yml | 10 ++++ 2 files changed, 42 insertions(+), 70 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 88b3e50d..d149a61d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,26 +1,7 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: "CodeQL" +name: CodeQL on: - push: - branches: [ "main" ] - paths: - # '!**.md' will not work by itself to exclude *.md files. See https://github.com/orgs/community/discussions/25369 - - '**' - - '!**.md' - - '!**.mdx' - - '!**/docs/**' - - '!docs/**' + workflow_call: jobs: analyze: @@ -34,59 +15,40 @@ jobs: strategy: fail-fast: false matrix: - language: [ 'go', 'java-kotlin', 'javascript-typescript' ] - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] - # Use only 'java' to analyze code written in Java, Kotlin or both - # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both - # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + language: [ 'go', 'java-kotlin', 'javascript-typescript', 'actions', 'python' ] steps: - - name: Checkout repository - uses: actions/checkout@v4 + - name: Checkout repository + uses: actions/checkout@v4 - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + queries: security-extended,security-and-quality - # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality + - name: Setup Java + if: matrix.language == 'java-kotlin' + uses: actions/setup-java@v4 + with: + distribution: temurin + java-version: 21 + - name: Autobuild + if: matrix.language != 'github-actions' + uses: github/codeql-action/autobuild@v3 + env: + GITHUB_TOKEN: ${{ secrets._GITHUB_TOKEN_RELEASE_ACCESS }} - - uses: actions/setup-java@v4 - with: - distribution: temurin - java-version: 21 - # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@v3 - env: - GITHUB_TOKEN: ${{ secrets._GITHUB_TOKEN_RELEASE_ACCESS }} + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" + output: sarif-results - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - # If the Autobuild fails above, remove it and uncomment the following three lines. - # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. - - # - run: | - # echo "Run, Build Application using script" - # ./location_of_script_within_repo/buildscript.sh - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:${{matrix.language}}" - output: sarif-results - sarif-file: ${{ matrix.language }}-results.sarif - - name: Upload CodeQL Results - uses: actions/upload-artifact@v4 - with: - name: codeql-results-${{ matrix.language }} - path: sarif-results - retention-days: 1 + - name: Upload CodeQL Results + uses: actions/upload-artifact@v4 + with: + name: codeql-results-${{ matrix.language }} + path: sarif-results + retention-days: 1 diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index a8334486..fd6e6e09 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -6,6 +6,11 @@ on: branches: - main +permissions: + contents: read + actions: read + security-events: write + jobs: store-image-name-and-tags: uses: ./.github/workflows/reuse-store-image-name-and-tags.yml @@ -143,6 +148,11 @@ jobs: transaction_exclusion_api_changed: ${{ needs.filter-commit-changes.outputs.transaction-exclusion-api }} secrets: inherit + code-analysis: + needs: [ filter-commit-changes ] + if: ${{ always() && needs.filter-commit-changes.outputs.has-changes-requiring-build == 'true' }} + uses: ./.github/workflows/codeql.yml + testing: needs: [ store-image-name-and-tags, filter-commit-changes, check-and-tag-images ] if: ${{ always() && needs.filter-commit-changes.outputs.has-changes-requiring-build == 'true' }}