kernel_settings/.github/workflows/codeql.yml at main · linux-system-roles/kernel_settings · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
---
name: CodeQL
on:  # yamllint disable-line rule:truthy
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
    types:
      - opened
      - synchronize
      - labeled
  issue_comment:
    types:
      - created
  merge_group:
    branches:
      - main
    types:
      - checks_requested
  schedule:
    - cron: 10 1 * * 4
permissions:
  contents: read
  pull-requests: read
  # This is required for the ability to create/update the Pull request status
  statuses: write
jobs:
  analyze:
    if: |
      (
        github.event_name == 'issue_comment'
        && github.event.issue.pull_request
        && (contains(github.event.comment.body, '[citest_all]')
            || contains(github.event.comment.body, '[citest_codeql]'))
        && (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
                     github.event.comment.author_association)
            || github.event.comment.user.login == 'systemroller')
      ) || (
        github.event_name == 'pull_request'
        && github.event.action == 'opened'
        && (contains(github.event.pull_request.labels.*.name, 'citest_all')
            || contains(github.event.pull_request.labels.*.name, 'citest_codeql'))
        && (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
                     github.event.pull_request.author_association)
            || github.event.pull_request.user.login == 'systemroller')
      ) || (
        github.event_name == 'pull_request'
        && github.event.action == 'synchronize'
        && (contains(github.event.pull_request.labels.*.name, 'citest_all')
            || contains(github.event.pull_request.labels.*.name, 'citest_codeql'))
        && (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
                     github.event.pull_request.author_association)
            || github.event.sender.login == 'systemroller')
      ) || (
        github.event_name == 'pull_request'
        && github.event.action == 'labeled'
        && (github.event.label.name == 'citest_all'
            || github.event.label.name == 'citest_codeql')
        && (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
                     github.event.pull_request.author_association)
            || github.event.sender.login == 'systemroller')
      )
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
      actions: read
      contents: read
      security-events: write
      statuses: write
    strategy:
      fail-fast: false
      matrix:
        language: [python]
    steps:
      - name: Get PR head SHA and context
        if: github.event_name == 'issue_comment'
        id: head_sha_context
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.issue.number }}
          CONTEXT: "${{ github.workflow }} / Analyze (${{ matrix.language }}) (pull_request)"
        run: |
          set -euxo pipefail
          head_sha=$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.head.sha')
          echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
          echo "context=$CONTEXT" >> "$GITHUB_OUTPUT"

      - name: Set commit status as pending
        if: github.event_name == 'issue_comment'
        uses: myrotvorets/set-commit-status-action@c0f880c99d91381c6fdb97726f03feb8004409b4  # master
        with:
          sha: ${{ steps.head_sha_context.outputs.head_sha }}
          status: pending
          context: ${{ steps.head_sha_context.outputs.context }}
          description: Test started
          targetUrl: ""

      - name: Update pip, git
        run: |
          set -euxo pipefail
          sudo apt update
          sudo apt install -y git

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
          ref: ${{ steps.head_sha_context.outputs.head_sha || github.sha }}

      - name: Initialize CodeQL
        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
        with:
          languages: ${{ matrix.language }}
          queries: +security-and-quality

      - name: Autobuild
        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
        with:
          category: "/language:${{ matrix.language }}"

      - name: Set final commit status
        if: always() && github.event_name == 'issue_comment' && steps.head_sha_context.outputs.head_sha != ''
        uses: myrotvorets/set-commit-status-action@c0f880c99d91381c6fdb97726f03feb8004409b4  # master
        with:
          sha: ${{ steps.head_sha_context.outputs.head_sha }}
          status: ${{ job.status }}
          context: ${{ steps.head_sha_context.outputs.context }}
          description: Test finished
          targetUrl: ""