Skip to content

Commit 725e5ff

Browse files
stephenegriffinstephenegriffin
authored
update codeql (#85)
1 parent 871d797 commit 725e5ff

File tree

5 files changed

+214
-61
lines changed

5 files changed

+214
-61
lines changed

‎.github/workflows/ci-build.yml‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,7 @@ jobs:
1818
security-events: write
1919

2020
steps:
21-
- uses: actions/checkout@v3
22-
23-
- name: Initialize CodeQL
24-
uses: github/codeql-action/init@v2
25-
with:
26-
languages: 'csharp'
21+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2722

2823
- name: Machine setup
2924
shell: pwsh
@@ -61,13 +56,8 @@ jobs:
6156
$path = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
6257
& $path\MSBuild\Current\Bin\amd64\msbuild.exe /m /p:Configuration="Release" ./FSSHTTPWOPIInspector/Test/WOPIautomation/WOPIautomation.sln
6358
64-
- name: Perform CodeQL Analysis
65-
uses: github/codeql-action/analyze@v2
66-
with:
67-
category: "/language:csharp"
68-
6959
- name: Publish Artifacts
70-
uses: actions/upload-artifact@v3
60+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
7161
with:
7262
name: build-artifacts
7363
path: |

‎.github/workflows/codeql.yml‎

Lines changed: 70 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,23 @@
1-
name: "CodeQL"
1+
name: "CodeQL Advanced"
22

33
on:
4+
workflow_dispatch:
45
push:
56
branches: [ "main" ]
67
pull_request:
7-
# The branches below must be a subset of the branches above
88
branches: [ "main" ]
99
schedule:
10-
- cron: '33 10 * * 4'
10+
- cron: '33 10 * * 4' # Run every Thursday at 10:33 UTC
11+
12+
permissions:
13+
contents: read
1114

1215
jobs:
1316
analyze:
14-
name: Analyze
15-
runs-on: ${{ 'windows-latest' }}
16-
timeout-minutes: ${{ 360 }}
17+
name: Analyze (${{ matrix.language }})
18+
runs-on: windows-latest
1719
permissions:
20+
packages: read
1821
actions: read
1922
contents: read
2023
security-events: write
@@ -25,52 +28,70 @@ jobs:
2528
language: [ 'csharp' ]
2629

2730
steps:
28-
- name: Checkout repository
29-
uses: actions/checkout@v3
30-
31-
# Initializes the CodeQL tools for scanning.
32-
- name: Initialize CodeQL
33-
uses: github/codeql-action/init@v2
34-
with:
35-
languages: ${{ matrix.language }}
31+
- name: Harden Runner
32+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
33+
with:
34+
egress-policy: audit
3635

37-
- name: Machine setup
38-
shell: pwsh
39-
run: ./scripts/machine-setup.ps1
36+
- name: Checkout repository
37+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
38+
with:
39+
submodules: 'recursive'
4040

41-
- name: Restore NuGet packages
42-
working-directory: ${{ github.workspace }}
43-
run: |
44-
nuget restore ./MAPIInspector/Source/MAPIInspector.sln
45-
nuget restore ./MAPIInspector/Test/MAPIAutomationTest/MAPIAutomationTest.sln
46-
nuget restore ./FSSHTTPWOPIInspector/Source/FSSHTTPandWOPIInspector.sln
47-
nuget restore ./FSSHTTPWOPIInspector/Test/WOPIautomation/WOPIautomation.sln
41+
# Initializes the CodeQL tools for scanning.
42+
- name: Initialize CodeQL
43+
uses: github/codeql-action/init@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3.27.3
44+
with:
45+
languages: ${{ matrix.language }}
46+
# If you wish to specify custom queries, you can do so here or in a config file.
47+
# By default, queries listed here will override any specified in a config file.
48+
# Prefix the list here with "+" to use these queries and those in the config file.
4849

49-
- name: "Build MAPIInspector"
50-
shell: pwsh
51-
run: |
52-
$path = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
53-
& $path\MSBuild\Current\Bin\amd64\msbuild.exe /m /p:Configuration="Release" ./MAPIInspector/Source/MAPIInspector.sln
50+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
51+
# queries: security-extended,security-and-quality
5452

55-
- name: "Build MAPIAutomationTest"
56-
shell: pwsh
57-
run: |
58-
$path = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
59-
& $path\MSBuild\Current\Bin\amd64\msbuild.exe /m /p:Configuration="Release" ./MAPIInspector/Test/MAPIAutomationTest/MAPIAutomationTest.sln
53+
- name: Machine setup
54+
shell: pwsh
55+
run: ./scripts/machine-setup.ps1
56+
57+
- name: Restore NuGet packages
58+
working-directory: ${{ github.workspace }}
59+
run: |
60+
nuget restore ./MAPIInspector/Source/MAPIInspector.sln
61+
nuget restore ./MAPIInspector/Test/MAPIAutomationTest/MAPIAutomationTest.sln
62+
nuget restore ./FSSHTTPWOPIInspector/Source/FSSHTTPandWOPIInspector.sln
63+
nuget restore ./FSSHTTPWOPIInspector/Test/WOPIautomation/WOPIautomation.sln
64+
65+
- name: "Build MAPIInspector"
66+
shell: pwsh
67+
run: |
68+
$path = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
69+
& $path\MSBuild\Current\Bin\amd64\msbuild.exe /m /p:Configuration="Release" ./MAPIInspector/Source/MAPIInspector.sln
70+
71+
- name: "Build MAPIAutomationTest"
72+
shell: pwsh
73+
run: |
74+
$path = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
75+
& $path\MSBuild\Current\Bin\amd64\msbuild.exe /m /p:Configuration="Release" ./MAPIInspector/Test/MAPIAutomationTest/MAPIAutomationTest.sln
76+
77+
- name: "Build FSSHTTPandWOPIInspector"
78+
shell: pwsh
79+
run: |
80+
$path = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
81+
& $path\MSBuild\Current\Bin\amd64\msbuild.exe /m /p:Configuration="Release" ./FSSHTTPWOPIInspector/Source/FSSHTTPandWOPIInspector.sln
82+
83+
- name: "Build WOPIautomation"
84+
shell: pwsh
85+
run: |
86+
$path = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
87+
& $path\MSBuild\Current\Bin\amd64\msbuild.exe /m /p:Configuration="Release" ./FSSHTTPWOPIInspector/Test/WOPIautomation/WOPIautomation.sln
6088
61-
- name: "Build FSSHTTPandWOPIInspector"
62-
shell: pwsh
63-
run: |
64-
$path = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
65-
& $path\MSBuild\Current\Bin\amd64\msbuild.exe /m /p:Configuration="Release" ./FSSHTTPWOPIInspector/Source/FSSHTTPandWOPIInspector.sln
89+
- name: Perform CodeQL Analysis
90+
uses: github/codeql-action/analyze@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3.27.3
91+
with:
92+
category: "/language:${{matrix.language}}"
6693

