Skip to content

Commit b29b598

Browse files
zouguangxianzouguangxian
committed
chore: add CodeQL analysis and ShellCheck linting workflow
1 parent 0f42855 commit b29b598

File tree

3 files changed

+81
-92
lines changed

3 files changed

+81
-92
lines changed

‎.devcontainer/post-create‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
1-
#!/usr/bin/env sh
1+
#!/usr/bin/env bash
22
set -e
33

44
# Function to patch the code script
55
patch_code() {
6-
# Check if the code binary path doesn't exist or if cursor handling logic is already present
7-
local bin_path="$1"
8-
[ ! -f "$bin_path" ] || grep -q 'cursor' "$bin_path" && return
6+
# Check if the code binary path doesn't exist or if cursor handling logic is already present
7+
local bin_path="$1"
8+
[ ! -f "$bin_path" ] || grep -q 'cursor' "$bin_path" && return
99

10-
# Insert the cursor handling logic before the specified line
11-
sed -i '/exec code-insiders/a \
10+
# Insert the cursor handling logic before the specified line
11+
sed -i '/exec code-insiders/a \
1212
elif [ "$(command -v cursor)" ]; then \
1313
exec cursor "$@"' "$bin_path"
1414

15-
if [ $? -ne 0 ]; then
16-
echo "Error: Failed to insert cursor handling logic into $bin_path."
17-
fi
15+
if [ $? -ne 0 ]; then
16+
echo "Error: Failed to insert cursor handling logic into $bin_path."
17+
fi
1818
}
1919

20-
patch_code /usr/local/bin/code
20+
patch_code /usr/local/bin/code

‎.github/workflows/codeql.yml‎

Lines changed: 69 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -1,101 +1,89 @@
1-
# For most projects, this workflow file will not need changing; you simply need
2-
# to commit it to your repository.
3-
#
4-
# You may wish to alter this file to override the set of languages analyzed,
5-
# or to provide custom queries or build logic.
6-
#
7-
# ******** NOTE ********
8-
# We have attempted to detect the languages in your repository. Please check
9-
# the `language` matrix defined below to confirm you have the correct set of
10-
# supported CodeQL languages.
11-
#
12-
name: "CodeQL Advanced"
1+
name: CodeQL
132

143
on:
154
push:
16-
branches: [ "main" ]
5+
branches:
6+
- main
7+
- dev
178
pull_request:
18-
branches: [ "main" ]
9+
branches:
10+
- main
11+
- dev
12+
merge_group:
13+
branches:
14+
- main
15+
- dev
1916
schedule:
20-
- cron: '27 12 * * 4'
17+
- cron: "27 12 * * 4"
18+
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
21+
cancel-in-progress: true
22+
23+
permissions:
24+
contents: read
25+
security-events: write
26+
packages: read
27+
actions: read
2128

2229
jobs:
2330
analyze:
2431
name: Analyze (${{ matrix.language }})
25-
# Runner size impacts CodeQL analysis time. To learn more, please see:
26-
# - https://gh.io/recommended-hardware-resources-for-running-codeql
27-
# - https://gh.io/supported-runners-and-hardware-resources
28-
# - https://gh.io/using-larger-runners (GitHub.com only)
29-
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
30-
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
31-
permissions:
32-
# required for all workflows
33-
security-events: write
34-
35-
# required to fetch internal or private CodeQL packs
36-
packages: read
37-
38-
# only required for workflows in private repositories
39-
actions: read
40-
contents: read
32+
runs-on: ubuntu-latest
33+
timeout-minutes: 30
4134

4235
strategy:
4336
fail-fast: false
4437
matrix:
4538
include:
46-
- language: actions
47-
build-mode: none
48-
- language: rust
49-
build-mode: none
50-
# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
51-
# Use `c-cpp` to analyze code written in C, C++ or both
52-
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
53-
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
54-
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
55-
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
56-
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
57-
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
39+
- language: actions
40+
build-mode: none
41+
- language: rust
42+
build-mode: none
43+
5844
steps:
59-
- name: Checkout repository
60-
uses: actions/checkout@v4
45+
- name: Checkout repository
46+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
6147

62-
# Add any setup steps before running the `github/codeql-action/init` action.
63-
# This includes steps like installing compilers or runtimes (`actions/setup-node`
64-
# or others). This is typically only required for manual builds.
65-
# - name: Setup runtime (example)
66-
# uses: actions/setup-example@v1
48+
- name: Initialize CodeQL
49+
uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
50+
with:
51+
languages: ${{ matrix.language }}
52+
build-mode: ${{ matrix.build-mode }}
53+
queries: security-extended
6754

68-
# Initializes the CodeQL tools for scanning.
69-
- name: Initialize CodeQL
70-
uses: github/codeql-action/init@v4
71-
with:
72-
languages: ${{ matrix.language }}
73-
build-mode: ${{ matrix.build-mode }}
74-
# If you wish to specify custom queries, you can do so here or in a config file.
75-
# By default, queries listed here will override any specified in a config file.
76-
# Prefix the list here with "+" to use these queries and those in the config file.
55+
- name: Perform CodeQL Analysis
56+
uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
57+
with:
58+
category: "/language:${{ matrix.language }}"
7759

78-
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
79-
# queries: security-extended,security-and-quality
60+
shellcheck:
61+
name: Shell Script Lint
62+
runs-on: ubuntu-latest
63+
timeout-minutes: 5
8064

81-
# If the analyze step fails for one of the languages you are analyzing with
82-
# "We were unable to automatically build your code", modify the matrix above
83-
# to set the build mode to "manual" for that language. Then modify this step
84-
# to build your code.
85-
# ℹ️ Command-line programs to run using the OS shell.
86-
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
87-
- name: Run manual build steps
88-
if: matrix.build-mode == 'manual'
89-
shell: bash
90-
run: |
91-
echo 'If you are using a "manual" build mode for one or more of the' \
92-
'languages you are analyzing, replace this with the commands to build' \
93-
'your code, for example:'
94-
echo ' make bootstrap'
95-
echo ' make release'
96-
exit 1
65+
permissions:
66+
contents: read
67+
security-events: write
9768

98-
- name: Perform CodeQL Analysis
99-
uses: github/codeql-action/analyze@v4
100-
with:
101-
category: "/language:${{matrix.language}}"
69+
steps:
70+
- name: Checkout repository
71+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
72+
73+
- name: Run ShellCheck
74+
uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
75+
with:
76+
scandir: "."
77+
format: gcc
78+
severity: warning
79+
80+
all-checks:
81+
name: CodeQL
82+
needs: [analyze, shellcheck]
83+
if: ${{ !cancelled() }}
84+
runs-on: ubuntu-latest
85+
steps:
86+
- name: Conclusion
87+
run: |
88+
jq -C <<< '${{ toJson(needs) }}'
89+
jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'

‎bootstrap‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ set -eu -o pipefail
44

55
TARGET_OS=""
66

7-
readonly ROOT="$(git rev-parse --show-toplevel 2>/dev/null || (cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd))"
7+
ROOT="$(git rev-parse --show-toplevel 2>/dev/null || (cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd))"
8+
readonly ROOT
89
readonly TMPDIR=${TMPDIR:-/tmp}
910

1011
readonly RISCV_DIR="$HOME/.local/riscv"

0 commit comments

Comments
 (0)