Skip to content

Commit e8ab982

Browse files
nashifnashif
committed
ci: add coding guideline scan workflow
Add initial workflow for scanning the code base using ECLAIR. This is the initial step used for integration, at the moment we only build one single application using west and enable all zephyr coding guidelines covered by the tool. This workflow will only run on push events only and will generate a SARIF file with all violations that can be downloaded and evaluated locally to help triage and fix issues. Goal it to address some of the rules with large number of violations first, get to a manageable number of violations and start posting those into GH dedicated tracking backend. Later on we will also start running this on pull requests and flag violations introduced in PRs. This should over time also obsolete this existing workflow: .github/workflows/coding_guidelines.yml Signed-off-by: Anas Nashif <anas.nashif@intel.com>
1 parent 22c8bd9 commit e8ab982

1 file changed

Lines changed: 169 additions & 0 deletions

File tree

‎.github/workflows/coding_guidelines_full.yml‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
name: Eclair Code Scanning
2+
on:
3+
push:
4+
branches:
5+
- main
6+
- v*-branch
7+
- collab-*
8+
permissions:
9+
contents: read
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
12+
cancel-in-progress: true
13+
14+
jobs:
15+
coding_guideline_scan:
16+
if: github.repository_owner == 'zephyrproject-rtos'
17+
runs-on:
18+
group: zephyr-runner-v2-linux-x64-4xlarge
19+
container:
20+
image: ghcr.io/zephyrproject-rtos/ci-repo-cache:v0.29.2.20260422
21+
options: '--entrypoint /bin/bash'
22+
permissions:
23+
security-events: write
24+
steps:
25+
- name: Print cloud service information
26+
run: |
27+
echo "ZEPHYR_RUNNER_CLOUD_PROVIDER = ${ZEPHYR_RUNNER_CLOUD_PROVIDER}"
28+
echo "ZEPHYR_RUNNER_CLOUD_NODE = ${ZEPHYR_RUNNER_CLOUD_NODE}"
29+
echo "ZEPHYR_RUNNER_CLOUD_POD = ${ZEPHYR_RUNNER_CLOUD_POD}"
30+
31+
- name: Apply container owner mismatch workaround
32+
run: |
33+
# FIXME: The owner UID of the GITHUB_WORKSPACE directory may not
34+
# match the container user UID because of the way GitHub
35+
# Actions runner is implemented. Remove this workaround when
36+
# GitHub comes up with a fundamental fix for this problem.
37+
git config --global --add safe.directory ${GITHUB_WORKSPACE}
38+
39+
- name: Clone cached Zephyr repository
40+
continue-on-error: true
41+
run: |
42+
git clone --shared /repo-cache/zephyrproject/zephyr .
43+
git remote set-url origin ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}
44+
45+
- name: Checkout
46+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
47+
with:
48+
ref: ${{ github.event.pull_request.head.sha }}
49+
fetch-depth: 0
50+
persist-credentials: false
51+
52+
- name: Environment Setup
53+
run: |
54+
echo "$HOME/.local/bin" >> $GITHUB_PATH
55+
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
56+
57+
west init -l . || true
58+
west config manifest.group-filter -- +ci,+optional
59+
west config --global update.narrow true
60+
west update --path-cache /repo-cache/zephyrproject 2>&1 1> west.update.log || west update --path-cache /repo-cache/zephyrproject 2>&1 1> west.update.log || ( rm -rf ../modules ../bootloader ../tools && west update --path-cache /repo-cache/zephyrproject)
61+
west forall -c 'git reset --hard HEAD'
62+
63+
echo "ZEPHYR_SDK_INSTALL_DIR=/opt/toolchains/zephyr-sdk-$( cat SDK_VERSION )" >> $GITHUB_ENV
64+
65+
- name: Check Environment
66+
run: |
67+
cmake --version
68+
gcc --version
69+
cargo --version
70+
rustup target list --installed
