Skip to content

Commit bc950e3

Browse files
Maxim-DoroninMaxim-Doronin
committed
Add CodeQL scan
1 parent 8640fdb commit bc950e3

File tree

8 files changed

+177
-12
lines changed

8 files changed

+177
-12
lines changed

‎.github/workflows/codeql.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: "CodeQL Advanced"
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
push:
7+
branches:
8+
- develop
9+
schedule:
10+
- cron: '24 8 * * 6'
11+
12+
concurrency:
13+
group: linux-${{ github.event_name }}-${{ github.ref_name }}-codeql
14+
cancel-in-progress: true
15+
16+
permissions: read-all
17+
18+
jobs:
19+
AnalyzePython:
20+
name: Analyze (${{ matrix.language }})
21+
runs-on: ubuntu-latest-8-cores
22+
permissions:
23+
security-events: write
24+
strategy:
25+
fail-fast: false
26+
matrix:
27+
include:
28+
- language: actions
29+
build-mode: none
30+
- language: python
31+
build-mode: none
32+
steps:
33+
- name: Checkout repository
34+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
35+
36+
- name: Initialize CodeQL
37+
uses: github/codeql-action/init@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
38+
with:
39+
languages: ${{ matrix.language }}
40+
build-mode: ${{ matrix.build-mode }}
41+
42+
- name: Perform CodeQL Analysis
43+
uses: github/codeql-action/analyze@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
44+
with:
45+
category: "/language:${{matrix.language}}"
46+
47+
AnalyzeCPP:
48+
name: Analyze c-cpp
49+
uses: ./.github/workflows/job_linux.yml
50+
permissions:
51+
actions: read
52+
contents: read
53+
packages: read
54+
statuses: read
55+
security-events: write
56+
with:
57+
os: ubuntu_24_04
58+
build-runner: ubuntu-latest-32-cores
59+
build-mlir: true
60+
build-driver: false
61+
with-codeql: true

‎.github/workflows/job_build_driver_linux.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,11 @@ defaults:
3232
run:
3333
shell: bash
3434

35-
permissions: read-all
35+
permissions:
36+
actions: read
37+
contents: read
38+
packages: read
39+
statuses: read
3640

3741
jobs:
3842
Build:
@@ -140,7 +144,7 @@ jobs:
140144
uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
141145
with:
142146
path: ${{ env.NPU_DRIVER_INSTALL_DIR }}
143-
key: ${{ needs.Cache.outputs.cache-key }}
147+
key: ${{ steps.cache-key.outputs.cache-key }}
144148

145149
- name: Upload artifacts
146150
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

‎.github/workflows/job_build_mlir_linux.yml‎

Lines changed: 67 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@ on:
2727
description: 'Cache package suffix'
2828
type: string
2929
required: false
30+
with-codeql:
31+
description: 'Whether to run CodeQL static C/C++ analyzer'
32+
type: boolean
33+
required: false
34+
default: false
3035
with-tests:
3136
description: 'Whether to build test targets'
3237
type: boolean
@@ -41,15 +46,25 @@ defaults:
4146
run:
4247
shell: bash
4348

44-
permissions: read-all
49+
permissions:
50+
actions: read
51+
contents: read
52+
packages: read
53+
statuses: read
4554

