Skip to content
Merged
Show file tree
Hide file tree
Changes from 66 commits
Commits
Show all changes
72 commits
Select commit Hold shift + click to select a range
d34e7e2
First integration and reorg
dmichalo Oct 10, 2025
c8138a3
Add missing spaces
dmichalo Oct 10, 2025
2a88b71
Fix mistakes
dmichalo Oct 10, 2025
0d364c2
Fix needs
dmichalo Oct 10, 2025
f0a8a76
Fix secrets
dmichalo Oct 10, 2025
76d91ad
Next cleanup
dmichalo Oct 14, 2025
4c0157c
Remove added line by mistake
dmichalo Oct 14, 2025
c6fe635
Fix Trivy action
dmichalo Oct 14, 2025
a09ce27
Next cleanup
dmichalo Oct 14, 2025
f8939ba
Cleanup and adjustments
dmichalo Oct 14, 2025
0001049
Add missing permission
dmichalo Oct 14, 2025
506040c
Add fixes
dmichalo Oct 15, 2025
7f4975c
Fix trivy
dmichalo Oct 15, 2025
6508407
Add missing DLS PS scans
dmichalo Oct 15, 2025
8d7848f
Add common actions improvements
dmichalo Oct 15, 2025
0ac2adc
Fix issues in new code
dmichalo Oct 15, 2025
b486f66
Add next issues with type
dmichalo Oct 15, 2025
264f658
Add more safety checkers
dmichalo Oct 15, 2025
1c65574
Add debug info
dmichalo Oct 15, 2025
616e215
Fix output-file
dmichalo Oct 15, 2025
84aa90c
Change pylint to give one score
dmichalo Oct 15, 2025
f16bcf0
Add debug to code style
dmichalo Oct 15, 2025
1302e84
Add dummy changes + cleanup of debug
dmichalo Oct 15, 2025
72b65f7
Add shell error, improve license hader repo fetch, add license header…
dmichalo Oct 15, 2025
ee89755
Add fixes
dmichalo Oct 15, 2025
91d008e
Fix SHA
dmichalo Oct 15, 2025
ba43a07
Add reports names fixes
dmichalo Oct 15, 2025
e7c99af
Remove unnecessary checkout
dmichalo Oct 15, 2025
5779d49
Improve license
dmichalo Oct 15, 2025
b397ca9
Fix shellcheck
dmichalo Oct 15, 2025
a0cf0c4
Add fixes and and Bandit hit
dmichalo Oct 16, 2025
f11fe92
Update orch-ci
dmichalo Oct 16, 2025
785682a
Fix wrong SHA
dmichalo Oct 16, 2025
9648c9b
Add fail-on-findings + fix bandit wrong param
dmichalo Oct 16, 2025
992a1bf
Update versions of actions
dmichalo Oct 16, 2025
531a873
Update versions of actions
dmichalo Oct 16, 2025
f51eaaf
Add fixes
dmichalo Oct 16, 2025
5b617b4
Fix hadolint
dmichalo Oct 16, 2025
5e41d19
Fix names of ClamAV reports
dmichalo Oct 16, 2025
cf42b44
Fix clamav action to execute
dmichalo Oct 16, 2025
cbaf4e4
Add ClamAV summary
dmichalo Oct 16, 2025
1317933
Add EICAR file to test antivirus
dmichalo Oct 16, 2025
1c14940
Fix ClamAV result
dmichalo Oct 16, 2025
08e86c1
Fix paths of reports for ClamAV
dmichalo Oct 16, 2025
4163651
Fix typo
dmichalo Oct 16, 2025
504bedf
Change ClamAV to not fail
dmichalo Oct 16, 2025
2cec6db
Revert intentional issues for scaners
dmichalo Oct 17, 2025
554d37d
Add fail-on-findings: true in workflows
dmichalo Oct 17, 2025
8dae857
Adjust test dir name and path
dmichalo Oct 17, 2025
0fef0e0
Remove double fail-on-findings
dmichalo Oct 17, 2025
cc03cb7
Add first building of DLS to DLS PS workflow
dmichalo Oct 17, 2025
7fb8540
Add Set up Docker Buildx
dmichalo Oct 17, 2025
4738afb
Fix docker buildx build
dmichalo Oct 17, 2025
606de47
Add cache
dmichalo Oct 17, 2025
e3371f2
Init submodules
dmichalo Oct 17, 2025
c55f371
Fix pull and export in DLS PS
dmichalo Oct 17, 2025
8744b2c
Fix local image
dmichalo Oct 17, 2025
14bbac5
Improve building DLS PS
dmichalo Oct 17, 2025
e73a910
Larger runs-on setup + new DLS PS requirements
dmichalo Oct 17, 2025
78d0191
Add requirements.txt installation
dmichalo Oct 17, 2025
43ce371
Fix wrong requirements.txt
dmichalo Oct 17, 2025
dd51e27
Try to fix DLS PS test
dmichalo Oct 17, 2025
eef40b4
Set JSON type as Trivy report output
dmichalo Oct 20, 2025
4143cdf
Fix trivy reports
dmichalo Oct 20, 2025
41b3b67
Fix Trivy upload
dmichalo Oct 20, 2025
a4a364a
Improve DLS PS Trivy output
dmichalo Oct 20, 2025
32aa168
Split DLS PS and DLS workflows
dmichalo Oct 21, 2025
047c276
Clean up
dmichalo Oct 21, 2025
a62dbd5
Final changes
dmichalo Oct 21, 2025
015453f
Remove extra code
dmichalo Oct 21, 2025
b42fd9d
Update fail-on-findings for Bandit
dmichalo Oct 22, 2025
5cf4422
Merge branch 'main' into dls_dmichalo_IntegrateDlsPsCI
dmichalo Oct 23, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 49 additions & 6 deletions .github/actions/common/code-style/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,14 @@ inputs:
description: "Directory to check for C/C++ files"
required: false
default: "."
name:
description: 'Name for the output artifact'
required: false
default: 'code-style-check-report'
fail-on-findings:
description: "Whether to fail the action if issues are found"
required: false
default: "true"

