libhttpserver/.github/workflows/codeql-analysis.yml at master · etr/libhttpserver · GitHub

View runs

History

117 lines (104 loc) · 5.15 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

name: "CodeQL"

# Supply-chain hardening (TASK-090): every action below is pinned to a full

# 40-hex commit SHA, mirroring the convention in verify-build.yml. The trailing

# `# vX.Y.Z` comment records the upstream release tag each SHA corresponds to,

# for rotation.

# Pinned actions and how to rotate them (read-only `gh` API; dereference the

# annotated tag to its commit SHA):

# actions/checkout v4.2.2 -> 11bd71901bbe5b1630ceea73d27597364c9af683

# (kept identical to verify-build.yml so both workflows rotate together)

# gh api repos/actions/checkout/git/refs/tags/v4.2.2 --jq .object.sha

# github/codeql-action/* v3.36.3 -> 411c4c9a36b3fca4d674f06b6396b2c6d23522c6

# init AND analyze ship from one repo/release and MUST share one SHA.

# SHA=$(gh api repos/github/codeql-action/git/refs/tags/v3.36.3 --jq .object.sha)

# gh api repos/github/codeql-action/git/tags/$SHA --jq .object.sha # deref annotated tag

# (@v1/@v2 of codeql-action are deprecated; v3 is the current major.)

on:

push:

branches: [master]

pull_request:

# The branches below must be a subset of the branches above

branches: [master]

schedule:

- cron: '0 4 * * 4'

# Least-privilege GITHUB_TOKEN: restrict to exactly what the CodeQL scan

# needs. `security-events: write` is required by github/codeql-action/analyze

# to upload the SARIF report to the security dashboard. `contents: read` is

# required by actions/checkout. `actions: read` is required on some GitHub

# plans/repository configurations to read the workflow run. Without an

# explicit block the token defaults to the repository's global setting.

permissions:

actions: read

contents: read

security-events: write

jobs:

analyze:

name: Analyze

runs-on: ubuntu-latest

strategy:

fail-fast: false

matrix:

# Override automatic language detection by changing the below list

# Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']

language: ['cpp']

# Learn more...

# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection

steps:

- name: Checkout repository

uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

with:

# We must fetch at least the immediate parents so that if this is

# a pull request then we can checkout the head.

fetch-depth: 2

# If this run was triggered by a pull request event, then checkout

# the head of the pull request instead of the merge commit.

- run: git checkout HEAD^2

if: ${{ github.event_name == 'pull_request' }}

- name: Fetch libmicrohttpd from cache

id: cache-libmicrohttpd

uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0

with:

path: libmicrohttpd-1.0.3

key: ${{ runner.os }}-libmicrohttpd-1.0.3-codeql

- name: Build libmicrohttpd dependency (if not cached)

# Supply-chain: libmicrohttpd-1.0.3.tar.gz is sha256-pinned. The digest

# must match the value used in verify-build.yml; both workflows track the

# same release. To rotate the libmicrohttpd version, update both the URL

# and the digest in the same PR (keep this file and verify-build.yml in

# sync). Obtain the new digest by downloading the tarball and running:

# sha256sum libmicrohttpd-<version>.tar.gz

# Cross-check against the libmicrohttpd project's official release page.

# rotate: sha256 7816b57aae199cf5c3645e8770e1be5f0a4dfafbcb24b3772173dc4ee634126a

run: |

curl -fsSL https://s3.amazonaws.com/libhttpserver/libmicrohttpd_releases/libmicrohttpd-1.0.3.tar.gz -o libmicrohttpd-1.0.3.tar.gz ;

echo "7816b57aae199cf5c3645e8770e1be5f0a4dfafbcb24b3772173dc4ee634126a libmicrohttpd-1.0.3.tar.gz" | sha256sum -c ;

tar -xzf libmicrohttpd-1.0.3.tar.gz ;

cd libmicrohttpd-1.0.3 ;

./configure --disable-examples ;

make ;

timeout-minutes: 30

if: steps.cache-libmicrohttpd.outputs.cache-hit != 'true'

- name: Install libmicrohttpd dependency

run: cd libmicrohttpd-1.0.3 ; sudo make install ;

timeout-minutes: 30

# Initializes the CodeQL tools for scanning.

- name: Initialize CodeQL

uses: github/codeql-action/init@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3.36.3

with:

languages: ${{ matrix.language }}

# CodeQL's C/C++ database extractor traces the actual compile commands, so

# the library is built explicitly here rather than via the CodeQL Autobuild

# action (autobuild guesses the build and is intentionally not used). The

# build must be a clean from-scratch `make` so every TU is extracted; the

# in-source build (--enable-same-directory-build) keeps object files where

# the extractor expects them.

- name: Build the library (CodeQL manual mode)

run: |

./bootstrap ;

./configure --enable-same-directory-build ;

make ;

timeout-minutes: 30

- name: Perform CodeQL Analysis

uses: github/codeql-action/analyze@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3.36.3

timeout-minutes: 30

libhttpserver/.github/workflows/codeql-analysis.yml at master · etr/libhttpserver · GitHub

Uh oh!

Expand file tree

Breadcrumbs

codeql-analysis.yml

Latest commit

History

Breadcrumbs

codeql-analysis.yml

File metadata and controls