Skip to content

Commit 8e2b40d

Browse files
alangoualangou
committed
ci(security): add informational security checks
Signed-off-by: Adrien Langou <alangou@nvidia.com>
1 parent 8be8b62 commit 8e2b40d

14 files changed

Lines changed: 788 additions & 0 deletions

‎.github/actionlint-matcher.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"problemMatcher": [
3+
{
4+
"owner": "actionlint",
5+
"pattern": [
6+
{
7+
"regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
8+
"file": 1,
9+
"line": 2,
10+
"column": 3,
11+
"message": 4,
12+
"code": 5
13+
}
14+
]
15+
}
16+
]
17+
}

‎.github/actionlint-sarif-template.txt‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"$schema": "https://json.schemastore.org/sarif-2.1.0.json",
3+
"version": "2.1.0",
4+
"runs": [
5+
{
6+
"tool": {
7+
"driver": {
8+
"name": "Actionlint",
9+
"version": {{ getVersion | json }},
10+
"informationUri": "https://github.com/rhysd/actionlint",
11+
"rules": [
12+
{{$first := true}}
13+
{{range $ := allKinds}}
14+
{{if $first}}{{$first = false}}{{else}},{{end}}
15+
{
16+
"id": {{json $.Name}},
17+
"name": {{$.Name | toPascalCase | json}},
18+
"defaultConfiguration": {
19+
"level": "warning"
20+
},
21+
"fullDescription": {
22+
"text": {{json $.Description}}
23+
},
24+
"helpUri": "https://github.com/rhysd/actionlint/blob/v1.7.12/docs/checks.md"
25+
}
26+
{{end}}
27+
]
28+
}
29+
},
30+
"results": [
31+
{{$first := true}}
32+
{{range $ := .}}
33+
{{if $first}}{{$first = false}}{{else}},{{end}}
34+
{
35+
"ruleId": {{json $.Kind}},
36+
"level": "warning",
37+
"message": {
38+
"text": {{json $.Message}}
39+
},
40+
"locations": [
41+
{
42+
"physicalLocation": {
43+
"artifactLocation": {
44+
"uri": {{json $.Filepath}},
45+
"uriBaseId": "%SRCROOT%"
46+
},
47+
"region": {
48+
"startLine": {{$.Line}},
49+
"startColumn": {{$.Column}},
50+
"endColumn": {{$.EndColumn}},
51+
"snippet": {
52+
"text": {{json $.Snippet}}
53+
}
54+
}
55+
}
56+
}
57+
]
58+
}
59+
{{end}}
60+
]
61+
}
62+
]
63+
}

‎.github/actionlint.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
self-hosted-runner:
5+
labels:
6+
- linux-amd64-cpu8
7+
- linux-amd64-gpu-rtxpro6000-latest-1
8+
- linux-arm64-cpu8
9+
- linux-arm64-gpu-l4-latest-1
10+
- nv
11+
- ubuntu-26.04
12+
- windows-arm64
13+
- wsl-amd64-gpu-rtxpro6000-latest-1
14+
15+
paths:
16+
.github/workflows/windows-msvc.yml:
17+
ignore:
18+
- 'constant expression "false" in condition'

‎.github/codeql/codeql-config.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: OpenShell Rust and SDKs
5+
6+
paths:
7+
- crates
8+
- examples
9+
- sdk/go
10+
- sdk/typescript/src
11+
- python/openshell
12+
13+
paths-ignore:
14+
- python/openshell/_proto
15+
- sdk/typescript/src/gen

