Skip to content

Commit 2b43f8c

Browse files
AlexanderBarabanovAlexanderBarabanov
authored
chore(ci): enable CodeQL and Scorecards (open-edge-platform#789)
Signed-off-by: Barabanov, Alexander <alexander.barabanov@intel.com>
1 parent cbc2ab2 commit 2b43f8c

15 files changed

Lines changed: 176 additions & 71 deletions

‎.github/workflows/backend.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
type: string
88
required: true
99
workflow_dispatch:
10+
11+
permissions: {} # No permissions by default
12+
1013
jobs:
1114
component-check:
1215
name: Backend workflow
@@ -24,7 +27,7 @@ jobs:
2427
- name: Install dependencies
2528
uses: ./.github/actions/install-dependencies
2629
with:
27-
uv-cache-dependency-glob: 'application/backend/uv.lock'
30+
uv-cache-dependency-glob: "application/backend/uv.lock"
2831

2932
- name: Lint backend
3033
working-directory: application/backend

‎.github/workflows/build-images-comment.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,4 +122,3 @@ jobs:
122122
123123
**Result** :x: The build failed.
124124
[Check the logs](https://github.com/open-edge-platform/instant-learn/actions/runs/${{ github.run_id }}) for the details.
125-

‎.github/workflows/codeql.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: "CodeQL scan"
2+
3+
on:
4+
schedule:
5+
- cron: "0 0 * * *"
6+
push:
7+
branches: ["main", "release/**"]
8+
pull_request:
9+
branches: ["main", "release/**"]
10+
11+
permissions: {}
12+
13+
jobs:
14+
analyze:
15+
name: Analyze (${{ matrix.language }})
16+
runs-on: ubuntu-latest
17+
permissions:
18+
security-events: write # required to publish sarif
19+
20+
strategy:
21+
fail-fast: false
22+
matrix:
23+
include:
24+
- language: actions
25+
build-mode: none
26+
- language: python
27+
build-mode: none
28+
- language: javascript-typescript
29+
build-mode: none
30+
- language: rust
31+
build-mode: none
32+
steps:
33+
- name: Checkout repository
34+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
35+
with:
36+
persist-credentials: false
37+
38+
- name: Initialize CodeQL
39+
uses: github/codeql-action/init@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
40+
with:
41+
languages: ${{ matrix.language }}
42+
build-mode: ${{ matrix.build-mode }}
43+
queries: security-extended
44+
45+
- name: Perform CodeQL Analysis
46+
uses: github/codeql-action/analyze@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
47+
with:
48+
category: "/language:${{matrix.language}}"

‎.github/workflows/collect-license.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,16 @@ name: Collect License Information
22

33
on:
44
workflow_dispatch:
5-
permissions:
6-
contents: read
5+
6+
permissions: {} # No permissions by default
7+
78

89
jobs:
910
collect-sbom-container-image:
1011
name: Generate SBOM with Syft
1112
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
1215
strategy:
1316
matrix:
1417
ai-device: [cpu, cuda, xpu]
@@ -89,6 +92,8 @@ jobs:
8992
collect-sbom-library:
9093
name: Collect Library Licenses
9194
runs-on: ubuntu-latest
95+
permissions:
96+
contents: read
9297
steps:
9398
- name: Checkout repository
9499
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/collect-source.yml‎

Lines changed: 41 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
- name: Install dependencies
2525
uses: ./.github/actions/install-dependencies
2626
with:
27-
cleanup-runner: 'true'
27+
cleanup-runner: "true"
2828