runs:
using: "composite"
Expand All @@ -19,16 +27,51 @@ runs:
shell: bash

- name: Run code style check
id: code-style-check
env:
target_dir: ${{ inputs.target_dir }}
run: |
chmod +x .github/actions/common/code-style/entrypoint.sh
./.github/actions/common/code-style/entrypoint.sh "${target_dir}"
chmod +x .github/actions/common/code-style/entrypoint.sh
./.github/actions/common/code-style/entrypoint.sh "${target_dir}" || echo "STYLE_ISSUES=true" >> $GITHUB_OUTPUT
shell: bash

- name: Upload clang-format report on failure
if: failure()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #4.6.2
- name: Analyze code style results
if: always()
run: |
if [ "${{ steps.code-style-check.outputs.STYLE_ISSUES }}" == "true" ]; then
# Count number of files with style issues
if [ -f "_output/diff.html" ]; then
# Try to count files from diff output
file_count=$(diff -u --recursive "${{ inputs.target_dir }}" "_styled/${{ inputs.target_dir }}" 2>/dev/null | grep -c "^diff -u" || echo "1+")

echo "### Code Style Check Results" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "- ❌ **Status**: Style issues found" >> $GITHUB_STEP_SUMMARY
echo "- 📁 **Files affected**: ${file_count}" >> $GITHUB_STEP_SUMMARY
echo "- 📄 **Detailed report**: Available in artifacts (diff.html)" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "⚠️ **Please review the code-style report artifact and apply clang-format to fix the issues.**" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "💡 **Tip**: Run \`clang-format -i\` on the affected files to automatically fix formatting." >> $GITHUB_STEP_SUMMARY
fi
else
echo "### Code Style Check Results" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "✅ **All code follows the style guidelines!**" >> $GITHUB_STEP_SUMMARY
fi
shell: bash

- name: Upload clang-format report
if: always()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: code-style-report
name: ${{ inputs.name }}
path: _output/diff.html
if-no-files-found: ignore

