Skip to content

Commit cf766c6

Browse files
novatechflownovatechflow
committed
chore: add local CodeQL infrastructure and summary reporting
1 parent 478dc5e commit cf766c6

5 files changed

Lines changed: 228 additions & 19 deletions

File tree

‎scripts/codeql_js_build.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env bash
2+
# Scalytics Copilot - Local CodeQL Build Script for JS/TS
3+
set -euo pipefail
4+
5+
# In a real build, we might run npm install or similar.
6+
# For CodeQL database creation, we just need to ensure the environment is sane.
7+
echo "Preparing JS/TS build for CodeQL..."
8+
npm install --no-package-lock --no-save
9+
cd frontend && npm install --no-package-lock --no-save && cd ..
10+
echo "JS/TS build preparation complete."

‎scripts/codeql_local.sh‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
#!/usr/bin/env bash
2+
# Scalytics Copilot - Local CodeQL Execution Script
3+
set -euo pipefail
4+
5+
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
6+
cd "$ROOT_DIR"
7+
8+
if ! command -v codeql >/dev/null 2>&1; then
9+
echo "ERROR: codeql CLI not found in PATH"
10+
echo "Install from: https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli"
11+
exit 1
12+
fi
13+
14+
mkdir -p .tmp/codeql
15+
16+
echo "==> Ensuring CodeQL standard query packs are available"
17+
codeql pack download codeql/javascript-queries codeql/python-queries codeql/actions-queries
18+
19+
# Stable defaults for local runs.
20+
CODEQL_JS_RAM_MB="${CODEQL_JS_RAM_MB:-6144}"
21+
CODEQL_JS_THREADS="${CODEQL_JS_THREADS:-2}"
22+
CODEQL_PY_RAM_MB="${CODEQL_PY_RAM_MB:-4096}"
23+
CODEQL_ACTIONS_RAM_MB="${CODEQL_ACTIONS_RAM_MB:-1024}"
24+
25+
# Strategy github/security-and-quality
26+
CODEQL_QUERY_STRATEGY="${CODEQL_QUERY_STRATEGY:-github}"
27+
28+
run_js() {
29+
echo "==> CodeQL (JavaScript/TypeScript)"
30+
echo " using --ram=${CODEQL_JS_RAM_MB}MB --threads=${CODEQL_JS_THREADS}"
31+
rm -rf .tmp/codeql/js-db
32+
chmod +x scripts/codeql_js_build.sh
33+
codeql database create .tmp/codeql/js-db
34+
--language=javascript-typescript
35+
--ram="$CODEQL_JS_RAM_MB"
36+
--command="./scripts/codeql_js_build.sh"
37+
38+
if [[ "$CODEQL_QUERY_STRATEGY" == "security-and-quality" ]]; then
39+
codeql database analyze .tmp/codeql/js-db
40+
codeql/javascript-queries:codeql-suites/javascript-security-and-quality.qls
41+
--download
42+
--ram="$CODEQL_JS_RAM_MB"
43+
--threads="$CODEQL_JS_THREADS"
44+
--format=sarifv2.1.0
45+
--sarif-category="/language:javascript-typescript"
46+
--output .tmp/codeql/javascript.sarif
47+
else
48+
codeql database analyze .tmp/codeql/js-db
49+
codeql/javascript-queries
50+
--download
51+
--ram="$CODEQL_JS_RAM_MB"
52+
--threads="$CODEQL_JS_THREADS"
53+
--format=sarifv2.1.0
54+
--sarif-category="/language:javascript-typescript"
55+
--output .tmp/codeql/javascript.sarif
56+
fi
57+
}
58+
59+
run_py() {
60+
echo "==> CodeQL (Python)"
61+
echo " using --ram=${CODEQL_PY_RAM_MB}MB"
62+
rm -rf .tmp/codeql/py-db
63+
chmod +x scripts/codeql_py_build.sh
64+
codeql database create .tmp/codeql/py-db
65+
--language=python
66+
--ram="$CODEQL_PY_RAM_MB"
67+
--command="./scripts/codeql_py_build.sh"
68+
69+
if [[ "$CODEQL_QUERY_STRATEGY" == "security-and-quality" ]]; then
70+
codeql database analyze .tmp/codeql/py-db
71+
codeql/python-queries:codeql-suites/python-security-and-quality.qls
72+
--download
73+
--ram="$CODEQL_PY_RAM_MB"
74+
--format=sarifv2.1.0
75+
--sarif-category="/language:python"
76+
--output .tmp/codeql/python.sarif
77+
else
78+
codeql database analyze .tmp/codeql/py-db
79+
codeql/python-queries
80+
--download
81+
--ram="$CODEQL_PY_RAM_MB"
82+
--format=sarifv2.1.0
83+
--sarif-category="/language:python"
84+
--output .tmp/codeql/python.sarif
85+
fi
86+
}
87+
88+
run_actions() {
89+
echo "==> CodeQL (Actions)"
90+
echo " using --ram=${CODEQL_ACTIONS_RAM_MB}MB"
91+
rm -rf .tmp/codeql/actions-db
92+
codeql database create .tmp/codeql/actions-db
93+
--language=actions
94+
--build-mode=none
95+
--ram="$CODEQL_ACTIONS_RAM_MB"
96+
97+
codeql database analyze .tmp/codeql/actions-db
98+
codeql/actions-queries
99+
--download
100+
--ram="$CODEQL_ACTIONS_RAM_MB"
101+
--format=sarifv2.1.0
102+
--sarif-category="/language:actions"
103+
--output .tmp/codeql/actions.sarif
104+
}
105+
106+
# Run for all project languages
107+
run_js
108+
run_py
109+
run_actions
110+
111+
echo ""
112+
echo "CodeQL local run complete."
113+
echo "SARIF outputs:"
114+
echo " .tmp/codeql/javascript.sarif"
115+
echo " .tmp/codeql/python.sarif"
116+
echo " .tmp/codeql/actions.sarif"

