Adding CodeQL Back (#27451)
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..d6aa8ae
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,122 @@
+# Copyright (c) 2020-2023 Project CHIP Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+name: "CodeQL"
+
+on:
+ workflow_dispatch:
+# push:
+# branches: [ "master", "sve*", "test_event_*", "v1.*" ]
+# pull_request:
+# schedule:
+# - cron: '27 4 * * 2'
+
+concurrency:
+ group: ${{ github.ref }}-${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.event.number) || (github.event_name == 'workflow_dispatch' && github.run_number) || github.sha }}
+ cancel-in-progress: true
+
+env:
+ CHIP_NO_LOG_TIMESTAMPS: true
+ # XXX: Workaround for https://github.com/actions/cache/issues/1141
+ SEGMENT_DOWNLOAD_TIMEOUT_MINS: 3
+
+jobs:
+ analyze:
+ name: CodeQL Analysis
+ runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+ timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
+ permissions:
+ actions: read
+ contents: read
+ security-events: write
+
+ container:
+ image: connectedhomeip/chip-build:0.7.3
+ volumes:
+ - "/tmp/log_output:/tmp/test_logs"
+ options: --privileged --sysctl "net.ipv6.conf.all.disable_ipv6=0
+ net.ipv4.conf.all.forwarding=1 net.ipv6.conf.all.forwarding=1"
+
+ strategy:
+ fail-fast: false
+ matrix:
+ language: [ 'cpp' ]
+ # language: [ 'cpp', 'java', 'javascript', 'python' ]
+ # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
+ # Use only 'java' to analyze code written in Java, Kotlin or both
+ # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
+ # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+
+ steps:
+ - name: Dump GitHub context
+ env:
+ GITHUB_CONTEXT: ${{ toJSON(github) }}
+ run: echo "$GITHUB_CONTEXT"
+ - name: Dump Concurrency context
+ env:
+ CONCURRENCY_CONTEXT: ${{ github.ref }}-${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.event.number) || (github.event_name == 'workflow_dispatch' && github.run_number) || github.sha }}
+ run: echo "$CONCURRENCY_CONTEXT"
+ - uses: Wandalen/wretry.action@v1.3.0
+ name: Checkout
+ with:
+ action: actions/checkout@v3.5.2
+ with: |
+ token: ${{ github.token }}
+ attempt_limit: 3
+ attempt_delay: 2000
+ - name: Checkout submodules
+ run: scripts/checkout_submodules.py --allow-changing-global-git-config --shallow --platform linux
+ - name: Try to ensure the directories for core dumping exist and we
+ can write them.
+ run: |
+ mkdir /tmp/cores || true
+ sysctl -w kernel.core_pattern=/tmp/cores/core.%u.%p.%t || true
+
+ - uses: Wandalen/wretry.action@v1.3.0
+ name: Bootstrap cache
+ continue-on-error: true
+ timeout-minutes: 10
+ with:
+ action: buildjet/cache@v3
+ attempt_limit: 3
+ attempt_delay: 2000
+ with: |
+ key: ${{ runner.os }}-env-${{ hashFiles('scripts/setup/*', 'third_party/pigweed/**') }}
+ path: |
+ .environment
+ build_overrides/pigweed_environment.gni
+ - name: Bootstrap
+ run: bash scripts/bootstrap.sh
+
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@v2
+ with:
+ languages: ${{ matrix.language }}
+ # If you wish to specify custom queries, you can do so here or in a config file.
+ # By default, queries listed here will override any specified in a config file.
+ # Prefix the list here with "+" to use these queries and those in the config file.
+
+ # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+ # queries: security-extended,security-and-quality
+
+ - name: Setup Build
+ run: scripts/build/gn_gen.sh --args="chip_config_memory_debug_checks=true chip_config_memory_debug_dmalloc=false"
+ - name: Run Build
+ run: scripts/run_in_build_env.sh "ninja -C ./out"
+ - name: Run Tests
+ run: scripts/tests/gn_tests.sh
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@v2
+ with:
+ category: "/language:${{matrix.language}}"