4655
jobs:
4756
Build:
4857
name: Build
4958
runs-on: ${{ inputs.build-runner }}
5059
timeout-minutes: 240
60+
permissions:
61+
actions: read
62+
contents: read
63+
packages: read
64+
statuses: read
65+
security-events: write
5166
outputs:
52-
build-package: ${{ steps.set-build-package-name.outputs.build-package }}
67+
build-package: ${{ steps.set-build-package-name.outputs.build-package }}
5368
env:
5469
DEBIAN_FRONTEND: noninteractive
5570
CMAKE_BUILD_TYPE: 'Release'
@@ -60,6 +75,7 @@ jobs:
6075
NPU_COMPILER_BUILD_DIR: ./npu_compiler_build
6176
OPENVINO_INSTALL_DIR: ./openvino_install
6277
OPENVINO_BUILD_PACKAGE: l_ov_dyn_${{ inputs.os }}_npu_${{ github.sha }}
78+
CODEQL_OUTPUTS: ./codeql_outputs
6379
steps:
6480
- name: Get cache key
6581
if: ${{ inputs.build-cache }}
@@ -131,6 +147,15 @@ jobs:
131147
echo "ENABLE_TESTS_FLAG=OFF" >> $GITHUB_ENV
132148
fi
133149
150+
- name: Initialize CodeQL
151+
if: ${{ !steps.cache-restore.outputs.cache-hit && inputs.with-codeql }}
152+
uses: github/codeql-action/init@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
153+
with:
154+
languages: c-cpp
155+
build-mode: manual
156+
config-file: ${{ env.NPU_COMPILER_REPO }}/.github/codeql/config.yml
157+
source-root: ${{ env.NPU_COMPILER_REPO }}
158+
134159
- name: CMake configure - OpenVINO
135160
if: ${{ !steps.cache-restore.outputs.cache-hit }}
136161
run: |
@@ -209,12 +234,51 @@ jobs:
209234
cmake --install ${NPU_COMPILER_BUILD_DIR} --config ${{ env.CMAKE_BUILD_TYPE }} --prefix ${OPENVINO_INSTALL_DIR}
210235
cmake --install ${NPU_COMPILER_BUILD_DIR} --config ${{ env.CMAKE_BUILD_TYPE }} --prefix ${OPENVINO_INSTALL_DIR} --component tests
211236
237+
- name: Perform CodeQL Analysis
238+
id: codeql-analyze
239+
if: ${{ !steps.cache-restore.outputs.cache-hit && inputs.with-codeql }}
240+
uses: github/codeql-action/analyze@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
241+
with:
242+
category: "/language:c-cpp"
243+
output: ${{ env.CODEQL_OUTPUTS }}
244+
upload: failure-only
245+
246+
- name: Filter CodeQL results
247+
id: codeql-filtered-analyze
248+
if: ${{ !steps.cache-restore.outputs.cache-hit && inputs.with-codeql }}
249+
uses: advanced-security/filter-sarif@bc96d9fb9338c5b48cc440b1b4d0a350b26a20db # Release 1.0
250+
with:
251+
input: ${{ env.CODEQL_OUTPUTS }}
252+
output: ${{ env.CODEQL_OUTPUTS }}/filtered-results.sarif
253+
include: |
254+
- ${{ env.NPU_COMPILER_REPO }}/**
255+
exclude: |
256+
- ${{ env.NPU_COMPILER_REPO }}/thirdparty/flatbuffers/**
257+
- ${{ env.NPU_COMPILER_REPO }}/thirdparty/gtest-parallel/**
258+
- ${{ env.NPU_COMPILER_REPO }}/thirdparty/llvm-project/**
259+
- ${{ env.NPU_COMPILER_REPO }}/thirdparty/yaml-cpp/**
260+
261+
- name: Upload CodeQL SARIF
262+
if: ${{ !steps.cache-restore.outputs.cache-hit && inputs.with-codeql }}
263+
uses: github/codeql-action/upload-sarif@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
264+
with:
265+
sarif_file: ${{ env.CODEQL_OUTPUTS }}/filtered-results.sarif
266+
checkout_path: ${{ env.NPU_COMPILER_REPO }}
267+
268+
- name: Upload CodeQL loc as a Build Artifact
269+
if: ${{ !steps.cache-restore.outputs.cache-hit && inputs.with-codeql }}
270+
uses: actions/upload-artifact@v4
271+
with:
272+
name: ${{ env.CODEQL_OUTPUTS }}
273+
path: ${{ env.CODEQL_OUTPUTS }}
274+
retention-days: 1
275+
212276
- name: Cache artifacts
213277
if: ${{ inputs.build-cache && !steps.cache-restore.outputs.cache-hit }}
214278
uses: actions/cache/save@v4
215279
with:
216280
path: ${{ env.OPENVINO_INSTALL_DIR }}
217-
key: ${{ needs.Cache.outputs.cache-key }}
281+
key: ${{ steps.cache-key.outputs.cache-key }}
218282

