Skip to content

Commit 411be70

Browse files
lucasssvazlucasssvaz
committed
feat(codeql): Add CodeQL analysis without build
1 parent c7520cc commit 411be70

File tree

4 files changed

+239
-0
lines changed

4 files changed

+239
-0
lines changed

‎.github/CODEOWNERS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111

1212
# CI
1313
/.github/ @lucasssvaz @me-no-dev @P-R-O-C-H-Y
14+
/.github/codeql/ @lucasssvaz
1415
/.gitlab/ @lucasssvaz
1516
/tests/ @lucasssvaz @P-R-O-C-H-Y
1617

‎.github/codeql/codeql-config.yml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: "CodeQL config"
2+
3+
packs:
4+
- trailofbits/cpp-queries
5+
- githubsecuritylab/codeql-cpp-queries
6+
- githubsecuritylab/codeql-python-queries
7+
8+
queries:
9+
- uses: security-extended
10+
- uses: security-and-quality
11+
12+
query-filters:
13+
- exclude:
14+
query path:
15+
- /^experimental\/.*/
16+
- exclude:
17+
tags contain:
18+
- experimental
19+
- exclude:
20+
problem.severity:
21+
- recommendation
22+
- exclude:
23+
id: tob/cpp/use-of-legacy-algorithm
24+
25+
paths-ignore:
26+
- tests/**

‎.github/scripts/sarif_nobuild.py

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
#!/usr/bin/env python3
2+
3+
import json
4+
import sys
5+
import os
6+
7+
def process_artifact_location(artifact_location, renamed_files):
8+
"""
9+
Process a single artifact location to rename .cpp files back to .ino
10+
"""
11+
if 'uri' in artifact_location:
12+
uri = artifact_location['uri']
13+
if uri in renamed_files:
14+
print(f"Renaming file: {uri} -> {renamed_files[uri]}")
15+
artifact_location['uri'] = renamed_files[uri]
16+
return True
17+
return False
18+
19+
def process_region(region):
20+
"""
21+
Adjust line numbers in a region by decreasing them by 1
22+
"""
23+
if 'startLine' in region:
24+
region['startLine'] = max(1, region['startLine'] - 1)
25+
if 'endLine' in region:
26+
region['endLine'] = max(1, region['endLine'] - 1)
27+
28+
def process_physical_location(physical_location, renamed_files):
29+
"""
30+
Process a physical location to rename files and adjust line numbers
31+
"""
32+
file_renamed = False
33+
34+
if 'artifactLocation' in physical_location:
35+
if process_artifact_location(physical_location['artifactLocation'], renamed_files):
36+
file_renamed = True
37+
38+
# Adjust line numbers if the file was renamed
39+
if file_renamed and 'region' in physical_location:
40+
process_region(physical_location['region'])
41+
42+
return file_renamed
43+
44+
def process_sarif_file(sarif_file, renamed_files_file):
45+
"""
46+
Process SARIF file to rename files back to .ino and adjust line numbers
47+
"""
48+
# Read the renamed files mapping
49+
with open(renamed_files_file, 'r') as f:
50+
renamed_files = json.load(f)
51+
52+
print(f"Loaded {len(renamed_files)} file mappings:")
53+
for cpp_file, ino_file in renamed_files.items():
54+
print(f" {cpp_file} -> {ino_file}")
55+
56+
# Read the SARIF file
57+
with open(sarif_file, 'r') as f:
58+
sarif_data = json.load(f)
59+
60+
files_processed = 0
61+
62+
# Process each run
63+
if 'runs' in sarif_data:
64+
for run in sarif_data['runs']:
65+
# Process results
66+
if 'results' in run:
67+
for result in run['results']:
68+
# Process all locations in the result
69+
if 'locations' in result:
70+
for location in result['locations']:
71+
if 'physicalLocation' in location:
72+
if process_physical_location(location['physicalLocation'], renamed_files):
73+
files_processed += 1
74+
75+
# Process related locations if they exist
76+
if 'relatedLocations' in result:
77+
for location in result['relatedLocations']:
78+
if 'physicalLocation' in location:
79+
if process_physical_location(location['physicalLocation'], renamed_files):
80+
files_processed += 1
81+
82+
# Process artifacts if they exist
83+
if 'artifacts' in run:
84+
for artifact in run['artifacts']:
85+
if 'location' in artifact and 'uri' in artifact['location']:
86+
uri = artifact['location']['uri']
87+
if uri in renamed_files:
88+
artifact['location']['uri'] = renamed_files[uri]
89+
files_processed += 1
90+
91+
print(f"Processed {files_processed} file references")
92+
93+
# Write the processed SARIF file
94+
with open(sarif_file, 'w') as f:
95+
json.dump(sarif_data, f, indent=2)
96+
97+
def main():
98+
if len(sys.argv) != 3:
99+
print("Usage: python3 sarif_nobuild.py <sarif_file> <renamed_files_file>")
100+
sys.exit(1)
101+
102+
sarif_file = sys.argv[1]
103+
renamed_files_file = sys.argv[2]
104+
105+
# Check if files exist
106+
if not os.path.exists(sarif_file):
107+
print(f"SARIF file not found: {sarif_file}")
108+
sys.exit(1)
109+
110+
if not os.path.exists(renamed_files_file):
111+
print(f"Renamed files mapping not found: {renamed_files_file}")
112+
sys.exit(1)
113+
114+
try:
115+
process_sarif_file(sarif_file, renamed_files_file)
116+
print("SARIF file processed successfully")
117+
except Exception as e:
118+
print(f"Error processing SARIF file: {e}")
119+
import traceback
120+
traceback.print_exc()
121+
sys.exit(1)
122+
123+
if __name__ == "__main__":
124+
main()

