Skip to content

Commit 1a6053e

Browse files
alangoualangou
committed
ci(security): add informational security checks
Signed-off-by: Adrien Langou <alangou@nvidia.com>
1 parent 7909fb5 commit 1a6053e

12 files changed

Lines changed: 570 additions & 0 deletions

File tree

‎.github/actionlint-matcher.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"problemMatcher": [
3+
{
4+
"owner": "actionlint",
5+
"pattern": [
6+
{
7+
"regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
8+
"file": 1,
9+
"line": 2,
10+
"column": 3,
11+
"message": 4,
12+
"code": 5
13+
}
14+
]
15+
}
16+
]
17+
}

‎.github/actionlint.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
self-hosted-runner:
5+
labels:
6+
- linux-amd64-cpu8
7+
- linux-amd64-gpu-rtxpro6000-latest-1
8+
- linux-arm64-cpu8
9+
- linux-arm64-gpu-l4-latest-1
10+
- nv
11+
- ubuntu-26.04
12+
- windows-arm64
13+
- wsl-amd64-gpu-rtxpro6000-latest-1
14+
15+
paths:
16+
.github/workflows/windows-msvc.yml:
17+
ignore:
18+
- 'constant expression "false" in condition'

‎.github/codeql/codeql-config.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: OpenShell Rust and SDKs
5+
6+
paths:
7+
- crates
8+
- e2e/rust
9+
- examples
10+
- sdk/go
11+
- sdk/typescript/src
12+
- python/openshell
13+
14+
paths-ignore:
15+
- python/openshell/_proto
16+
- sdk/typescript/src/gen

‎.github/workflows/codeql.yml‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: CodeQL
5+
6+
on:
7+
pull_request:
8+
merge_group:
9+
types: [checks_requested]
10+
push:
11+
branches: [main]
12+
schedule:
13+
- cron: "29 5 * * 6"
14+
workflow_dispatch:
15+
16+
permissions:
17+
contents: read
18+
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.ref }}
21+
cancel-in-progress: true
22+
23+
jobs:
24+
analyze:
25+
name: CodeQL (${{ matrix.language }})
26+
runs-on: ubuntu-latest
27+
timeout-minutes: 90
28+
strategy:
29+
fail-fast: false
30+
matrix:
31+
include:
32+
- language: rust
33+
build-mode: none
34+
- language: go
35+
build-mode: manual
36+
- language: python
37+
build-mode: none
38+
- language: javascript-typescript
39+
build-mode: none
40+
steps:
41+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
42+
with:
43+
persist-credentials: false
44+
45+
- name: Set up Go
46+
if: matrix.language == 'go'
47+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
48+
with:
49+
go-version-file: sdk/go/go.mod
50+
cache-dependency-path: sdk/go/go.sum
51+
52+
- name: Initialize CodeQL
53+
uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
54+
with:
55+
languages: ${{ matrix.language }}
56+
build-mode: ${{ matrix.build-mode }}
57+
config-file: ./.github/codeql/codeql-config.yml
58+
59+
- name: Build Go SDK
60+
if: matrix.language == 'go'
61+
working-directory: sdk/go
62+
run: go build ./...
63+
64+
- name: Analyze
65+
id: analyze
66+
uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
67+
with:
68+
category: /language:${{ matrix.language }}
69+
output: codeql-results
70+
upload: never
71+
72+
- name: Summarize findings
73+
if: always()
74+
env:
75+
LANGUAGE: ${{ matrix.language }}
76+
shell: bash
77+
run: |
78+
set -euo pipefail
79+
shopt -s globstar nullglob
80+
sarif_files=(codeql-results/**/*.sarif)
81+
82+
{
83+
echo "### CodeQL: $LANGUAGE"
84+
echo
85+
if [ "${#sarif_files[@]}" -eq 0 ]; then
86+
echo "No SARIF report was produced."
87+
else
88+
finding_count=$(jq -s '[.[].runs[]?.results[]?] | length' "${sarif_files[@]}")
89+
echo "Findings: $finding_count"
90+
echo
91+
echo "Findings are informational and do not fail CI."
92+
fi
93+
} >> "$GITHUB_STEP_SUMMARY"
94+
95+
- name: Upload SARIF
96+
if: always()
97+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
98+
with:
99+
name: codeql-${{ matrix.language }}-${{ github.run_id }}
100+
path: codeql-results
101+
if-no-files-found: ignore
102+
retention-days: 14
103+
104+
result:
105+
name: OpenShell / CodeQL (informational)
106+
if: always()
107+
needs: analyze
108+
runs-on: ubuntu-latest
109+
permissions: {}
110+
steps:
111+
- name: Evaluate analyzer execution
112+
env:
113+
ANALYZE_RESULT: ${{ needs.analyze.result }}
114+
shell: bash
115+
run: |
116+
if [ "$ANALYZE_RESULT" != "success" ]; then
117+
echo "::error::One or more CodeQL analyzers did not complete successfully."
118+
exit 1
119+
fi
120+
echo "All CodeQL analyzers completed; findings remain informational."