219283
- name: Upload artifacts
220284
uses: actions/upload-artifact@v4

‎.github/workflows/job_linux.yml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@ on:
4545
description: 'Cache package suffix'
4646
type: string
4747
required: false
48+
with-codeql:
49+
description: 'Whether to run CodeQL static C/C++ analyzer'
50+
type: boolean
51+
required: false
52+
default: false
4853
run-unit-tests:
4954
description: 'Whether to run NPU Compiler unit tests'
5055
type: boolean
@@ -65,7 +70,11 @@ defaults:
6570
run:
6671
shell: bash
6772

68-
permissions: read-all
73+
permissions:
74+
actions: read
75+
contents: read
76+
packages: read
77+
statuses: read
6978

7079
env:
7180
OPENVINO_INSTALL_DIR: ./openvino_install
@@ -75,13 +84,20 @@ jobs:
7584
name: MLIR / Build
7685
if: ${{ inputs.build-mlir }}
7786
uses: ./.github/workflows/job_build_mlir_linux.yml
87+
permissions:
88+
actions: read
89+
contents: read
90+
packages: read
91+
statuses: read
92+
security-events: write
7893
with:
7994
os: ${{ inputs.os }}
8095
build-runner: ${{ inputs.build-runner }}
8196
openvino-cmake-options: ${{ inputs.openvino-cmake-options }}
8297
npu-cmake-options: ${{ inputs.npu-cmake-options }}
8398
build-cache: ${{ inputs.build-cache }}
8499
build-cache-key-suffix: ${{ inputs.build-cache-key-suffix }}
100+
with-codeql: ${{ inputs.with-codeql }}
85101
with-tests: ${{ inputs.run-unit-tests || inputs.run-lit-tests }}
86102

87103
BuildDriver:

‎.github/workflows/job_tests_compilation_linux.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,11 @@ defaults:
2828
run:
2929
shell: bash
3030

31-
permissions: read-all
31+
permissions:
32+
actions: read
33+
contents: read
34+
packages: read
35+
statuses: read
3236

3337
jobs:
3438
CompilationTests:

‎.github/workflows/job_tests_unit_mlir_linux.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,11 @@ defaults:
2525
run:
2626
shell: bash
2727

28-
permissions: read-all
28+
permissions:
29+
actions: read
30+
contents: read
31+
packages: read
32+
statuses: read
2933

3034
env:
3135
OPENVINO_INSTALL_DIR: ./openvino_install

‎.github/workflows/ubuntu_22.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,20 @@ jobs:
1616
Ubuntu2204:
1717
name: Main Trigger
1818
uses: ./.github/workflows/job_linux.yml
19+
permissions:
20+
actions: read
21+
contents: read
22+
packages: read
23+
statuses: read
24+
security-events: write
1925
with:
2026
os: ubuntu_22_04
2127
build-runner: ubuntu-22.04-16-cores
2228
test-runner: ubuntu-22.04-8-cores
2329
build-cache: false
2430
build-cache-key-suffix: cache_${{ github.ref_name }}
25-
build-mlir: false
26-
build-driver: false
31+
build-mlir: true
32+
build-driver: true
2733
run-unit-tests: true
2834
run-lit-tests: true
2935
run-compilation-tests: true

‎.github/workflows/ubuntu_24.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,19 @@ jobs:
1616
Ubuntu2404:
1717
name: Main Trigger
1818
uses: ./.github/workflows/job_linux.yml
19+
permissions:
20+
actions: read
21+
contents: read
22+
packages: read
23+
statuses: read
24+
security-events: write
1925
with:
2026
os: ubuntu_24_04
2127
build-runner: ubuntu-latest-32-cores
2228
test-runner: ubuntu-latest-8-cores
23-
build-cache: true
29+
build-cache: false
2430
build-cache-key-suffix: cache_${{ github.ref_name }}
25-
build-mlir: false
31+
build-mlir: true
2632
build-driver: true
2733
run-unit-tests: false
2834
run-lit-tests: false

0 commit comments

Comments
 (0)