Extract SARIF upload to separate workflow and improve C++ flags

.github/scripts/ossf-sarif-generator.es

@@ -25,28 +25,30 @@
 
 main([CompilerFlagsJson]) ->
     io:format(standard_error,"~p",[os:env()]),
-    CFLAGS = proplists:get_value(cflags, erlang:system_info(compile_info)) ++ " " ++ os:getenv("SKIPPED_OSSF_CFLAGS"),
-    LDFLAGS = proplists:get_value(ldflags, erlang:system_info(compile_info)) ++ " " ++ os:getenv("SKIPPED_OSSF_LDFLAGS"),
+    CFLAGS = proplists:get_value(cflags, erlang:system_info(compile_info)) ++ " " ++ os:getenv("SKIPPED_OSSF_CFLAGS", ""),
+    CXXFLAGS = proplists:get_value(cxxflags, erlang:system_info(compile_info)) ++ " " ++ os:getenv("SKIPPED_OSSF_CXXFLAGS", ""),
+    LDFLAGS = proplists:get_value(ldflags, erlang:system_info(compile_info)) ++ " " ++ os:getenv("SKIPPED_OSSF_LDFLAGS", ""),
     {gnuc, {Vsn, _, _} } = erlang:system_info(c_compiler_used),
     #{ ~"options" := #{ ~"recommended" := Opts } } = json:decode(unicode:characters_to_binary(CompilerFlagsJson)),
-    io:format(standard_error, ~s'CFLAGS="~ts"~nLDFLAGS="~ts"~n',[CFLAGS, LDFLAGS]),
-    Missing = [Opt || Opt <- Opts, check_option(Opt, string:split(CFLAGS, " ", all), string:split(LDFLAGS, " ", all), Vsn)],
+    io:format(standard_error, ~s'CFLAGS="~ts"~nCXXFLAGS="~ts"~nLDFLAGS="~ts"~n',[CFLAGS, CXXFLAGS, LDFLAGS]),
+    Missing = [Opt || Opt <- Opts, check_option(Opt, string:split(CFLAGS, " ", all), string:split(CXXFLAGS, " ", all), string:split(LDFLAGS, " ", all), Vsn)],
     io:format("~ts~n",[sarif(Missing)]),
     ok.
-check_option(#{ ~"requires" := #{ ~"gcc" := GccVsn }, ~"opt" := Opt }, CFLAGS, _LDFLAGS, CurrentGccVsn) ->
+
+check_option(#{ ~"requires" := #{ ~"gcc" := GccVsn }, ~"opt" := Opt }, CFLAGS, _CXXFLAGS, _LDFLAGS, CurrentGccVsn) ->
     io:format(standard_error, "Looking for ~ts...",[Opt]),
     case binary_to_integer(hd(string:split(GccVsn, "."))) > CurrentGccVsn of
         true -> io:format(standard_error, "skipped!~n",[]), false;
         false ->
             check_for_flags(Opt, CFLAGS)
     end;
-check_option(#{ ~"requires" := #{ ~"binutils" := _ }, ~"opt" := Opt }, _CFLAGS, LDFLAGS, _CurrentGccVsn) ->
+check_option(#{ ~"requires" := #{ ~"binutils" := _ }, ~"opt" := Opt }, _CFLAGS, _CXXFLAGS,LDFLAGS, _CurrentGccVsn) ->
     io:format(standard_error, "Looking for ~ts...",[Opt]),
     check_for_flags(Opt, LDFLAGS);
-check_option(#{ ~"requires" := #{ ~"libstdc++" := _ }, ~"opt" := Opt }, _CFLAGS, LDFLAGS, _CurrentGccVsn) ->
+check_option(#{ ~"requires" := #{ ~"libstdc++" := _ }, ~"opt" := Opt }, _CFLAGS, CXXFLAGS, LDFLAGS, _CurrentGccVsn) ->
     io:format(standard_error, "Looking for ~ts...",[Opt]),
-    check_for_flags(Opt, LDFLAGS);
-check_option(#{ ~"requires" := Tool, ~"opt" := Opt }, _CFLAGS, _LDFLAGS, _CurrentGccVsn) ->
+    check_for_flags(Opt, CXXFLAGS ++ LDFLAGS);
+check_option(#{ ~"requires" := Tool, ~"opt" := Opt }, _CFLAGS, _CXXFLAGS, _LDFLAGS, _CurrentGccVsn) ->
     io:format(standard_error, "~ts not implemented yet using ~p!~n",[Opt, Tool]),
     true.
 
@@ -86,7 +88,7 @@ sarif(Missing) ->
                  ~"artifacts" =>
                      [ #{
                          ~"location" => #{
-                                          ~"uri" => ~".github/docker/Dockerfile.64-bit"
+                                          ~"uri" => ~".github/dockerfiles/Dockerfile.64-bit"
                                          },
                          ~"length" => -1
                         }
@@ -100,9 +102,9 @@ sarif(Missing) ->
                          ~"locations" =>
                              [ #{ ~"physicalLocation" =>
                                       #{ ~"artifactLocation" =>
-                                             #{ ~"uri" => ~".github/docker/Dockerfile.64-bit" }
+                                             #{ ~"uri" => ~".github/dockerfiles/Dockerfile.64-bit" }
                                        }
                                 } ]
                         } || {Id, #{ ~"opt" := Opt }} <- Zip]
                 } ]
-       }).
+       }).

