Repository navigation
Connect v3 CI, fuzz campaigns and guarded release publication #1043
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CodeQL" | |
| # Supply-chain hardening (TASK-090): every action below is pinned to a full | |
| # 40-hex commit SHA, mirroring the convention in verify-build.yml. The trailing | |
| # `# vX.Y.Z` comment records the upstream release tag each SHA corresponds to, | |
| # for rotation. | |
| # | |
| # Pinned actions and how to rotate them (read-only `gh` API; dereference the | |
| # annotated tag to its commit SHA): | |
| # actions/checkout v4.2.2 -> 11bd71901bbe5b1630ceea73d27597364c9af683 | |
| # (kept identical to verify-build.yml so both workflows rotate together) | |
| # gh api repos/actions/checkout/git/refs/tags/v4.2.2 --jq .object.sha | |
| # github/codeql-action/* v3.36.3 -> 411c4c9a36b3fca4d674f06b6396b2c6d23522c6 | |
| # init AND analyze ship from one repo/release and MUST share one SHA. | |
| # SHA=$(gh api repos/github/codeql-action/git/refs/tags/v3.36.3 --jq .object.sha) | |
| # gh api repos/github/codeql-action/git/tags/$SHA --jq .object.sha # deref annotated tag | |
| # (@v1/@v2 of codeql-action are deprecated; v3 is the current major.) | |
| on: | |
| push: | |
| branches: [master, v3] | |
| pull_request: | |
| # The branches below must be a subset of the branches above | |
| branches: [master, v3] | |
| schedule: | |
| - cron: '0 4 * * 4' | |
| # Least-privilege GITHUB_TOKEN: restrict to exactly what the CodeQL scan | |
| # needs. `security-events: write` is required by github/codeql-action/analyze | |
| # to upload the SARIF report to the security dashboard. `contents: read` is | |
| # required by actions/checkout. `actions: read` is required on some GitHub | |
| # plans/repository configurations to read the workflow run. Without an | |
| # explicit block the token defaults to the repository's global setting. | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| jobs: | |
| analyze: | |
| name: Analyze | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Override automatic language detection by changing the below list | |
| # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python'] | |
| language: ['cpp'] | |
| # Learn more... | |
| # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| # We must fetch at least the immediate parents so that if this is | |
| # a pull request then we can checkout the head. | |
| fetch-depth: 2 | |
| # If this run was triggered by a pull request event, then checkout | |
| # the head of the pull request instead of the merge commit. | |
| - run: git checkout HEAD^2 | |
| if: ${{ github.event_name == 'pull_request' }} | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3.36.3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Install build prerequisites | |
| run: sudo apt-get update && sudo apt-get install -y autoconf automake libtool pkg-config perl | |
| - name: Select source configuration | |
| id: source | |
| run: | | |
| if grep -q 'libhttpserver_v3core_la_SOURCES' src/Makefile.am; then | |
| echo 'native=true' >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Provision private native TLS provider | |
| if: steps.source.outputs.native == 'true' | |
| run: python3 scripts/prepare-v3-package-ci.py --output "$RUNNER_TEMP/codeql-prerequisites" | |
| - name: Build the library (CodeQL manual mode) | |
| run: | | |
| ./bootstrap | |
| mkdir "$RUNNER_TEMP/codeql-build" | |
| cd "$RUNNER_TEMP/codeql-build" | |
| if grep -q 'libhttpserver_v3core_la_SOURCES' "$GITHUB_WORKSPACE/src/Makefile.am"; then | |
| export LD_LIBRARY_PATH="$RUNNER_TEMP/codeql-prerequisites/provider/lib" | |
| export V3_TLS_CFLAGS="-I$RUNNER_TEMP/codeql-prerequisites/provider/include" | |
| export V3_TLS_LIBS="-L$RUNNER_TEMP/codeql-prerequisites/provider/lib -lssl -lcrypto" | |
| "$GITHUB_WORKSPACE/./configure" --enable-v3-tls | |
| else | |
| "$GITHUB_WORKSPACE/./configure" | |
| fi | |
| make -j2 | |
| timeout-minutes: 40 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3.36.3 | |
| timeout-minutes: 30 |