Skip to content

Commit c2f63de

Browse files
msslulumsslulu
committed
fix:codeql scan
1 parent af0756b commit c2f63de

4 files changed

Lines changed: 154 additions & 86 deletions

File tree

‎.github/codeql/codeql-full-config.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Full CodeQL scan config.
2+
paths-ignore:
3+
- '**/target/'

‎.github/scripts/codeql-matrix.sh‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#!/bin/bash
2+
3+
set -euo pipefail
4+
5+
matrix_entries=""
6+
7+
has_files() {
8+
git ls-files "$@" | grep -q .
9+
}
10+
11+
add_entry() {
12+
local entry="$1"
13+
if [ -n "$matrix_entries" ]; then
14+
matrix_entries="$matrix_entries,$entry"
15+
else
16+
matrix_entries="$entry"
17+
fi
18+
}
19+
20+
if has_files '.github/workflows/*.yml' '.github/workflows/*.yaml'; then
21+
add_entry '{"language":"actions","build-mode":"none"}'
22+
fi
23+
24+
if has_files '*.java'; then
25+
add_entry '{"language":"java-kotlin","build-mode":"autobuild"}'
26+
fi
27+
28+
if has_files '*.js' '*.jsx' '*.ts' '*.tsx' '*.mjs' '*.cjs' '*.vue' '*.html'; then
29+
add_entry '{"language":"javascript-typescript","build-mode":"none"}'
30+
fi
31+
32+
printf '{"include":[%s]}\n' "$matrix_entries"

‎.github/workflows/codeql-full.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: CodeQL Full Scan
2+
3+
on:
4+
schedule:
5+
- cron: '24 15 * * 1'
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: read
10+
security-events: write
11+
packages: read
12+
actions: read
13+
14+
jobs:
15+
detect:
16+
name: Detect CodeQL languages
17+
runs-on: ubuntu-latest
18+
outputs:
19+
matrix: ${{ steps.matrix.outputs.matrix }}
20+
steps:
21+
- name: Checkout repository
22+
uses: actions/checkout@v4
23+
with:
24+
fetch-depth: 0
25+
26+
- name: Build matrix
27+
id: matrix
28+
shell: bash
29+
run: |
30+
matrix=$(bash .github/scripts/codeql-matrix.sh)
31+
printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
32+
33+
analyze:
34+
needs: detect
35+
name: Full scan (${{ matrix.language }})
36+
runs-on: ubuntu-latest
37+
strategy:
38+
fail-fast: false
39+
matrix: ${{ fromJSON(needs.detect.outputs.matrix) }}
40+
41+
steps:
42+
- name: Checkout repository
43+
uses: actions/checkout@v4
44+
with:
45+
fetch-depth: 0
46+
47+
- name: Set up JDK 17
48+
if: matrix.language == 'java-kotlin'
49+
uses: actions/setup-java@v5
50+
with:
51+
java-version: '17'
52+
distribution: 'temurin'
53+
cache: maven
54+
55+
- name: Initialize CodeQL
56+
uses: github/codeql-action/init@v4
57+
with:
58+
languages: ${{ matrix.language }}
59+
build-mode: ${{ matrix.build-mode }}
60+
config-file: ./.github/codeql/codeql-full-config.yml
61+
62+
- name: Build project
63+
if: matrix.language == 'java-kotlin'
64+
run: mvn -B clean test-compile -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true -Dspotbugs.skip=true -Dcpd.skip=true
65+
66+
- name: Perform CodeQL Analysis
67+
uses: github/codeql-action/analyze@v4
68+
with:
69+
category: "/codeql-full:${{ matrix.language }}"

‎.github/workflows/codeql.yml‎

Lines changed: 50 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -1,102 +1,66 @@
1-
# For most projects, this workflow file will not need changing; you simply need
2-
# to commit it to your repository.
3-
#
4-
# You may wish to alter this file to override the set of languages analyzed,
5-
# or to provide custom queries or build logic.
6-
#
7-
# ******** NOTE ********
8-
# We have attempted to detect the languages in your repository. Please check
9-
# the `language` matrix defined below to confirm you have the correct set of
10-
# supported CodeQL languages.
11-
#
12-
name: "CodeQL Advanced"
1+
name: CodeQL Incremental
132

143
on:
154
push:
165
branches: [ "develop" ]
176
pull_request:
187
branches: [ "develop" ]
19-
schedule:
20-
- cron: '24 15 * * 1'
218