- name: Fail if code style issues found
if: inputs.fail-on-findings == 'true' && steps.code-style-check.outputs.STYLE_ISSUES == 'true'
shell: bash
run: |
echo "❌ Code style issues found. Failing the job."
exit 1
81 changes: 77 additions & 4 deletions .github/actions/common/hadolint/action.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,10 @@ inputs:
github_token:
description: GitHub token for ReviewDog
required: false
fail-on-findings:
description: "Whether to fail the action if issues are found"
required: false
default: "true"

runs:
using: "composite"
Expand All @@ -30,15 +34,70 @@ runs:
shell: bash

- name: Run Hadolint
env:
id: run-hadolint
env:
dockerfile: ${{ inputs.dockerfile }}
output-file: ${{ inputs.output-file }}
output_file: ${{ inputs.output-file }}
run: |
hadolint ${dockerfile} \
--format tty \
| tee ${output-file}
2>&1 | tee ${output_file} || true
if [ ! -f "${output_file}" ]; then
echo "No Dockerfile found or hadolint produced no output" > ${output_file}
fi
shell: bash

- name: Analyze Hadolint results
if: always()
env:
output_file: ${{ inputs.output-file }}
name: ${{ inputs.name }}
run: |
if [ -f "${output_file}" ]; then
# Count issues by severity (hadolint format: DL#### or SC#### followed by colored severity)
# Pattern matches: DL3008 or SC1091 (hadolint and shellcheck codes)
error_count=$(grep -E "(DL|SC)[0-9]+" "${output_file}" 2>/dev/null | grep -i "error" | wc -l | tr -d '[:space:]' || echo "0")
warning_count=$(grep -E "(DL|SC)[0-9]+" "${output_file}" 2>/dev/null | grep -i "warning" | wc -l | tr -d '[:space:]' || echo "0")
info_count=$(grep -E "(DL|SC)[0-9]+" "${output_file}" 2>/dev/null | grep -i "info" | wc -l | tr -d '[:space:]' || echo "0")
style_count=$(grep -E "(DL|SC)[0-9]+" "${output_file}" 2>/dev/null | grep -i "style" | wc -l | tr -d '[:space:]' || echo "0")
# Ensure counts are valid integers, default to 0 if empty
error_count=${error_count:-0}
warning_count=${warning_count:-0}
info_count=${info_count:-0}
style_count=${style_count:-0}
# Additional safety check - ensure numeric (use case to validate)
case "$error_count" in ''|*[!0-9]*) error_count=0 ;; esac || true
case "$warning_count" in ''|*[!0-9]*) warning_count=0 ;; esac || true
case "$info_count" in ''|*[!0-9]*) info_count=0 ;; esac || true
case "$style_count" in ''|*[!0-9]*) style_count=0 ;; esac || true
total=$((error_count + warning_count + info_count + style_count)) || total=0

echo "### Hadolint Results for ${name}" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "- **Total Issues**: $total" >> $GITHUB_STEP_SUMMARY

if [ "$error_count" -gt 0 ]; then
echo "- ❌ **Errors**: $error_count" >> $GITHUB_STEP_SUMMARY
fi
if [ "$warning_count" -gt 0 ]; then
echo "- ⚠️ **Warnings**: $warning_count" >> $GITHUB_STEP_SUMMARY
fi
if [ "$info_count" -gt 0 ]; then
echo "- ℹ️ **Info**: $info_count" >> $GITHUB_STEP_SUMMARY
fi
if [ "$style_count" -gt 0 ]; then
echo "- 🎨 **Style**: $style_count" >> $GITHUB_STEP_SUMMARY
fi

if [ "$total" -gt 0 ]; then
echo "" >> $GITHUB_STEP_SUMMARY
echo "⚠️ **Please review the Hadolint report artifact and consider fixing the issues.**" >> $GITHUB_STEP_SUMMARY
else
echo "" >> $GITHUB_STEP_SUMMARY
echo "✅ **No issues found!**" >> $GITHUB_STEP_SUMMARY
fi
fi
shell: bash
continue-on-error: true

- name: Upload Hadolint report as artifact
if: always()
Expand All @@ -55,3 +114,17 @@ runs:
reporter: github-pr-review
level: warning
hadolint_flags: ${{ inputs.dockerfile }}