‎.github/workflows/codeql_nobuild.yml

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: CodeQL No-Build Analysis
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 4 * * SUN"
7+
pull_request:
8+
paths:
9+
- "**/*.py"
10+
- "**/*.yml"
11+
- "**/*.c"
12+
- "**/*.h"
13+
- "**/*.cpp"
14+
- "**/*.hpp"
15+
- "**/*.ino"
16+
17+
jobs:
18+
codeql-analysis:
19+
name: CodeQL ${{ matrix.language }} Analysis
20+
runs-on: ubuntu-latest
21+
strategy:
22+
matrix:
23+
language:
24+
- python
25+
- actions
26+
- cpp
27+
28+
steps:
29+
- name: Checkout repository
30+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
31+
32+
- name: Initialize CodeQL
33+
uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
34+
with:
35+
languages: ${{ matrix.language }}
36+
config-file: ./.github/codeql/codeql-config.yml
37+
build-mode: none
38+
39+
- name: Process .ino files
40+
if: matrix.language == 'cpp'
41+
run: |
42+
# Create a mapping file to track renamed files
43+
echo "{}" > renamed_files.json
44+
45+
# Find all .ino files and process them
46+
find . -name "*.ino" -type f | while read -r file; do
47+
echo "Processing $file"
48+
49+
# Get the relative path from repository root
50+
rel_path=$(realpath --relative-to=. "$file")
51+
cpp_path="${rel_path%.ino}.cpp"
52+
53+
# Create new .cpp file with Arduino.h include
54+
echo "#include <Arduino.h>" > "$cpp_path"
55+
56+
# Append the original content
57+
cat "$file" >> "$cpp_path"
58+
59+
# Update the mapping file
60+
jq --arg ino "$rel_path" --arg cpp "$cpp_path" '. += {($cpp): $ino}' renamed_files.json > temp.json && mv temp.json renamed_files.json
61+
62+
# Remove the original .ino file
63+
rm "$file"
64+
65+
echo "Converted $file to $cpp_path"
66+
done
67+
68+
echo "Renamed files mapping:"
69+
cat renamed_files.json
70+
71+
- name: Run CodeQL Analysis
72+
uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
73+
with:
74+
category: "Analysis: ${{ matrix.language }}"
75+
output: sarif-results
76+
upload: failure-only
77+
78+
- name: Process SARIF file
79+
if: matrix.language == 'cpp'
80+
run: |
81+
sarif_file="sarif-results/${{ matrix.language }}.sarif"
82+
python3 .github/scripts/sarif_nobuild.py "$sarif_file" "renamed_files.json"
83+
84+
- name: Upload SARIF file
85+
uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
86+
with:
87+
sarif_file: sarif-results/${{ matrix.language }}.sarif
88+
category: "Analysis: ${{ matrix.language }}"

0 commit comments

Comments
 (0)