67-
- name: "Build WOPIautomation"
68-
shell: pwsh
69-
run: |
70-
$path = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
71-
& $path\MSBuild\Current\Bin\amd64\msbuild.exe /m /p:Configuration="Release" ./FSSHTTPWOPIInspector/Test/WOPIautomation/WOPIautomation.sln
72-
73-
- name: Perform CodeQL Analysis
74-
uses: github/codeql-action/analyze@v2
75-
with:
76-
category: "/language:${{matrix.language}}"
94+
- name: Upload CodeQL Analysis Results
95+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
96+
with:
97+
path: ${{ steps.analyze.outputs.sarif-output }}

‎.github/workflows/dependency-review.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Harden Runner
20+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
21+
with:
22+
egress-policy: audit
23+
24+
- name: 'Checkout Repository'
25+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
26+
- name: 'Dependency Review'
27+
uses: actions/dependency-review-action@4081bf99e2866ebe428fc0477b69eb4fcda7220a # v4.4.0

‎.github/workflows/devskim.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: DevSkim
2+
3+
on:
4+
pull_request:
5+
branches: [ "main" ]
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
lint:
13+
name: DevSkim
14+
runs-on: ubuntu-20.04
15+
permissions:
16+
actions: read
17+
contents: read
18+
security-events: write
19+
steps:
20+
- name: Harden Runner
21+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
22+
with:
23+
egress-policy: audit
24+
25+
- name: Checkout code
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
27+
28+
- name: Run DevSkim scanner
29+
uses: microsoft/DevSkim-Action@914fa647b406c387000300b2f09bb28691be2b6d # v1.0.14
30+
31+
- name: Upload DevSkim scan results to GitHub Security tab
32+
uses: github/codeql-action/upload-sarif@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3.27.3
33+
with:
34+
sarif_file: devskim-results.sarif
35+
36+
- name: Upload DevSkim scan results as an artifact
37+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
38+
with:
39+
path: devskim-results.sarif

‎.github/workflows/scorecards.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# This workflow uses actions that are not certified by GitHub. They are provided
2+
# by a third-party and are governed by separate terms of service, privacy
3+
# policy, and support documentation.
4+
5+
name: Scorecard supply-chain security
6+
on:
7+
# For Branch-Protection check. Only the default branch is supported. See
8+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
9+
branch_protection_rule:
10+
# To guarantee Maintained check is occasionally updated. See
11+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
12+
schedule:
13+
- cron: '20 7 * * 4' # Run every Thursday at 7:20 UTC
14+
push:
15+
branches: ["main"]
16+
17+
# Declare default permissions as read only.
18+
permissions: read-all
19+
20+
jobs:
21+
analysis:
22+
name: Scorecard analysis
23+
runs-on: ubuntu-latest
24+
permissions:
25+
# Needed to upload the results to code-scanning dashboard.
26+
security-events: write
27+
# Needed to publish results and get a badge (see publish_results below).
28+
id-token: write
29+
contents: read
30+
actions: read
31+
32+
steps:
33+
- name: Harden Runner
34+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
35+
with:
36+
egress-policy: audit
37+
38+
- name: "Checkout code"
39+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
40+
with:
41+
persist-credentials: false
42+
43+
- name: "Run analysis"
44+
uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
45+
with:
46+
results_file: results.sarif
47+
results_format: sarif
48+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
49+
# - you want to enable the Branch-Protection check on a *public* repository, or
50+
# - you are installing Scorecards on a *private* repository
51+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
52+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
53+
54+
# Public repositories:
55+
# - Publish results to OpenSSF REST API for easy access by consumers
56+
# - Allows the repository to include the Scorecard badge.
57+
# - See https://github.com/ossf/scorecard-action#publishing-results.
58+
# For private repositories:
59+
# - `publish_results` will always be set to `false`, regardless
60+
# of the value entered here.
61+
publish_results: true
62+
63+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
64+
# format to the repository Actions tab.
65+
- name: "Upload artifact"
66+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
67+
with:
68+
name: SARIF file
69+
path: results.sarif
70+
retention-days: 5
71+
72+
# Upload the results to GitHub's code scanning dashboard.
73+
- name: "Upload to code-scanning"
74+
uses: github/codeql-action/upload-sarif@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3.27.3
75+
with:
76+
sarif_file: results.sarif

0 commit comments

Comments
 (0)