Skip to content

Commit b5688e4

Browse files
FScholPerFScholPer
committed
add codeql test and reverted integration_test.sh
1 parent 8d4ef3b commit b5688e4

File tree

2 files changed

+220
-3
lines changed

2 files changed

+220
-3
lines changed

‎.github/workflows/codeql-multiple-repo-scan.yml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# *******************************************************************************
2+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
3+
#
4+
# See the NOTICE file(s) distributed with this work for additional
5+
# information regarding copyright ownership.
6+
#
7+
# This program and the accompanying materials are made available under the
8+
# terms of the Apache License Version 2.0 which is available at
9+
# https://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# SPDX-License-Identifier: Apache-2.0
12+
# *******************************************************************************
13+
14+
name: "CodeQL - Multi-Repo Source Scan"
15+
16+
on:
17+
pull_request:
18+
types: [opened, reopened, synchronize]
19+
merge_group:
20+
types: [checks_requested]
21+
22+
permissions:
23+
contents: write
24+
25+
jobs:
26+
analyze-repos:
27+
name: Analyze Multiple Repositories
28+
runs-on: ubuntu-latest
29+
permissions:
30+
contents: read
31+
security-events: write
32+
33+
steps:
34+
- name: Checkout central repository
35+
uses: actions/checkout@v4
36+
with:
37+
path: central-repo
38+
39+
- name: Parse pinned repository versions
40+
id: parse-repos
41+
run: |
42+
43+
sudo apt-get update && sudo apt-get install -y jq
44+
JSON_FILE="known_good.json"
45+
46+
# Check if the file exists
47+
if [ ! -f "$JSON_FILE" ]; then
48+
echo "Fehler: Die Datei '$JSON_FILE' wurde nicht gefunden."
49+
exit 1
50+
fi
51+
52+
53+
echo "MODULE_COUNT=$(jq '.modules | length' "$JSON_FILE")" >> $GITHUB_OUTPUT
54+
55+
56+
jq -c '.modules | to_entries[]' "$JSON_FILE" | while read -r module_entry; do
57+
module_name=$(echo "$module_entry" | jq -r '.key')
58+
repo_url=$(echo "$module_entry" | jq -r '.value.repo // empty')
59+
version=$(echo "$module_entry" | jq -r '.value.version // empty')
60+
branch=$(echo "$module_entry" | jq -r '.value.branch // empty')
61+
hash=$(echo "$module_entry" | jq -r '.value.hash // empty')
62+
63+
echo "${module_name}_url=$repo_url" >> $GITHUB_OUTPUT
64+
65+
if [ -n "$version" ]; then
66+
echo "${module_name}_version=$version" >> $GITHUB_OUTPUT
67+
fi
68+
69+
if [ -n "$branch" ]; then
70+
echo "${module_name}_branch=$branch" >> $GITHUB_OUTPUT
71+
fi
72+
73+
if [ -n "$hash" ]; then
74+
echo "${module_name}_hash=$hash" >> $GITHUB_OUTPUT
75+
fi
76+
done
77+
78+
- name: Checkout all pinned repositories
79+
id: checkout-repos
80+
run: |
81+
# Install jq for JSON parsing
82+
sudo apt-get install -y jq
83+
84+
# Read repositories from JSON file
85+
repos=$(cat repos.json)
86+
repo_count=$(echo $repos | jq length)
87+
88+
for i in $(seq 0 $((repo_count-1))); do
89+
name=$(echo $repos | jq -r ".[$i].name")
90+
url=$(echo $repos | jq -r ".[$i].url")
91+
version=$(echo $repos | jq -r ".[$i].version")
92+
path=$(echo $repos | jq -r ".[$i].path")
93+
94+
echo "Checking out $name ($version) to $path"
95+
96+
# Checkout the specific version/branch
97+
git clone --depth 1 --branch $version $url $path
98+
99+
# Store paths for later use
100+
echo "$path" >> repo-paths.txt
101+
done
102+
103+
# Output all paths as a single variable
104+
echo "repo_paths=$(cat repo-paths.txt | tr '\n' ',')" >> $GITHUB_OUTPUT
105+
106+
- name: Initialize CodeQL for all repositories
107+
uses: github/codeql-action/init@v4
108+
with:
109+
languages: cpp, python, javascript
110+
build-mode: none
111+
# Configure which paths to analyze
112+
config: |
113+
paths:
114+
- 'repos/**' # Analyze all repositories in repos/ directory
115+
paths-ignore:
116+
- '**/third_party/**'
117+
- '**/tests/**'
118+
- '**/*.test.*'
119+
- 'central-repo/**' # Don't analyze the central repo itself
120+
121+
- name: Perform CodeQL Analysis
122+
uses: github/codeql-action/analyze@v4
123+
with:
124+
upload-database: false # Don't upload databases for each repo
125+
output: sarif-results/
126+
category: "multi-repo-scan"
127+
128+
- name: Upload SARIF results as artifact
129+
uses: actions/upload-artifact@v4
130+
with:
131+
name: codeql-sarif-results
132+
path: sarif-results/