- name: Fail if Hadolint found issues
if: inputs.fail-on-findings == 'true'
shell: bash
env:
output_file: ${{ inputs.output-file }}
run: |
if [ -f "${output_file}" ]; then
issue_count=$(grep -E "(DL|SC)[0-9]+" "${output_file}" 2>/dev/null | wc -l | tr -d '[:space:]' || echo "0")
if [ "$issue_count" -gt 0 ]; then
echo "❌ Hadolint found $issue_count issue(s). Failing the job."
exit 1
fi
fi
84 changes: 74 additions & 10 deletions .github/actions/common/license-namespace-checker/action.yaml
Original file line number Diff line number Diff line change
@@ -1,20 +1,28 @@
name: 'License and Namespace Checker'
description: 'Checks license headers and namespace usage in headers'
inputs:
name:
description: 'Name for the output artifact'
required: false
default: 'license-namespace-check-report'
path:
description: 'Path to the repository root'
required: false
default: '.'
fail-on-findings:
description: "Whether to fail the action if issues are found"
required: false
default: "true"
runs:
using: 'composite'
steps:
- name: Check out edge-ai-libraries repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #4.2.2
with:
path: edge-ai-libraries-repo
persist-credentials: false
fetch-depth: 0

- name: Get list of changed files
shell: bash
id: discover-changes
env:
REPO_PATH: ${{ inputs.path }}
run: |
cd edge-ai-libraries-repo
cd "${REPO_PATH}"
if [ "$(git rev-parse --abbrev-ref HEAD)" != "main" ]; then
git fetch origin main:main
echo "Fetched main branch"
Expand All @@ -33,12 +41,68 @@ runs:
fi

- name: Check License header and namespace usage in headers
id: license-check
shell: bash
env:
CHANGED_FILES: ${{ steps.discover-changes.outputs.changed_files }}
REPO_PATH: ${{ inputs.path }}
output_file: license-check-report.txt
run: |
if [ -z "${CHANGED_FILES}" ]; then
echo "No new files to scan."
echo "No new files to scan." | tee "${output_file}"
echo "ISSUES_FOUND=false" >> $GITHUB_OUTPUT
else
./.github/actions/common/license-namespace-checker/run.sh . $CHANGED_FILES
if "${GITHUB_ACTION_PATH}/run.sh" "${REPO_PATH}" $CHANGED_FILES 2>&1 | tee "${output_file}"; then
echo "ISSUES_FOUND=false" >> $GITHUB_OUTPUT
else
echo "ISSUES_FOUND=true" >> $GITHUB_OUTPUT
fi
fi

- name: Upload License Check report
if: always()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: ${{ inputs.name }}
path: license-check-report.txt
if-no-files-found: warn

- name: Analyze License Check results
if: always()
shell: bash
env:
output_file: license-check-report.txt
run: |
if [ "${{ steps.license-check.outputs.ISSUES_FOUND }}" == "true" ]; then
# Count files with issues
if [ -f "${output_file}" ]; then
error_count=$(grep -c "Error:" "${output_file}" 2>/dev/null || echo "0")
echo "### License & Namespace Check Results" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "- ❌ **Status**: Issues found" >> $GITHUB_STEP_SUMMARY
echo "- 🔍 **Total errors**: ${error_count}" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "📄 **See job logs for detailed error messages.**" >> $GITHUB_STEP_SUMMARY
fi
elif [ "${{ steps.discover-changes.outputs.changed_files }}" != "" ]; then
echo "### License & Namespace Check Results" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "✅ **All checked files have correct license headers and namespace usage!**" >> $GITHUB_STEP_SUMMARY
else
echo "### License & Namespace Check Results" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "ℹ️ **No relevant files changed - check skipped**" >> $GITHUB_STEP_SUMMARY
fi

- name: Fail if license/namespace issues found
if: inputs.fail-on-findings == 'true' && steps.license-check.outputs.ISSUES_FOUND == 'true'
shell: bash
run: |
echo "❌ License or namespace issues found. Failing the job."
exit 1

- name: Clean up
if: always()
shell: bash
run: |
rm -f license-check-report.txt
Loading
Loading