22-
jobs:
23-
analyze:
24-
name: Analyze (${{ matrix.language }})
25-
# Runner size impacts CodeQL analysis time. To learn more, please see:
26-
# - https://gh.io/recommended-hardware-resources-for-running-codeql
27-
# - https://gh.io/supported-runners-and-hardware-resources
28-
# - https://gh.io/using-larger-runners (GitHub.com only)
29-
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
30-
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
31-
permissions:
32-
# required for all workflows
33-
security-events: write
9+
permissions:
10+
contents: read
11+
security-events: write
12+
packages: read
13+
actions: read
3414

35-
# required to fetch internal or private CodeQL packs
36-
packages: read
15+
jobs:
16+
detect:
17+
name: Detect CodeQL languages
18+
runs-on: ubuntu-latest
19+
outputs:
20+
matrix: ${{ steps.matrix.outputs.matrix }}
21+
steps:
22+
- name: Checkout repository
23+
uses: actions/checkout@v4
24+
with:
25+
fetch-depth: 0
3726

38-
# only required for workflows in private repositories
39-
actions: read
40-
contents: read
27+
- name: Build matrix
28+
id: matrix
29+
shell: bash
30+
run: |
31+
matrix=$(bash .github/scripts/codeql-matrix.sh)
32+
printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
4133
34+
analyze:
35+
needs: detect
36+
name: Analyze (${{ matrix.language }})
37+
runs-on: ubuntu-latest
4238
strategy:
4339
fail-fast: false
44-
matrix:
45-
include:
46-
- language: actions
47-
build-mode: none
48-
- language: java-kotlin
49-
build-mode: autobuild # This mode only analyzes Java. Set this to 'autobuild' or 'manual' to analyze Kotlin too.
50-
# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
51-
# Use `c-cpp` to analyze code written in C, C++ or both
52-
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
53-
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
54-
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
55-
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
56-
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
57-
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
58-
steps:
59-
- name: Checkout repository
60-
uses: actions/checkout@v4
40+
matrix: ${{ fromJSON(needs.detect.outputs.matrix) }}
6141

62-
# Add any setup steps before running the `github/codeql-action/init` action.
63-
# This includes steps like installing compilers or runtimes (`actions/setup-node`
64-
# or others). This is typically only required for manual builds.
65-
# - name: Setup runtime (example)
66-
# uses: actions/setup-example@v1
67-
68-
# Initializes the CodeQL tools for scanning.
69-
- name: Initialize CodeQL
70-
uses: github/codeql-action/init@v4
71-
with:
72-
languages: ${{ matrix.language }}
73-
build-mode: ${{ matrix.build-mode }}
74-
config-file: ./.github/codeql/codeql-config.yml
75-
# If you wish to specify custom queries, you can do so here or in a config file.
76-
# By default, queries listed here will override any specified in a config file.
77-
# Prefix the list here with "+" to use these queries and those in the config file.
42+
steps:
43+
- name: Checkout repository
44+
uses: actions/checkout@v4
45+
with:
46+
fetch-depth: 0
7847

79-
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
80-
# queries: security-extended,security-and-quality
48+
- name: Set up JDK 17
49+
if: matrix.language == 'java-kotlin'
50+
uses: actions/setup-java@v5
51+
with:
52+
java-version: '17'
53+
distribution: 'temurin'
54+
cache: maven
8155

82-
# If the analyze step fails for one of the languages you are analyzing with
83-
# "We were unable to automatically build your code", modify the matrix above
84-
# to set the build mode to "manual" for that language. Then modify this step
85-
# to build your code.
86-
# ℹ️ Command-line programs to run using the OS shell.
87-
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
88-
- name: Run manual build steps
89-
if: matrix.build-mode == 'manual'
90-
shell: bash
91-
run: |
92-
echo 'If you are using a "manual" build mode for one or more of the' \
93-
'languages you are analyzing, replace this with the commands to build' \
94-
'your code, for example:'
95-
echo ' make bootstrap'
96-
echo ' make release'
97-
exit 1
56+
- name: Initialize CodeQL
57+
uses: github/codeql-action/init@v4
58+
with:
59+
languages: ${{ matrix.language }}
60+
build-mode: ${{ matrix.build-mode }}
61+
config-file: ./.github/codeql/codeql-config.yml
9862

99-
- name: Perform CodeQL Analysis
100-
uses: github/codeql-action/analyze@v4
101-
with:
102-
category: "/language:${{matrix.language}}"
63+
- name: Perform CodeQL Analysis
64+
uses: github/codeql-action/analyze@v4
65+
with:
66+
category: "/codeql-incremental:${{ matrix.language }}"

0 commit comments

Comments
 (0)