Skip to content

Commit 57f2e77

Browse files
anakrishanakrish
authored
ci: Add CodeQl workflow (microsoft#478)
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
1 parent 4ec9e76 commit 57f2e77

1 file changed

Lines changed: 212 additions & 0 deletions

File tree

‎.github/workflows/codeql.yml‎

Lines changed: 212 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
1+
name: "CodeQL Security Analysis"
2+
3+
on:
4+
schedule:
5+
# Run weekly on Wednesdays at 3:17 AM UTC
6+
- cron: '17 3 * * 3'
7+
workflow_dispatch:
8+
# Allow manual triggering
9+
push:
10+
branches: [ "main" ]
11+
pull_request:
12+
branches: [ "main" ]
13+
14+
jobs:
15+
analyze:
16+
name: Analyze (${{ matrix.language }})
17+
runs-on: ubuntu-latest
18+
timeout-minutes: 60
19+
permissions:
20+
# required for all workflows
21+
security-events: write
22+
# required to fetch internal or private CodeQL packs
23+
packages: read
24+
# only required for workflows in private repositories
25+
actions: read
26+
contents: read
27+
28+
strategy:
29+
fail-fast: false
30+
matrix:
31+
include:
32+
# Rust analysis for main crate and Rust-based bindings
33+
- language: rust
34+
build-mode: none
35+
working-directory: .
36+
# C/C++ analysis for FFI bindings
37+
- language: c-cpp
38+
build-mode: manual
39+
working-directory: bindings/ffi
40+
# Python analysis for Python bindings
41+
- language: python
42+
build-mode: none
43+
working-directory: bindings/python
44+
# Java analysis for Java bindings
45+
- language: java-kotlin
46+
build-mode: manual
47+
working-directory: bindings/java
48+
# Go analysis for Go bindings
49+
- language: go
50+
build-mode: manual
51+
working-directory: bindings/go
52+
# C# analysis for C# bindings
53+
- language: csharp
54+
build-mode: manual
55+
working-directory: bindings/csharp
56+
# JavaScript analysis for WASM bindings
57+
- language: javascript-typescript
58+
build-mode: none
59+
working-directory: bindings/wasm
60+
61+
steps:
62+
- name: Checkout repository
63+
uses: actions/checkout@v4
64+
65+
# Setup language-specific dependencies BEFORE CodeQL init for proper tracing setup
66+
- name: Setup Rust
67+
if: matrix.language == 'rust' || matrix.language == 'c-cpp'
68+
uses: ./.github/actions/toolchains/rust
69+
70+
- name: Setup Python
71+
if: matrix.language == 'python'
72+
uses: actions/setup-python@v5
73+
with:
74+
python-version: '3.10'
75+
76+
- name: Setup Java
77+
if: matrix.language == 'java-kotlin'
78+
uses: actions/setup-java@v4
79+
with:
80+
distribution: 'corretto'
81+
java-version: '8'
82+
83+
- name: Setup Go
84+
if: matrix.language == 'go'
85+
uses: actions/setup-go@v5
86+
with:
87+
go-version: '1.21'
88+
89+
- name: Setup .NET
90+
if: matrix.language == 'csharp'
91+
uses: actions/setup-dotnet@v4
92+
with:
93+
global-json-file: ./bindings/csharp/global.json
94+
95+
- name: Setup Node.js
96+
if: matrix.language == 'javascript-typescript'
97+
uses: actions/setup-node@v4
98+
with:
99+
node-version: '18'
100+
101+
- name: Initialize CodeQL
102+
uses: github/codeql-action/init@v3
103+
with:
104+
languages: ${{ matrix.language }}
105+
build-mode: ${{ matrix.build-mode }}
106+
107+
# Install additional build dependencies
108+
- name: Install system dependencies
109+
if: matrix.language == 'rust' || matrix.language == 'c-cpp'
110+
run: |
111+
sudo apt-get update
112+
sudo apt-get install -y build-essential cmake
113+
114+