‎integration_test.sh‎

Lines changed: 88 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,32 @@ LOG_DIR=${LOG_DIR:-_logs/logs}
1212
SUMMARY_FILE=${SUMMARY_FILE:-_logs/build_summary.md}
1313
KNOWN_GOOD_FILE=""
1414

15+
# Codeql
16+
17+
CODEQL_WORK_DIR="./codeql_analysis_results"
18+
CODEQL_DATABASES_DIR="${CODEQL_WORK_DIR}/databases"
19+
CODEQL_SARIF_DIR="${CODEQL_WORK_DIR}/sarif"
20+
CODEQL_LANGUAGE="cpp"
21+
CODEQL_QUERY_PACKS="codeql/cpp-queries,codeql/misra-cpp-coding-standards" # Add more packs as needed
22+
CODEQL_CLI_VERSION="v2.23.6" # Use the latest stable version
23+
CODEQL_PLATFORM="linux64" # e.g., linux64, macos, win64
24+
CODEQL_BUNDLE="codeql-${CODEQL_PLATFORM}.zip"
25+
CODEQL_URL="https://github.com/github/codeql-cli-binaries/releases/download/${CODEQL_CLI_VERSION}/${CODEQL_BUNDLE}"
26+
#https://github.com/github/codeql-cli-binaries/releases/download/v2.23.6/codeql-linux64.zip
27+
1528
# maybe move this to known_good.json or a config file later
1629
declare -A BUILD_TARGET_GROUPS=(
1730
[score_baselibs]="@score_baselibs//score/..."
1831
[score_communication]="@score_communication//score/mw/com:com"
1932
[score_persistency]="@score_persistency//src/cpp/src/... @score_persistency//src/rust/..."
20-
#[score_logging]="@score_logging//src/..."
33+
[score_logging]="@score_logging//src/..."
2134
[score_orchestrator]="@score_orchestrator//src/..."
2235
[score_test_scenarios]="@score_test_scenarios//..."
2336
[score_feo]="@score_feo//..."
2437
)
2538

39+
40+
2641
# Parse command line arguments
2742
while [[ $# -gt 0 ]]; do
2843
case $1 in
@@ -107,19 +122,71 @@ overall_depr_total=0
107122

108123
# Track if any build group failed
109124
any_failed=0
125+
binary_path="${CODEQL_WORK_DIR}/codeql-cli/codeql/codeql"
126+
127+
if [ -x "${binary_path}" ]; then
128+
echo "Local CodeQL CLI found at ${binary_path}. Adding to PATH."
129+
export PATH="$(pwd)/${CODEQL_WORK_DIR}/codeql-cli/codeql:${PATH}"
130+
else
131+
echo "CodeQL CLI not found. Downloading..."
132+
mkdir -p "${CODEQL_WORK_DIR}/codeql-cli"
133+
curl -L "${CODEQL_URL}" -o "${CODEQL_WORK_DIR}/${CODEQL_BUNDLE}"
134+
unzip "${CODEQL_WORK_DIR}/${CODEQL_BUNDLE}" -d "${CODEQL_WORK_DIR}/codeql-cli"
135+
export PATH="$(pwd)/${CODEQL_WORK_DIR}/codeql-cli/codeql:${PATH}"
136+
echo "CodeQL CLI downloaded and added to PATH."
137+
fi
138+
139+
# Verify CodeQL CLI is now available
140+
if ! command -v codeql &> /dev/null; then
141+
echo "Error: CodeQL CLI could not be set up. Exiting."
142+
exit 1
143+
else
144+
echo "codeql found in path"
145+
fi
146+
147+
148+
mkdir -p "${CODEQL_DATABASES_DIR}"
149+
mkdir -p "${CODEQL_SARIF_DIR}"
110150