‎scripts/codeql_py_build.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/usr/bin/env bash
2+
# Scalytics Copilot - Local CodeQL Build Script for Python
3+
set -euo pipefail
4+
5+
echo "Preparing Python build for CodeQL..."
6+
# Python usually doesn't need a formal build step for CodeQL (build-mode=none),
7+
# but we can verify dependencies here if needed.
8+
pip install -r scripts/requirements.txt || echo "Optional requirements installation failed, continuing..."
9+
echo "Python build preparation complete."

‎scripts/codeql_summary.py‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/usr/bin/env python3
2+
import json
3+
import glob
4+
import sys
5+
from collections import Counter
6+
7+
class C:
8+
RED = '\033[91m'
9+
YEL = '\033[93m'
10+
CYA = '\033[96m'
11+
GRN = '\033[92m'
12+
RST = '\033[0m'
13+
BLD = '\033[1m'
14+
DIM = '\033[2m'
15+
16+
def summarize():
17+
sarifs = sorted(glob.glob(".tmp/codeql/*.sarif"))
18+
if not sarifs:
19+
print(f"{C.YEL}No SARIF files found under .tmp/codeql/. Did local CodeQL run successfully?{C.RST}")
20+
return
21+
22+
total_errors = 0
23+
total_warnings = 0
24+
25+
print(f"
26+
{C.BLD}=== Local CodeQL Findings Summary ==={C.RST}")
27+
28+
for path in sarifs:
29+
filename = path.split('/')[-1]
30+
with open(path, "r", encoding="utf-8") as f:
31+
data = json.load(f)
32+
33+
file_errors = 0
34+
file_warnings = 0
35+
36+
for run in data.get("runs", []):
37+
for result in (run.get("results") or []):
38+
level = (result.get("level") or "warning").lower()
39+
if level == "error":
40+
file_errors += 1
41+
else:
42+
file_warnings += 1
43+
44+
if file_errors > 0 or file_warnings > 0:
45+
print(f"📄 {C.CYA}{filename}{C.RST}: {C.RED}{file_errors} Errors{C.RST}, {C.YEL}{file_warnings} Warnings{C.RST}")
46+
47+
total_errors += file_errors
48+
total_warnings += file_warnings
49+
50+
if total_errors > 0:
51+
print(f"
52+
{C.RED}❌ CodeQL gate failed: {total_errors} blocking error(s) found.{C.RST}")
53+
sys.exit(1)
54+
55+
if total_warnings > 0:
56+
print(f"
57+
{C.YEL}⚠️ CodeQL passed with {total_warnings} warnings (non-blocking).{C.RST}")
58+
else:
59+
print(f"
60+
{C.GRN}✅ CodeQL passed: no findings found.{C.RST}")
61+
62+
if __name__ == "__main__":
63+
summarize()

