devtools/.github/workflows/codeql-analysis.yml at main · Open-CMSIS-Pack/devtools · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
name: "CodeQL"

on:
  workflow_dispatch:
  pull_request:
    branches: [ main ]
    paths:
      - '.github/workflows/codeql-analysis.yml'
      - '.github/codeql-config.yml'
      - '.github/codeql-svdconv-suppressions.qls'
      - '**/*.c'
      - '**/*.cpp'
      - '**/*.h'
      - '**/*.in'
      - '**/CMakeLists.txt'
      - '!**/*.md'
  push:
    branches: [ main ]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      pull-requests: read

    steps:
      - name: Install packages
        run: |
          sudo apt-get install ninja-build

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true

      - name: Initialize CodeQL
        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
        with:
          languages: cpp
          build-mode: manual
          config-file: ./.github/codeql-config.yml

      - name: Create build folder
        run: mkdir build

      - name: Build code for analysis
        run: |
          cmake -G Ninja ..
          cmake --build .
        working-directory: ./build

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
        with:
          category: .github/workflows/codeql-analysis.yml:analyze
          output: sarif-results
          upload: never

      - name: Filter external results and approved source suppressions
        run: |
          set -euo pipefail
          mkdir sarif-results-filtered
          find sarif-results -type f -name '*.sarif' -print0 | while IFS= read -r -d '' sarif_file; do
            jq '
              def is_external_path:
                (. // "" | gsub("\\\\"; "/") | test("(^|/)(\\./)?external(/|$)"));
              def is_svdconv_unused_suppression:
                (.ruleId == "cpp/unused-local-variable" or .ruleId == "cpp/unused-static-variable")
                and (
                  (.locations[0].physicalLocation.artifactLocation.uri // "")
                  | gsub("\\\\"; "/")
                  | test("^(\\./)?tools/svdconv/")
                )
                and any(.suppressions[]?;
                  .kind == "inSource" and ((.status // "accepted") == "accepted")
                );
              def is_xmlreader_trivial_switch_suppression:
                .ruleId == "cpp/trivial-switch"
                and (
                  (.locations[0].physicalLocation.artifactLocation.uri // "")
                  | gsub("\\\\"; "/")
                  | test("^(\\./)?libs/xmlreader/src/XML_Reader\\.cpp$")
                )
                and any(.suppressions[]?;
                  .kind == "inSource" and ((.status // "accepted") == "accepted")
                );
              .runs |= map(
                .results |= map(
                  select(
                    (.locations[0].physicalLocation.artifactLocation.uri // "")
                    | is_external_path
                    | not
                  )
                  | select(is_svdconv_unused_suppression | not)
                  | select(is_xmlreader_trivial_switch_suppression | not)
                )
              )
            ' "$sarif_file" > "sarif-results-filtered/$(basename "$sarif_file")"
          done

      - name: Upload filtered CodeQL results
        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
        with:
          category: .github/workflows/codeql-analysis.yml:analyze
          sarif_file: sarif-results-filtered