- name: Install Python build dependencies
115+
if: matrix.language == 'python'
116+
working-directory: ${{ matrix.working-directory }}
117+
run: |
118+
python -m pip install --upgrade pip
119+
pip install maturin[patchelf] pytest
120+
121+
- name: Setup Ruby
122+
if: matrix.language == 'rust' && contains(matrix.working-directory, 'ruby')
123+
uses: ruby/setup-ruby@v1
124+
with:
125+
ruby-version: '3.4.2'
126+
bundler-cache: true
127+
working-directory: bindings/ruby
128+
129+
- name: Install WASM build dependencies
130+
if: matrix.language == 'javascript-typescript'
131+
run: |
132+
cargo install wasm-pack
133+
134+
# Manual build steps for different languages
135+
- name: Build C/C++ FFI bindings
136+
if: matrix.language == 'c-cpp'
137+
working-directory: ${{ matrix.working-directory }}
138+
run: |
139+
# Build FFI library in no_std mode for embedded/constrained environments
140+
cargo build --release --locked --features "ast,coverage,regorus/opa-no-std" --no-default-features
141+
142+
# Build the Rust FFI library that provides C-compatible interface
143+
cargo build --release --locked
144+
145+
# Build C bindings using CMake
146+
cd ../c
147+
mkdir -p build
148+
cd build
149+
cmake ..
150+
make
151+
152+
# Build C++ bindings using CMake
153+
cd ../../cpp
154+
mkdir -p build
155+
cd build
156+
cmake ..
157+
make
158+
159+
- name: Build Java bindings
160+
if: matrix.language == 'java-kotlin'
161+
working-directory: ${{ matrix.working-directory }}
162+
run: |
163+
# Build the Rust JNI library that provides Java-compatible interface
164+
cargo fetch
165+
cargo build --release --locked
166+
# Compile Java source and create JAR package with Maven
167+
mvn package
168+
169+
- name: Build Go bindings
170+
if: matrix.language == 'go'
171+
working-directory: ${{ matrix.working-directory }}
172+
run: |
173+
# Build the FFI library that Go bindings depend on via CGO
174+
cd ../ffi
175+
cargo fetch
176+
cargo build --release --locked
177+
cd ../go
178+
# Download Go dependencies
179+
go mod tidy
180+
# Set up environment for CGO linking to Rust FFI library
181+
export CGO_ENABLED=1
182+
export LD_LIBRARY_PATH="$(pwd)/../ffi/target/release:$LD_LIBRARY_PATH"
183+
# Build Go packages with verbose output for CodeQL tracing
184+
go build -v ./pkg/regorus
185+
go build -v -o regorus_test .
186+
187+
- name: Build C# bindings
188+
if: matrix.language == 'csharp'
189+
working-directory: ${{ matrix.working-directory }}
190+
run: |
191+
# Build the FFI library that C# bindings access via P/Invoke
192+
cd ../ffi
193+
cargo fetch
194+
cargo build --release --locked
195+
cd ../csharp
196+
# Restore NuGet packages and build .NET assemblies in release mode
197+
# Build the main Regorus library project only (tests require packaged version)
198+
dotnet restore Regorus/Regorus.csproj
199+
dotnet build Regorus/Regorus.csproj --no-restore /p:Configuration=Release /p:IgnoreMissingArtifacts=true
200+
201+
- name: Build WASM bindings
202+
if: matrix.language == 'javascript-typescript'
203+
working-directory: ${{ matrix.working-directory }}
204+
run: |
205+
# Build WebAssembly module with wasm-pack for Node.js target
206+
cargo fetch
207+
wasm-pack build --target nodejs --release
208+
209+
- name: Perform CodeQL Analysis
210+
uses: github/codeql-action/analyze@v3
211+
with:
212+
category: "/language:${{matrix.language}}"

0 commit comments

Comments
 (0)