.github/workflows/main.yaml

@@ -307,21 +307,6 @@ jobs:
           name: Event File
           path: ${{ github.event_path }}
 
-  # Zizmor is a GitHub Actions security linter.
-  # See: https://docs.zizmor.sh/
-  zizmor:
-    name: Zizmor
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
-        with:
-          persist-credentials: false
-      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # ratchet:zizmorcore/zizmor-action@v0.5.2
-
   # This job checks that the most important jobs are successful.
   # the use of conditionals, e.g., `if:` at the job level makes
   # the jobs included in the GH Settngs Ruleset to fail.
@@ -347,7 +332,6 @@ jobs:
       - test
       - system-test
       - sbom
-      - zizmor
     steps:
       - name: Check Ruleset Results
         shell: bash

.github/workflows/ossf-compiler-flags-scanner.yaml

@@ -28,13 +28,12 @@ on:
   schedule:
     - cron: 0 1 * * *
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   schedule-scan:
     runs-on: ubuntu-latest
-    if: github.repository == 'erlang/otp'
+    if: github.repository == 'erlang/otp' || github.event_name == 'workflow_dispatch'
     permissions:
       # Required to upload SARIF file to CodeQL.
       # See: https://github.com/github/codeql-action/issues/2117
@@ -47,12 +46,44 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
         with:
           persist-credentials: false
+
       - name: Create initial pre-release tar
         run: .github/scripts/init-pre-release.sh otp_src.tar.gz
+
       - uses: ./.github/actions/build-base-image
         with:
           BASE_BRANCH: master
 
-      - uses: ./.github/actions/ossf-compiler-flags-scanner
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+        with:
+            repository: ossf/wg-best-practices-os-developers
+            sparse-checkout: docs/Compiler-Hardening-Guides/compiler-options-scraper
+            path: ossf
+            persist-credentials: false
+
+      - name: Setup compiler options scraper
+        shell: bash -eo pipefail {0}
+        run: |
+          pip3 install -r ossf/docs/Compiler-Hardening-Guides/compiler-options-scraper/requirements.txt
+          python3 ossf/docs/Compiler-Hardening-Guides/compiler-options-scraper/main.py
+          cat compiler-options.json
+
+      - name: Run compiler flag comparison
+        shell: bash -eo pipefail {0}
+        run: |
+          docker run -v `pwd`/.github/scripts:/github --entrypoint "" otp \
+            bash -c "/github/ossf-sarif-generator.es '$(cat compiler-options.json)'" > results.sarif
+
+      - name: "Upload artifact"
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+            name: SARIF file
+            path: results.sarif
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        if: ${{ !cancelled() }}
+        uses: github/codeql-action/upload-sarif@2d6b98c7cf7260afd6954ee7de478b21127b40f4 # ratchet:github/codeql-action/upload-sarif@v3.29.7
         with:
-            upload: true
+            sarif_file: results.sarif

.github/workflows/reusable-static-analysis.yaml

@@ -37,7 +37,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      security-events: write   # needed for SARIF upload
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
         with:
@@ -53,7 +52,3 @@ jobs:
         ## Run dialyzer
       - name: Run dialyzer
         run: docker run -v $PWD/:/github otp '/github/scripts/run-dialyzer'
-      - name: Check OSSF compiler flags
-        uses: ./.github/actions/ossf-compiler-flags-scanner
-        with:
-          upload: ${{ github.repository == 'erlang/otp' || github.event_name != 'push' }}

.github/workflows/zizmor.yaml

@@ -0,0 +1,54 @@
+## %CopyrightBegin%
+##
+## SPDX-License-Identifier: Apache-2.0
+##
+## Copyright Ericsson AB 2024-2026. All Rights Reserved.
+##
+## Licensed under the Apache License, Version 2.0 (the "License");
+## you may not use this file except in compliance with the License.
+## You may obtain a copy of the License at
+##
+##     http://www.apache.org/licenses/LICENSE-2.0
+##
+## Unless required by applicable law or agreed to in writing, software
+## distributed under the License is distributed on an "AS IS" BASIS,
+## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+## See the License for the specific language governing permissions and
+## limitations under the License.
+##
+## %CopyrightEnd%
+
+##
+## Runs the zizmor GitHub Actions security linter and uploads its findings
+## to code scanning. Kept in its own workflow so its tool status reflects
+## only the linter, not the result of the main build.
+##
+
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+  pull_request:
+
+## We cancel any multiple runs from PRs, while runs from tags/branches are allowed
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  # Zizmor is a GitHub Actions security linter.
+  # See: https://docs.zizmor.sh/
+  zizmor:
+    name: Zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # ratchet:zizmorcore/zizmor-action@v0.5.2