‎.github/workflows/codeql.yml‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: CodeQL
5+
6+
on:
7+
pull_request:
8+
merge_group:
9+
types: [checks_requested]
10+
push:
11+
branches: [main]
12+
schedule:
13+
- cron: "29 5 * * 6"
14+
workflow_dispatch:
15+
16+
permissions:
17+
contents: read
18+
security-events: write
19+
20+
concurrency:
21+
group: ${{ github.workflow }}-${{ github.ref }}
22+
cancel-in-progress: true
23+
24+
jobs:
25+
analyze:
26+
name: CodeQL (${{ matrix.language }})
27+
runs-on: ubuntu-latest
28+
timeout-minutes: 90
29+
strategy:
30+
fail-fast: false
31+
matrix:
32+
include:
33+
- language: rust
34+
build-mode: none
35+
- language: go
36+
build-mode: manual
37+
- language: python
38+
build-mode: none
39+
- language: javascript-typescript
40+
build-mode: none
41+
steps:
42+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
43+
with:
44+
persist-credentials: false
45+
46+
- name: Set up Go
47+
if: matrix.language == 'go'
48+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
49+
with:
50+
go-version-file: sdk/go/go.mod
51+
cache-dependency-path: sdk/go/go.sum
52+
53+
- name: Initialize CodeQL
54+
uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
55+
with:
56+
languages: ${{ matrix.language }}
57+
build-mode: ${{ matrix.build-mode }}
58+
config-file: ./.github/codeql/codeql-config.yml
59+
60+
- name: Build Go SDK
61+
if: matrix.language == 'go'
62+
working-directory: sdk/go
63+
run: go build ./...
64+
65+
- name: Analyze
66+
id: analyze
67+
uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
68+
with:
69+
category: /language:${{ matrix.language }}
70+
output: codeql-results
71+
upload: never
72+
73+
- name: Summarize findings
74+
if: always()
75+
env:
76+
LANGUAGE: ${{ matrix.language }}
77+
shell: bash
78+
run: |
79+
set -euo pipefail
80+
shopt -s globstar nullglob
81+
sarif_files=(codeql-results/**/*.sarif)
82+
83+
{
84+
echo "### CodeQL: $LANGUAGE"
85+
echo
86+
if [ "${#sarif_files[@]}" -eq 0 ]; then
87+
echo "No SARIF report was produced."
88+
else
89+
finding_count=$(jq -s '[.[].runs[]?.results[]?] | length' "${sarif_files[@]}")
90+
echo "Findings: $finding_count"
91+
echo
92+
echo "Findings are informational and do not fail CI."
93+
fi
94+
} >> "$GITHUB_STEP_SUMMARY"
95+
96+
- name: Upload SARIF to Code Scanning
97+
if: >-
98+
steps.analyze.outcome == 'success' &&
99+
(github.event_name != 'pull_request' ||
100+
github.event.pull_request.head.repo.full_name == github.repository)
101+
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
102+
with:
103+
sarif_file: codeql-results
104+
category: /language:${{ matrix.language }}
105+
106+
- name: Upload SARIF
107+
if: always()
108+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
109+
with:
110+
name: codeql-${{ matrix.language }}-${{ github.run_id }}
111+
path: codeql-results
112+
if-no-files-found: ignore
113+
retention-days: 14
114+
115+
result:
116+
name: OpenShell / CodeQL (informational)
117+
if: always()
118+
needs: analyze
119+
runs-on: ubuntu-latest
120+
permissions: {}
121+
steps:
122+
- name: Evaluate analyzer execution
123+
env:
124+
ANALYZE_RESULT: ${{ needs.analyze.result }}
125+
shell: bash
126+
run: |
127+
if [ "$ANALYZE_RESULT" != "success" ]; then
128+
echo "::error::One or more CodeQL analyzers did not complete successfully."
129+
exit 1
130+
fi
131+
echo "All CodeQL analyzers completed; findings remain informational."

‎.github/workflows/dependency-review.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Dependency Review
5+
6+
on:
7+
pull_request:
8+
merge_group:
9+
types: [checks_requested]
10+
workflow_dispatch:
11+
inputs:
12+
base_sha:
13+
description: Base commit SHA to compare
14+
required: true
15+
type: string
16+
head_sha:
17+
description: Head commit SHA to compare
18+
required: true
19+
type: string
20+
21+
permissions:
22+
contents: read
23+
24+
concurrency:
25+
group: ${{ github.workflow }}-${{ github.ref }}
26+
cancel-in-progress: true
27+
28+
jobs:
29+
review:
30+
name: Dependency Review (informational)
31+
runs-on: ubuntu-latest
32+
env:
33+
BASE_REF: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || inputs.base_sha }}
34+
HEAD_REF: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha || inputs.head_sha }}
35+
steps:
36+
- name: Check Dependency Graph availability
37+
id: preflight
38+
env:
39+
GH_TOKEN: ${{ github.token }}
40+
shell: bash
41+
run: |
42+
set -euo pipefail
43+
44+
sha_pattern='^([0-9a-fA-F]{40}|[0-9a-fA-F]{64})$'
45+
if [[ ! "$BASE_REF" =~ $sha_pattern || ! "$HEAD_REF" =~ $sha_pattern ]]; then
46+
echo "::error::Dependency Review requires base and head commit SHAs."
47+
exit 2
48+
fi
49+
50+
response_file="$RUNNER_TEMP/dependency-review-preflight.json"
51+
http_status=$(
52+
curl \
53+
--silent \
54+
--show-error \
55+
--output "$response_file" \
56+
--write-out "%{http_code}" \
57+
--header "Accept: application/vnd.github+json" \
58+
--header "Authorization: Bearer $GH_TOKEN" \
59+
--header "X-GitHub-Api-Version: 2022-11-28" \
60+
"$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/dependency-graph/compare/$BASE_REF...$HEAD_REF"
61+
)
62+
63+
case "$http_status" in
64+
200)
65+
echo "available=true" >> "$GITHUB_OUTPUT"
66+
;;
67+
403|404)
68+
echo "available=false" >> "$GITHUB_OUTPUT"
69+
echo "::warning::GitHub Dependency Graph is unavailable (HTTP $http_status); Dependency Review is skipped."
70+
{
71+
echo "### Dependency Review"
72+
echo
73+
echo "GitHub Dependency Graph is unavailable (HTTP $http_status)."
74+
echo "The informational review will start automatically once the repository feature is available."
75+
} >> "$GITHUB_STEP_SUMMARY"
76+
;;
77+
*)
78+
message=$(jq -r '.message // "unknown API error"' "$response_file")
79+
echo "::error::Dependency Graph preflight failed with HTTP $http_status: $message"
80+
exit 1
81+
;;
82+
esac
83+
84+
- name: Review dependency changes
85+
if: steps.preflight.outputs.available == 'true'
86+
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
87+
with:
88+
base-ref: ${{ env.BASE_REF }}
89+
head-ref: ${{ env.HEAD_REF }}
90+
fail-on-severity: high
91+
fail-on-scopes: runtime, development, unknown
92+
warn-only: true
93+
comment-summary-in-pr: never
94+
license-check: false
95+
show-openssf-scorecard: false

0 commit comments

Comments
 (0)