[azure] Implement excess IP release support #181
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| types: | |
| - opened | |
| - synchronize | |
| - reopened | |
| jobs: | |
| analyze: | |
| name: Analyze | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ['actions'] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 | |
| with: | |
| category: '/language:${{matrix.language}}' | |
| output: sarif-results | |
| upload: false | |
| - name: Checking for missing-workflow-permissions issues | |
| run: | | |
| set -euo pipefail | |
| SARIF_FILE="sarif-results/${{ matrix.language }}.sarif" | |
| if [[ ! -f "$SARIF_FILE" ]]; then | |
| echo "No SARIF file found" | |
| touch /tmp/affected_files.txt | |
| exit 0 | |
| fi | |
| AFFECTED_FILES=$(jq -r ' | |
| .runs[].results // [] | | |
| .[] | | |
| select(.ruleId == "actions/missing-workflow-permissions") | | |
| .locations[0].physicalLocation.artifactLocation.uri | |
| ' "$SARIF_FILE" | sort -u) | |
| if [[ -z "$AFFECTED_FILES" ]]; then | |
| echo "✅ No issues found" | |
| touch /tmp/affected_files.txt | |
| exit 0 | |
| fi | |
| echo "$AFFECTED_FILES" > /tmp/affected_files.txt | |
| echo "Found issues in $(echo "$AFFECTED_FILES" | wc -l) files" | |
| - name: Get modified files | |
| run: | | |
| set -euo pipefail | |
| if [[ "${{ github.event_name }}" == "pull_request" ]]; then | |
| BASE_SHA="${{ github.event.pull_request.base.sha }}" | |
| HEAD_SHA="${{ github.event.pull_request.head.sha }}" | |
| MODIFIED_FILES=$(git diff --name-only "$BASE_SHA"..."$HEAD_SHA") | |
| else | |
| MODIFIED_FILES=$(git diff --name-only HEAD~1) | |
| fi | |
| echo "$MODIFIED_FILES" > /tmp/modified_files.txt | |
| echo "Found $(echo "$MODIFIED_FILES" | wc -l) modified files" | |
| - name: Check for issues in modified files | |
| run: | | |
| set -euo pipefail | |
| SARIF_FILE="sarif-results/${{ matrix.language }}.sarif" | |
| AFFECTED_FILES=$(cat /tmp/affected_files.txt) | |
| MODIFIED_FILES=$(cat /tmp/modified_files.txt) | |
| # If no affected files, skip check | |
| if [[ -z "$AFFECTED_FILES" ]]; then | |
| echo "✅ No issues in modified files" | |
| exit 0 | |
| fi | |
| # Check for issues in modified files | |
| FAILED=false | |
| while IFS= read -r file; do | |
| [[ -z "$file" ]] && continue | |
| if echo "$MODIFIED_FILES" | grep -qx "$file"; then | |
| echo "❌ Missing permissions in modified file: $file" | |
| jq -r --arg file "$file" ' | |
| .runs[].results // [] | | |
| .[] | | |
| select(.ruleId == "actions/missing-workflow-permissions" and | |
| .locations[0].physicalLocation.artifactLocation.uri == $file) | | |
| " Line \(.locations[0].physicalLocation.region.startLine): \(.message.text)" | |
| ' "$SARIF_FILE" | |
| FAILED=true | |
| fi | |
| done <<< "$AFFECTED_FILES" | |
| if [[ "$FAILED" == "true" ]]; then | |
| echo "" | |
| echo "❌ Pipeline failed: Modified files have missing workflow permissions" | |
| exit 1 | |
| fi | |
| echo "✅ No issues in modified files" | |
| - name: Upload SARIF as artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: codeql-sarif-${{ matrix.language }} | |
| path: sarif-results/${{ matrix.language }}.sarif | |
| retention-days: 7 | |
| - name: Upload SARIF to GitHub Security | |
| uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 | |
| with: | |
| sarif_file: sarif-results/${{ matrix.language }}.sarif | |
| category: '/language:${{matrix.language}}' |