c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2024-11-17 10:01:01 +03:00
Code Issues Packages Projects Releases Wiki Activity
21cba06bef
mirror_zfs/.github/workflows/codeql.yml

46 lines
965 B
YAML
Raw Normal View History

Add CodeQL workflow CodeQL is a static analyzer from github with a very low false positive rate. We have long wanted to have static analysis runs done on every pull request and using CodeQL, we can. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14087
2022-10-27 19:36:17 +03:00
name: "CodeQL"
on:
push:
pull_request:
CI: cancel workflows when PRs are updated (#16562) For checkstyle, zloop, zfs-qemu, and codeql workflows cancel in-progress jobs when the PR is updated. Relevant GitHub Actions documentation: The following concurrency group cancels in-progress jobs or run on pull_request events only; if github.head_ref is undefined, the concurrency group will fallback to the run ID, which is guaranteed to be both unique and defined for the run. https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#example-using-a-fallback-value Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov> Closes #16562
2024-09-24 19:02:01 +03:00
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
cancel-in-progress: true
Add CodeQL workflow CodeQL is a static analyzer from github with a very low false positive rate. We have long wanted to have static analysis runs done on every pull request and using CodeQL, we can. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14087
2022-10-27 19:36:17 +03:00
jobs:
analyze:
name: Analyze
CI: Stick with ubuntu-22.04 for CodeQL analysis The ubuntu-latest alias now refers to ubuntu-24.04 instead of ubuntu-22.04 which causes CodeQL's autobuild to fail with: cpp/autobuilder: deptrace not supported in ubuntu 24.04 Until deptrace is supported by ubuntu-24.04 hosted runners request ubuntu-22.04 which is supported. Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Tino Reichardt <milky-zfs@mcmilk.de> Reviewed-by: George Melikov <mail@gmelikov.ru> Closes #16639
2024-10-12 00:16:00 +03:00
runs-on: ubuntu-22.04
Add CodeQL workflow CodeQL is a static analyzer from github with a very low false positive rate. We have long wanted to have static analysis runs done on every pull request and using CodeQL, we can. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14087
2022-10-27 19:36:17 +03:00
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: [ 'cpp', 'python' ]
steps:
Set multiple make jobs on CodeQL github workflows github supports 2 processors right now, although we use nproc instead of hard coding -j2, so if that ever increases, we will take advantage of it right away. Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com> Reviewed-by: Tino Reichardt <milky-zfs@mcmilk.de> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14217
2022-11-29 00:29:55 +03:00
- name: Set make jobs
run: |
echo "MAKEFLAGS=-j$(nproc)" >> $GITHUB_ENV
Add CodeQL workflow CodeQL is a static analyzer from github with a very low false positive rate. We have long wanted to have static analysis runs done on every pull request and using CodeQL, we can. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14087
2022-10-27 19:36:17 +03:00
- name: Checkout repository
ZTS: Update deprecated Github Action version numbers GitHub Actions is transitioning from Node 16 to Node 20. So we need to update these: - actions/checkout@v3 -> v4 - actions/download-artifact@v3 -> v4 - actions/upload-artifact@v3 -> v4 and some minor changes Update also the documentation of the testings workflow. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Tino Reichardt <milky-zfs@mcmilk.de> Closes #15820
2024-01-27 01:22:26 +03:00
uses: actions/checkout@v4
Add CodeQL workflow CodeQL is a static analyzer from github with a very low false positive rate. We have long wanted to have static analysis runs done on every pull request and using CodeQL, we can. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14087
2022-10-27 19:36:17 +03:00
- name: Initialize CodeQL
ZTS: CodeQL Action v3 update Switch from v2 to v3 CodeQL Actions. The v2 actions will no longer be supported as of Dec '24 so we need to move to v3. According to the release notes they should be functionally equivalent. Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, ... For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. https://github.com/github/codeql-action/blob/main/CHANGELOG.md Reviewed-by: George Melikov <mail@gmelikov.ru> Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov> Closes #16560
2024-09-24 03:07:29 +03:00
uses: github/codeql-action/init@v3
Add CodeQL workflow CodeQL is a static analyzer from github with a very low false positive rate. We have long wanted to have static analysis runs done on every pull request and using CodeQL, we can. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14087
2022-10-27 19:36:17 +03:00
with:
Switch to CodeQL to detect prohibited function use The LLVM/Clang developers pointed out that using the CPP to detect use of functions that our QA policies prohibit risks invoking undefined behavior. To resolve this, we configure CodeQL to detect forbidden function usage. Note that cpp in the context of CodeQL refers to C/C++, rather than the C PreProcessor, which C++ also uses. It really should have been written cxx, but that ship sailed a long time ago. This misuse of the term cpp is retained in the CodeQL configuration for consistency with upstream CodeQL. As a side benefit, verbose make no longer is a wall of text showing a bunch of CPP macros, which can make debugging slightly easier. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #15819 Closes #14134
2024-01-27 01:11:33 +03:00
config-file: .github/codeql-${{ matrix.language }}.yml
Add CodeQL workflow CodeQL is a static analyzer from github with a very low false positive rate. We have long wanted to have static analysis runs done on every pull request and using CodeQL, we can. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14087
2022-10-27 19:36:17 +03:00
languages: ${{ matrix.language }}
- name: Autobuild
ZTS: CodeQL Action v3 update Switch from v2 to v3 CodeQL Actions. The v2 actions will no longer be supported as of Dec '24 so we need to move to v3. According to the release notes they should be functionally equivalent. Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, ... For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. https://github.com/github/codeql-action/blob/main/CHANGELOG.md Reviewed-by: George Melikov <mail@gmelikov.ru> Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov> Closes #16560
2024-09-24 03:07:29 +03:00
uses: github/codeql-action/autobuild@v3
Add CodeQL workflow CodeQL is a static analyzer from github with a very low false positive rate. We have long wanted to have static analysis runs done on every pull request and using CodeQL, we can. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14087
2022-10-27 19:36:17 +03:00
- name: Perform CodeQL Analysis
ZTS: CodeQL Action v3 update Switch from v2 to v3 CodeQL Actions. The v2 actions will no longer be supported as of Dec '24 so we need to move to v3. According to the release notes they should be functionally equivalent. Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, ... For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. https://github.com/github/codeql-action/blob/main/CHANGELOG.md Reviewed-by: George Melikov <mail@gmelikov.ru> Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov> Closes #16560
2024-09-24 03:07:29 +03:00
uses: github/codeql-action/analyze@v3
Add CodeQL workflow CodeQL is a static analyzer from github with a very low false positive rate. We have long wanted to have static analysis runs done on every pull request and using CodeQL, we can. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14087
2022-10-27 19:36:17 +03:00
with:
category: "/language:${{matrix.language}}"
Reference in New Issue Copy Permalink