71+
ls -la
72+
echo "github.ref: ${{ github.ref }}"
73+
echo "github.base_ref: ${{ github.base_ref }}"
74+
echo "github.ref_name: ${{ github.ref_name }}"
75+
76+
- name: SCA Setup
77+
uses: zephyrproject-rtos/action-sca-setup@681d9f46f28d391eb57e6f15fdb76af25d6c46bc
78+
with:
79+
tool-name: eclair
80+
tool-version: 3.15.0
81+
install-dir: eclair
82+
s3-access-key-id: ${{ secrets.TOOLDIST_ACCESS_KEY }}
83+
s3-secret-access-key: ${{ secrets.TOOLDIST_SECRET_ACCESS_KEY }}
84+
license-server: ${{ secrets.TOOLDIST_ECLAIR_LICENSE_SERVER }}
85+
license-key-ttl: 480
86+
87+
- name: Set Up Python 3.12
88+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
89+
with:
90+
python-version: 3.12
91+
cache: pip
92+
cache-dependency-path: scripts/requirements-actions.txt
93+
94+
- name: install-packages
95+
run: |
96+
pip install -r scripts/requirements-actions.txt --require-hashes
97+
sudo apt-get update
98+
sudo apt-get install -y jq
99+
100+
- name: Scan code with Eclair
101+
run: |
102+
#./scripts/twister -j 16 -p qemu_x86 -T samples/synchronization -i --build-only -v \
103+
# -xZEPHYR_SCA_VARIANT=eclair \
104+
# -xUSE_CCACHE=0 \
105+
# -xECLAIR_REPORTS_SARIF=1 \
106+
# -xECLAIR_RULESET_ZEPHYR_GUIDELINES=1 \
107+
# -xECLAIR_RULESET_FIRST_ANALYSIS=0
108+
109+
# Initially we use west to build just one single application on one
110+
# platform and address rules with large number of findings. This is
111+
# to make sure we can complete the scan within the time limit of
112+
# GitHub Actions and also to make sure we can get the results in
113+
# SARIF format without running into any issues. Once we have that
114+
# working, we can expand the scan to cover more applications and
115+
# platforms and start posting findings to GitHub Security tab.
116+
export ZEPHYR_BASE=${PWD}
117+
west -v build -p -b qemu_x86 tests/integration/kernel/ -- \
118+
-DZEPHYR_SCA_VARIANT=eclair \
119+
-DUSE_CCACHE=0 \
120+
-DECLAIR_REPORTS_SARIF=1 \
121+
-DECLAIR_RULESET_ZEPHYR_GUIDELINES=1 \
122+
-DECLAIR_RULESET_FIRST_ANALYSIS=0
123+
124+
cp build/sca/eclair/reports.sarif .
125+
cp build/sca/eclair/DIAGNOSTIC.txt .
126+
127+
jq -s '{ "$schema": "https://json.schemastore.org/sarif-2.1.0", "version": "2.1.0", "runs": map(.runs) | add }' $(find build -name "reports.sarif") > results.sarif
128+
cp results.sarif results_${GITHUB_SHA}.sarif
129+
jq --arg basepath "file://${GITHUB_WORKSPACE}/" '
130+
.runs[].results[] |= (
131+
# Remove partialFingerprints if it exists
132+
del(.partialFingerprints)
133+
|
134+
.locations[]? |= (
135+
.physicalLocation.artifactLocation.uri
136+
|= if type == "string" then ($basepath + .) else . end
137+
)
138+
| .relatedLocations[]? |= (
139+
.physicalLocation.artifactLocation.uri
140+
|= if type == "string" then ($basepath + .) else . end
141+
)
142+
)
143+
' results.sarif > results_tmp.sarif
144+
mv results_tmp.sarif results.sarif
145+
146+
ver=`git describe`
147+
echo "PAYLOAD_VERSION=${ver}" >> $GITHUB_ENV
148+
echo "PAYLOAD_DESC=${ver}" >> $GITHUB_ENV
149+
- name: Clean up
150+
if: always()
151+
run: |
152+
eclair_licman -c 57350
153+
154+
- name: Upload SARIF as artifact
155+
if: always() && github.event_name == 'push'
156+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
157+
with:
158+
name: sarif
159+
if-no-files-found: ignore
160+
path: |
161+
DIAGNOSTIC.txt
162+
results_*.sarif
163+
164+
# disabled for now
165+
# - name: Upload Analysis Results
166+
# if: always()
167+
# uses: github/codeql-action/upload-sarif@v4
168+
# with:
169+
# sarif_file: results.sarif

0 commit comments

Comments
 (0)