‎scripts/commit-check.sh‎

Lines changed: 30 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,60 @@
11
#!/bin/bash
22
# Scalytics Copilot - Local Commit Check Script
3-
# This script runs linting, security audits, and tests to ensure code quality.
3+
# This script runs linting, security audits, tests, and CodeQL to ensure code quality.
44

55
set -e # Exit on any failure
66

77
# Colors for output
88
GREEN='\033[0;32m'
99
RED='\033[0;31m'
1010
YELLOW='\033[1;33m'
11+
CYAN='\033[0;36m'
1112
NC='\033[0m' # No Color
1213

13-
echo -e "${YELLOW}🚀 Starting Scalytics Copilot Commit Check...${NC}
14-
"
14+
echo -e "${YELLOW}🚀 Starting Scalytics Copilot Commit Check...${NC}\n"
1515

1616
# 1. Backend Checks
17-
echo -e "${GREEN}📦 [1/4] Checking Backend...${NC}"
17+
echo -e "${CYAN}📦 [1/5] Checking Backend...${NC}"
1818
npm run lint || { echo -e "${RED}❌ Backend Linting Failed${NC}"; exit 1; }
1919
npm test || { echo -e "${RED}❌ Backend Tests Failed${NC}"; exit 1; }
20-
echo -e "✅ Backend checks passed.
21-
"
20+
echo -e "✅ Backend checks passed.\n"
2221

2322
# 2. Frontend Checks
24-
echo -e "${GREEN}🖼️ [2/4] Checking Frontend...${NC}"
23+
echo -e "${CYAN}🖼️ [2/5] Checking Frontend...${NC}"
2524
cd frontend
26-
npm run lint || { echo -e "${YELLOW}⚠️ Frontend Linting had warnings/errors (skipping exit)${NC}" ; }
25+
# Skip exit on frontend linting as it's often noisy in early stages
26+
npm run lint || { echo -e "${YELLOW}⚠️ Frontend Linting had warnings/errors${NC}" ; }
2727
CI=true npm test -- --passWithNoTests || { echo -e "${RED}❌ Frontend Tests Failed${NC}"; exit 1; }
2828
cd ..
29-
echo -e "✅ Frontend checks passed.
30-
"
29+
echo -e "✅ Frontend checks passed.\n"
3130

3231
# 3. Python Checks (Sanity)
33-
echo -e "${GREEN}🐍 [3/4] Checking Python Services...${NC}"
32+
echo -e "${CYAN}🐍 [3/5] Checking Python Services...${NC}"
3433
if command -v python3 &> /dev/null; then
3534
python3 -m compileall scripts src/python_services > /dev/null
36-
echo -e "✅ Python syntax check passed.
37-
"
35+
echo -e "✅ Python syntax check passed.\n"
3836
else
39-
echo -e "${YELLOW}⚠️ Python3 not found, skipping Python checks.${NC}
40-
"
37+
echo -e "${YELLOW}⚠️ Python3 not found, skipping Python checks.${NC}\n"
4138
fi
4239

4340
# 4. Security Audit
44-
echo -e "${GREEN}🛡️ [4/4] Running Security Audit...${NC}"
41+
echo -e "${CYAN}🛡️ [4/5] Running Security Audit...${NC}"
4542
npm audit --audit-level=high || { echo -e "${YELLOW}⚠️ High-level vulnerabilities found in dependencies. Please review with 'npm audit'.${NC}"; }
46-
echo -e "✅ Security audit complete.
47-
"
43+
echo -e "✅ Security audit complete.\n"
44+
45+
# 5. Local CodeQL Analysis
46+
echo -e "${CYAN}🔍 [5/5] Running Local CodeQL Analysis...${NC}"
47+
if command -v codeql &> /dev/null; then
48+
./scripts/codeql_local.sh
49+
# Use python script for summary and gating (if python3 is available)
50+
if command -v python3 &> /dev/null; then
51+
python3 scripts/codeql_summary.py
52+
else
53+
echo -e "${YELLOW}⚠️ python3 not found, skipping CodeQL summary report.${NC}"
54+
fi
55+
else
56+
echo -e "${YELLOW}⚠️ CodeQL CLI not found in PATH, skipping local deep analysis.${NC}"
57+
echo -e "${YELLOW} Install from: https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli${NC}"
58+
fi
4859

49-
echo -e "${GREEN}🎉 All checks passed! You are ready to commit.${NC}"
60+
echo -e "\n${GREEN}🎉 All checks passed! You are ready to commit.${NC}"

0 commit comments

Comments
 (0)