‎.github/workflows/dependency-review.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Dependency Review
5+
6+
on:
7+
pull_request:
8+
merge_group:
9+
types: [checks_requested]
10+
workflow_dispatch:
11+
inputs:
12+
base_sha:
13+
description: Base commit SHA to compare
14+
required: true
15+
type: string
16+
head_sha:
17+
description: Head commit SHA to compare
18+
required: true
19+
type: string
20+
21+
permissions:
22+
contents: read
23+
24+
concurrency:
25+
group: ${{ github.workflow }}-${{ github.ref }}
26+
cancel-in-progress: true
27+
28+
jobs:
29+
review:
30+
name: Dependency Review (informational)
31+
runs-on: ubuntu-latest
32+
env:
33+
BASE_REF: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || inputs.base_sha }}
34+
HEAD_REF: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha || inputs.head_sha }}
35+
steps:
36+
- name: Check Dependency Graph availability
37+
id: preflight
38+
env:
39+
GH_TOKEN: ${{ github.token }}
40+
shell: bash
41+
run: |
42+
set -euo pipefail
43+
44+
sha_pattern='^([0-9a-fA-F]{40}|[0-9a-fA-F]{64})$'
45+
if [[ ! "$BASE_REF" =~ $sha_pattern || ! "$HEAD_REF" =~ $sha_pattern ]]; then
46+
echo "::error::Dependency Review requires base and head commit SHAs."
47+
exit 2
48+
fi
49+
50+
response_file="$RUNNER_TEMP/dependency-review-preflight.json"
51+
http_status=$(
52+
curl \
53+
--silent \
54+
--show-error \
55+
--output "$response_file" \
56+
--write-out "%{http_code}" \
57+
--header "Accept: application/vnd.github+json" \
58+
--header "Authorization: Bearer $GH_TOKEN" \
59+
--header "X-GitHub-Api-Version: 2022-11-28" \
60+
"$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/dependency-graph/compare/$BASE_REF...$HEAD_REF"
61+
)
62+
63+
case "$http_status" in
64+
200)
65+
echo "available=true" >> "$GITHUB_OUTPUT"
66+
;;
67+
403|404)
68+
echo "available=false" >> "$GITHUB_OUTPUT"
69+
echo "::warning::GitHub Dependency Graph is unavailable (HTTP $http_status); Dependency Review is skipped."
70+
{
71+
echo "### Dependency Review"
72+
echo
73+
echo "GitHub Dependency Graph is unavailable (HTTP $http_status)."
74+
echo "The informational review will start automatically once the repository feature is available."
75+
} >> "$GITHUB_STEP_SUMMARY"
76+
;;
77+
*)
78+
message=$(jq -r '.message // "unknown API error"' "$response_file")
79+
echo "::error::Dependency Graph preflight failed with HTTP $http_status: $message"
80+
exit 1
81+
;;
82+
esac
83+
84+
- name: Review dependency changes
85+
if: steps.preflight.outputs.available == 'true'
86+
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
87+
with:
88+
base-ref: ${{ env.BASE_REF }}
89+
head-ref: ${{ env.HEAD_REF }}
90+
fail-on-severity: high
91+
fail-on-scopes: runtime, development, unknown
92+
warn-only: true
93+
comment-summary-in-pr: never
94+
license-check: false
95+
show-openssf-scorecard: false

0 commit comments

Comments
 (0)