2929
- name: Build docker image
3030
working-directory: application
@@ -99,43 +99,43 @@ jobs:
9999
container:
100100
image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
101101
steps:
102-
- name: Add apt sources for deb-src
103-
shell: bash
104-
run: |
105-
sed -Ei "s/^Types: deb$/Types: deb deb-src/" /etc/apt/sources.list.d/debian.sources
106-
apt-get update
107-
108-
- name: Find GPL/MPL licensed packages
109-
shell: bash
110-
env:
111-
PACKAGES: ${{ needs.get-unique-names.outputs.unique_package_names_oneline }}
112-
run: |
113-
OUTPUT_DIR="output"
114-
ARCHIVE_NAME="source_code.tar.gz"
115-
mkdir -p "$OUTPUT_DIR"
116-
cd "$OUTPUT_DIR"
117-
# Split comma-separated list into an array
118-
IFS=',' read -r -a PACKAGES_ARR <<< "$PACKAGES"
119-
# Collect missing packages
120-
# Install GNU Parallel for faster downloads
121-
apt-get update && apt-get install -y parallel
122-
123-
# Download sources for GPL/MPL packages in parallel with error handling
124-
if [ ${#PACKAGES_ARR[@]} -gt 0 ]; then
125-
export OUTPUT_DIR
126-
printf "%s\n" "${PACKAGES_ARR[@]}" | parallel --jobs 4 '
127-
echo "Downloading source for {}"
128-
if ! apt-get source -q --download-only "{}"; then
129-
echo "Warning: Source not available for {}" >&2
130-
fi
131-
'
132-
fi
133-
cd ..
134-
tar -czf "$ARCHIVE_NAME" -C "$OUTPUT_DIR" .
135-
136-
- name: Upload source code archive
137-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
138-
with:
139-
name: source-code-archive
140-
path: source_code.tar.gz
141-
retention-days: 3
102+
- name: Add apt sources for deb-src
103+
shell: bash
104+
run: |
105+
sed -Ei "s/^Types: deb$/Types: deb deb-src/" /etc/apt/sources.list.d/debian.sources
106+
apt-get update
107+
108+
- name: Find GPL/MPL licensed packages
109+
shell: bash
110+
env:
111+
PACKAGES: ${{ needs.get-unique-names.outputs.unique_package_names_oneline }}
112+
run: |
113+
OUTPUT_DIR="output"
114+
ARCHIVE_NAME="source_code.tar.gz"
115+
mkdir -p "$OUTPUT_DIR"
116+
cd "$OUTPUT_DIR"
117+
# Split comma-separated list into an array
118+
IFS=',' read -r -a PACKAGES_ARR <<< "$PACKAGES"
119+
# Collect missing packages
120+
# Install GNU Parallel for faster downloads
121+
apt-get update && apt-get install -y parallel
122+
123+
# Download sources for GPL/MPL packages in parallel with error handling
124+
if [ ${#PACKAGES_ARR[@]} -gt 0 ]; then
125+
export OUTPUT_DIR
126+
printf "%s\n" "${PACKAGES_ARR[@]}" | parallel --jobs 4 '
127+
echo "Downloading source for {}"
128+
if ! apt-get source -q --download-only "{}"; then
129+
echo "Warning: Source not available for {}" >&2
130+
fi
131+
'
132+
fi
133+
cd ..
134+
tar -czf "$ARCHIVE_NAME" -C "$OUTPUT_DIR" .
135+
136+
- name: Upload source code archive
137+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
138+
with:
139+
name: source-code-archive
140+
path: source_code.tar.gz
141+
retention-days: 3

‎.github/workflows/daily.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
name: daily
22
on:
33
schedule:
4-
- cron: '0 0 * * *' # Run every day at midnight UTC
4+
- cron: "0 0 * * *" # Run every day at midnight UTC
55
workflow_dispatch:
66

7+
permissions: {} # No permissions by default
8+
79
jobs:
810
build-parameters:
911
name: Prepare build parameters

‎.github/workflows/distrib.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ on:
2424
default: '["cpu","cuda","xpu"]'
2525
required: false
2626

27+
permissions: {} # No permissions by default
28+
2729
jobs:
2830
component-check:
2931
name: Distrib workflow
@@ -54,8 +56,8 @@ jobs:
5456
- name: Install dependencies
5557
uses: ./.github/actions/install-dependencies
5658
with:
57-
uv-cache-dependency-glob: 'application/backend/uv.lock'
58-
cleanup-runner: 'true'
59+
uv-cache-dependency-glob: "application/backend/uv.lock"
60+
cleanup-runner: "true"
5961

6062
- name: Build docker image for ${{ matrix.ai-device }}
6163
working-directory: application

‎.github/workflows/library.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
type: string
88
required: true
99
workflow_dispatch:
10+
11+
permissions: {} # No permissions by default
12+
1013
jobs:
1114
component-check:
1215
name: Library workflow
@@ -24,7 +27,7 @@ jobs:
2427
- name: Install dependencies
2528
uses: ./.github/actions/install-dependencies
2629
with:
27-
uv-cache-dependency-glob: 'library/uv.lock'
30+
uv-cache-dependency-glob: "library/uv.lock"
2831

2932
- name: Lint library
3033
working-directory: library

‎.github/workflows/main.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,11 +94,11 @@ jobs:
9494

9595
- uses: DavidAnson/markdownlint-cli2-action@07035fd053f7be764496c0f8d8f9f41f98305101 #v22.0.0
9696
with:
97-
config: '.github/.markdownlint-cli2.jsonc'
97+
config: ".github/.markdownlint-cli2.jsonc"
9898

9999
success:
100100
name: Status checks
101-
needs: [ build-parameters, library, backend, ui, distrib, markdown ]
101+
needs: [build-parameters, library, backend, ui, distrib, markdown]
102102
runs-on: ubuntu-latest
103103
if: ${{ always() && !cancelled() }}
104104
env:

‎.github/workflows/renovate-config-validator.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,7 @@ on:
1717
paths:
1818
- ".github/renovate.json5"
1919

20-
permissions:
21-
contents: read
20+
permissions: {} # No permissions by default
2221

2322
concurrency:
2423
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.after }}
@@ -27,6 +26,8 @@ concurrency:
2726
jobs:
2827
validate:
2928
runs-on: ubuntu-latest
29+
permissions:
30+
contents: read
3031
steps:
3132
- name: Checkout configuration
3233
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

0 commit comments

Comments
 (0)