|
9 | 9 | branches: '*' |
10 | 10 |
|
11 | 11 | jobs: |
12 | | - codeql: |
13 | | - name: GitHub CodeQL |
14 | | - runs-on: ubuntu-latest |
15 | | - |
16 | | - permissions: |
17 | | - actions: read |
18 | | - contents: read |
19 | | - security-events: write |
20 | | - |
21 | | - steps: |
22 | | - - name: Checkout repository |
23 | | - uses: actions/checkout@v4 |
24 | | - with: |
25 | | - submodules: recursive |
26 | | - |
27 | | - # Initializes the CodeQL tools for scanning. |
28 | | - - name: Initialize CodeQL |
29 | | - uses: github/codeql-action/init@v2 |
30 | | - with: |
31 | | - languages: ${{ matrix.language }} |
32 | | - queries: security-and-quality |
33 | | - |
34 | | - - name: Install Deps, Configure and Build |
35 | | - run: | |
36 | | - ./.github/workflows/codeql-buildscript.sh |
37 | | -
|
38 | | - - name: Perform CodeQL Analysis |
39 | | - uses: github/codeql-action/analyze@v2 |
40 | | - with: |
41 | | - category: "/language:cpp" |
42 | | - upload: false |
43 | | - id: step1 |
44 | | - |
45 | | - # Filter out rules with low severity or high false positve rate |
46 | | - # Also filter out warnings in third-party code |
47 | | - - name: Filter out unwanted errors and warnings |
48 | | - uses: advanced-security/filter-sarif@v1 |
49 | | - with: |
50 | | - patterns: | |
51 | | - -**:cpp/path-injection |
52 | | - -**:cpp/world-writable-file-creation |
53 | | - -**:cpp/poorly-documented-function |
54 | | - -**:cpp/potentially-dangerous-function |
55 | | - -**:cpp/use-of-goto |
56 | | - -**:cpp/integer-multiplication-cast-to-long |
57 | | - -**:cpp/comparison-with-wider-type |
58 | | - -**:cpp/leap-year/* |
59 | | - -**:cpp/ambiguously-signed-bit-field |
60 | | - -**:cpp/suspicious-pointer-scaling |
61 | | - -**:cpp/suspicious-pointer-scaling-void |
62 | | - -**:cpp/unsigned-comparison-zero |
63 | | - -**/cmake*/Modules/** |
64 | | - input: ${{ steps.step1.outputs.sarif-output }}/cpp.sarif |
65 | | - output: ${{ steps.step1.outputs.sarif-output }}/cpp.sarif |
66 | | - |
67 | | - - name: Upload CodeQL results to code scanning |
68 | | - uses: github/codeql-action/upload-sarif@v2 |
69 | | - with: |
70 | | - sarif_file: ${{ steps.step1.outputs.sarif-output }} |
71 | | - category: "/language:cpp" |
72 | | - |
73 | | - - name: Upload CodeQL results as an artifact |
74 | | - if: success() || failure() |
75 | | - uses: actions/upload-artifact@v4 |
76 | | - with: |
77 | | - name: codeql-results |
78 | | - path: ${{ steps.step1.outputs.sarif-output }} |
79 | | - retention-days: 5 |
80 | | - |
81 | | - - name: Fail if a warning is found |
82 | | - run: | |
83 | | - ./.github/workflows/fail_on_warning.py \ |
84 | | - ${{ steps.step1.outputs.sarif-output }}/cpp.sarif |
85 | | - |
86 | 12 | codechecker: |
87 | 13 | name: CodeChecker |
88 | 14 | runs-on: ubuntu-latest |
|
0 commit comments