111151
for group in "${!BUILD_TARGET_GROUPS[@]}"; do
112152
targets="${BUILD_TARGET_GROUPS[$group]}"
113153
log_file="${LOG_DIR}/${group}.log"
114-
154+
155+
db_path="${CODEQL_DATABASES_DIR}/${group}_db"
156+
sarif_output="${CODEQL_SARIF_DIR}/${group}.sarif"
157+
current_bazel_output_base="/tmp/codeql_bazel_output_${group}_$(date +%s%N)" # Add timestamp for extra uniqueness
158+
159+
160+
# 1. Clean Bazel to ensure a fresh build for CodeQL tracing
161+
echo "Running 'bazel clean --expunge' and 'bazel shutdown'..."
162+
bazel --output_base="${current_bazel_output_base}" clean --expunge || { echo "Bazel clean failed for ${group}"; exit 1; }
163+
bazel --output_base="${current_bazel_output_base}" shutdown || { echo "Bazel shutdown failed for ${group}"; exit 1; }
164+
115165
# Log build group banner only to stdout/stderr (not into summary table file)
116166
echo "--- Building group: ${group} ---"
117167
start_ts=$(date +%s)
118168
echo "bazel build --config "${CONFIG}" ${targets} --verbose_failures"
119169
# GitHub Actions log grouping start
120170
echo "::group::Bazel build (${group})"
121171
set +e
122-
bazel build --config "${CONFIG}" ${targets} --verbose_failures 2>&1 | tee "$log_file"
172+
173+
build_command="bazel --output_base=\\\"${current_bazel_output_base}\\\" build \
174+
${targets} \
175+
--verbose_failures \
176+
--spawn_strategy=standalone \
177+
--nouse_action_cache \
178+
--noremote_accept_cached \
179+
--noremote_upload_local_results \
180+
--disk_cache= ${targets}"
181+
182+
codeql database create "${db_path}" \
183+
--language="${CODEQL_LANGUAGE}" \
184+
--build-mode=none \
185+
#--command="${build_command}" \
186+
--overwrite \
187+
|| { echo "CodeQL database creation failed for ${group}"; exit 1; }
188+
189+
123190
build_status=${PIPESTATUS[0]}
124191
# Track if any build group failed
125192
if [[ ${build_status} -ne 0 ]]; then
@@ -133,6 +200,24 @@ for group in "${!BUILD_TARGET_GROUPS[@]}"; do
133200
d_count=$(depr_count "$log_file")
134201
overall_warn_total=$(( overall_warn_total + w_count ))
135202
overall_depr_total=$(( overall_depr_total + d_count ))
203+
204+
# Shutdown Bazel again after the traced build
205+
echo "Running 'bazel shutdown' after CodeQL database creation..."
206+
bazel shutdown || { echo "Bazel shutdown failed after tracing for ${group}"; exit 1; }
207+
208+
# 4. Analyze the created database
209+
echo "Analyzing CodeQL database for ${group}..."
210+
codeql database analyze "${DB_PATH}" \
211+
--format=sarifv2.1.0 \
212+
--output="${SARIF_OUTPUT}" \
213+
--sarif-category="${group}-${CODEQL_LANGUAGE}" \
214+
--packs "${CODEQL_QUERY_PACKS}" \
215+
|| { echo "CodeQL analysis failed for ${group}"; exit 1; }
216+
217+
echo "CodeQL analysis for ${group} complete. Results saved to: ${SARIF_OUTPUT}"
218+
echo ""
219+
220+
136221
# Append as a markdown table row (duration without trailing 's')
137222
if [[ ${build_status} -eq 0 ]]; then
138223
status_symbol="✅"

0 commit comments

Comments
 (0)