Skip to content

Commit aa9ff84

Browse files
roshan-kudmkarthi
roshan-ku
and
dmkarthi
authored
Workflows fixes and cpp scans (#4)
* Add cppcheck composite action and integrate into all workflows * Fix workflow security findings: pin actions, restrict permissions, secure GITHUB_ENV * Remove workflow scan report * ci: fix zizmor security findings - coverity: remove GITHUB_ENV write; resolve MTL pkg-config path inline using export to eliminate environment file injection risk - cppcheck: fix report dir to use GITHUB_WORKSPACE/reports/ so cppcheck results are included in the uploaded artifact - ci/daily_build/pull_request: move permissions block from workflow level to job level for tighter token scoping --------- Co-authored-by: D M, Karthik <karthik.d.m@intel.com>
1 parent 7ed1126 commit aa9ff84

6 files changed

Lines changed: 60 additions & 24 deletions

File tree

‎.github/actions/analysis/coverity/action.yml‎

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -9,26 +9,22 @@ description: 'Run Coverity static analysis (assumes Coverity pre-installed on ru
99
runs:
1010
using: composite
1111
steps:
12-
- name: Set up MTL environment
12+
- name: Coverity Scan
1313
shell: bash
1414
run: |
15-
if pkg-config --exists mtl 2>/dev/null; then
16-
echo "MTL already discoverable via pkg-config"
17-
exit 0
18-
fi
19-
MTL_PC=$(find /usr /home /opt -name "mtl.pc" 2>/dev/null | head -1)
20-
if [ -z "$MTL_PC" ]; then
21-
echo "ERROR: MTL pkg-config file not found under /usr, /home, or /opt."
22-
echo "Please ensure Media Transport Library is built and installed on the runner."
23-
exit 1
15+
# Resolve MTL pkg-config path without writing to GITHUB_ENV
16+
if ! pkg-config --exists mtl 2>/dev/null; then
17+
MTL_PC=$(find /usr /home /opt -name "mtl.pc" 2>/dev/null | head -1)
18+
if [ -z "$MTL_PC" ]; then
19+
echo "ERROR: MTL pkg-config file not found under /usr, /home, or /opt."
20+
echo "Please ensure Media Transport Library is built and installed on the runner."
21+
exit 1
22+
fi
23+
MTL_PC_DIR=$(dirname "$MTL_PC")
24+
echo "Found MTL pkgconfig at: $MTL_PC_DIR"
25+
export PKG_CONFIG_PATH="${MTL_PC_DIR}:${PKG_CONFIG_PATH:-}"
2426
fi
25-
MTL_PC_DIR=$(dirname "$MTL_PC")
26-
echo "Found MTL pkgconfig at: $MTL_PC_DIR"
27-
echo "PKG_CONFIG_PATH=${MTL_PC_DIR}:${PKG_CONFIG_PATH}" >> "$GITHUB_ENV"
2827
29-
- name: Coverity Scan
30-
shell: bash
31-
run: |
3228
cd "$GITHUB_WORKSPACE"
3329
REPORT_DIR="$GITHUB_WORKSPACE/reports"
3430
mkdir -p "$REPORT_DIR"

‎.github/actions/analysis/cppcheck/action.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#
2+
# BSD 3-Clause License
3+
# Copyright (C) 2026 Intel Corporation
4+
# SPDX-License-Identifier: BSD-3-Clause
5+
#
6+
name: 'cppcheck'
7+
description: 'Run cppcheck static analysis'
8+
9+
runs:
10+
using: composite
11+
steps:
12+
- name: cppcheck
13+
shell: bash
14+
run: |
15+
REPORT_DIR="$GITHUB_WORKSPACE/reports"
16+
mkdir -p "$REPORT_DIR"
17+
echo "===== cppcheck Static Analysis ====="
18+
cppcheck \
19+
--enable=warning,style,performance,portability \
20+
--std=c11 --force --inline-suppr \
21+
--suppress=missingIncludeSystem \
22+
-Iinclude src 2>&1 | tee "$REPORT_DIR/cppcheck-report.txt" || true
23+
echo "cppcheck scan complete. Report: $REPORT_DIR/cppcheck-report.txt"

‎.github/actions/environment-check/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ runs:
5454
run: |
5555
echo "===== Analysis Tools Check ====="
5656
MISSING=""
57-
for TOOL in shellcheck; do
57+
for TOOL in shellcheck cppcheck; do
5858
if command -v "$TOOL" &>/dev/null; then
5959
echo " [OK] $TOOL ($(command -v "$TOOL"))"
6060
else

‎.github/workflows/ci.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,20 @@ jobs:
1818
ci:
1919
name: Continuous Integration
2020
runs-on: self-hosted
21+
permissions:
22+
contents: read
2123
steps:
2224
- name: Clean up previous run
2325
run: |
2426
find "${{ github.workspace }}" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
2527
rm -rf /tmp/trivy-*
2628
2729
- name: Checkout repository
28-
uses: actions/checkout@v4
30+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2931
with:
3032
ref: ${{ github.sha }}
3133
fetch-depth: 0
34+
persist-credentials: false
3235

3336
- name: Environment check
3437
uses: ./.github/actions/environment-check
@@ -45,14 +48,17 @@ jobs:
4548
- name: ShellCheck
4649
uses: ./.github/actions/analysis/shellcheck
4750

51+
- name: cppcheck
52+
uses: ./.github/actions/analysis/cppcheck
53+
4854
- name: Coverity Scan
4955
uses: ./.github/actions/analysis/coverity
5056

5157
- name: Trivy Scan
5258
uses: ./.github/actions/analysis/trivy
5359

5460
- name: Upload all reports
55-
uses: actions/upload-artifact@v4
61+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
5662
if: always()
5763
with:
5864
name: all-scan-reports-${{ github.run_id }}

‎.github/workflows/daily_build.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,9 @@ on:
1818
jobs:
1919
build:
2020
name: Daily Build
21-
2221
runs-on: self-hosted
22+
permissions:
23+
contents: read
2324

2425
steps:
2526
- name: Clean up previous run
@@ -28,10 +29,11 @@ jobs:
2829
find "${{ github.workspace }}" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
2930
3031
- name: Checkout repository
31-
uses: actions/checkout@v4
32+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3233
with:
3334
ref: ${{ github.sha }}
3435
fetch-depth: 0
36+
persist-credentials: false
3537

3638
- name: Environment check
3739
uses: ./.github/actions/environment-check
@@ -48,14 +50,17 @@ jobs:
4850
- name: ShellCheck
4951
uses: ./.github/actions/analysis/shellcheck
5052

53+
- name: cppcheck
54+
uses: ./.github/actions/analysis/cppcheck
55+
5156
- name: Coverity Scan
5257
uses: ./.github/actions/analysis/coverity
5358

5459
- name: Trivy Scan
5560
uses: ./.github/actions/analysis/trivy
5661

5762
- name: Upload daily build reports
58-
uses: actions/upload-artifact@v4
63+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
5964
if: always()
6065
with:
6166
name: dvledtx-build-artifacts-${{ github.run_id }}

‎.github/workflows/pull_request.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,17 +21,20 @@ jobs:
2121
pull-request:
2222
name: Pull Request
2323
runs-on: self-hosted
24+
permissions:
25+
contents: read
2426

2527
steps:
2628
- name: Clean up previous run
2729
run: |
2830
find "${{ github.workspace }}" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
2931
3032
- name: Checkout repository
31-
uses: actions/checkout@v4
33+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3234
with:
3335
ref: ${{ github.event.pull_request.head.sha || github.sha }}
3436
fetch-depth: 0
37+
persist-credentials: false
3538

3639
- name: Environment check
3740
uses: ./.github/actions/environment-check
@@ -48,14 +51,17 @@ jobs:
4851
- name: ShellCheck
4952
uses: ./.github/actions/analysis/shellcheck
5053

54+
- name: cppcheck
55+
uses: ./.github/actions/analysis/cppcheck
56+
5157
- name: Coverity Scan
5258
uses: ./.github/actions/analysis/coverity
5359

5460
- name: Trivy Scan
5561
uses: ./.github/actions/analysis/trivy
5662

5763
- name: Upload PR reports
58-
uses: actions/upload-artifact@v4
64+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
5965
if: always()
6066
with:
6167
name: dvledtx-pr-artifacts-${{ github.run_id }}

0 commit comments

Comments
 (0)