@cryptotaxi247 / netdata-1
Code Commits Issues Pulls Sessions CI/CD
master
master
yml 206 lines 6.37 KB
Raw
1 ---
2 # Run CodeQL to analyze C/C++ and Python code.
3 name: CodeQL
4 on:
5 pull_request:
6 types: [opened, reopened, labeled, synchronize]
7 branches: [master]
8 push:
9 branches: [master]
10 schedule:
11 - cron: "27 2 * * 1"
12 env:
13 DISABLE_TELEMETRY: 1
14 concurrency:
15 group: codeql-${{ github.ref }}
16 cancel-in-progress: true
17 jobs:
18 prepare:
19 name: Prepare Jobs
20 runs-on: ubuntu-latest
21 outputs:
22 cpp: ${{ steps.cpp.outputs.run }}
23 python: ${{ steps.python.outputs.run }}
24 go: ${{ steps.go.outputs.run }}
25 rust: ${{ steps.rust.outputs.run }}
26 steps:
27 - name: Clone repository
28 uses: actions/checkout@v6
29 with:
30 submodules: recursive
31 fetch-depth: 0
32 - name: Check if we should always run
33 id: always
34 run: |
35 if [ "${{ github.event_name }}" = "pull_request" ]; then
36 if [ "${{ contains(github.event.pull_request.labels.*.name, 'run-ci/codeql') }}" = "true" ]; then
37 echo "run=true" >> "${GITHUB_OUTPUT}"
38 echo '::notice::Found ci/codeql label, unconditionally running all CodeQL checks.'
39 else
40 echo "run=false" >> "${GITHUB_OUTPUT}"
41 fi
42 else
43 echo "run=true" >> "${GITHUB_OUTPUT}"
44 fi
45 - name: Check for C/C++ changes
46 id: cpp
47 run: |
48 if [ "${{ steps.always.outputs.run }}" = "false" ]; then
49 if git diff --name-only origin/${{ github.base_ref }} HEAD | grep -Eq '.*\.[ch](xx|\+\+)?' ; then
50 echo "run=true" >> "${GITHUB_OUTPUT}"
51 echo '::notice::C/C++ code has changed, need to run CodeQL.'
52 else
53 echo "run=false" >> "${GITHUB_OUTPUT}"
54 fi
55 else
56 echo "run=true" >> "${GITHUB_OUTPUT}"
57 fi
58 - name: Check for python changes
59 id: python
60 run: |
61 if [ "${{ steps.always.outputs.run }}" = "false" ]; then
62 if git diff --name-only origin/${{ github.base_ref }} HEAD | grep -Eq 'src/collectors/python.d.plugin/.*\.py' ; then
63 echo "run=true" >> "${GITHUB_OUTPUT}"
64 echo '::notice::Python code has changed, need to run CodeQL.'
65 else
66 echo "run=false" >> "${GITHUB_OUTPUT}"
67 fi
68 else
69 echo "run=true" >> "${GITHUB_OUTPUT}"
70 fi
71 - name: Check for Go changes
72 id: go
73 run: |
74 if [ "${{ steps.always.outputs.run }}" = "false" ]; then
75 if git diff --name-only origin/${{ github.base_ref }} HEAD | grep -Eq 'src/go/*\.go' ; then
76 echo "run=true" >> "${GITHUB_OUTPUT}"
77 echo '::notice::Go code has changed, need to run CodeQL.'
78 else
79 echo "run=false" >> "${GITHUB_OUTPUT}"
80 fi
81 else
82 echo "run=true" >> "${GITHUB_OUTPUT}"
83 fi
84 - name: Check for Rust changes
85 id: rust
86 run: |
87 if [ "${{ steps.always.outputs.run }}" = "false" ]; then
88 if git diff --name-only origin/${{ github.base_ref }} HEAD | grep -Eq 'src/crates/(*.rs|*Cargo.(toml|lock))' ; then
89 echo "run=true" >> "${GITHUB_OUTPUT}"
90 echo '::notice::Rust code has changed, need to run CodeQL.'
91 else
92 echo "run=false" >> "${GITHUB_OUTPUT}"
93 fi
94 else
95 echo "run=true" >> "${GITHUB_OUTPUT}"
96 fi
97
98 analyze-cpp:
99 name: Analyze C/C++
100 runs-on: ubuntu-latest
101 needs: prepare
102 if: needs.prepare.outputs.cpp == 'true'
103 permissions:
104 security-events: write
105 steps:
106 - name: Git clone repository
107 uses: actions/checkout@v6
108 with:
109 submodules: recursive
110 fetch-depth: 0
111 - name: Initialize CodeQL
112 uses: github/codeql-action/init@v4
113 with:
114 languages: c-cpp
115 config-file: ./.github/codeql/c-cpp-config.yml
116 - name: Prepare environment
117 run: ./packaging/installer/install-required-packages.sh --dont-wait --non-interactive netdata
118 - name: Build netdata
119 run: ./netdata-installer.sh --dont-start-it --disable-telemetry --dont-wait --install-prefix /tmp/install --one-time-build
120 - name: Run CodeQL
121 uses: github/codeql-action/analyze@v4
122 with:
123 category: "/language:cpp"
124
125 analyze-python:
126 name: Analyze Python
127 runs-on: ubuntu-latest
128 needs: prepare
129 if: needs.prepare.outputs.python == 'true'
130 permissions:
131 security-events: write
132 steps:
133 - name: Git clone repository
134 uses: actions/checkout@v6
135 with:
136 submodules: recursive
137 fetch-depth: 0
138 - name: Initialize CodeQL
139 uses: github/codeql-action/init@v4
140 with:
141 config-file: ./.github/codeql/python-config.yml
142 languages: python
143 - name: Run CodeQL
144 uses: github/codeql-action/analyze@v4
145 with:
146 category: "/language:python"
147
148 analyze-go:
149 name: Analyze Go
150 runs-on: ubuntu-latest
151 needs: prepare
152 if: needs.prepare.outputs.go == 'true'
153 strategy:
154 matrix:
155 tree:
156 - src/go
157 permissions:
158 security-events: write
159 steps:
160 - name: Git clone repository
161 uses: actions/checkout@v6
162 with:
163 submodules: recursive
164 fetch-depth: 0
165 - name: Initialize CodeQL
166 uses: github/codeql-action/init@v4
167 with:
168 languages: go
169 - name: Autobuild
170 uses: github/codeql-action/autobuild@v4
171 with:
172 working-directory: ${{ matrix.tree }}
173 - name: Run CodeQL
174 uses: github/codeql-action/analyze@v4
175 with:
176 category: "/language:go"
177
178 analyze-rust:
179 name: Analyze Rust
180 runs-on: ubuntu-latest
181 needs: prepare
182 if: needs.prepare.outputs.rust == 'true'
183 strategy:
184 matrix:
185 tree:
186 - src/crates/jf
187 permissions:
188 security-events: write
189 steps:
190 - name: Git clone repository
191 uses: actions/checkout@v6
192 with:
193 submodules: recursive
194 fetch-depth: 0
195 - name: Initialize CodeQL
196 uses: github/codeql-action/init@v4
197 with:
198 languages: rust
199 - name: Autobuild
200 uses: github/codeql-action/autobuild@v4
201 with:
202 working-directory: ${{ matrix.tree }}
203 - name: Run CodeQL
204 uses: github/codeql-action/analyze@v4
205 with:
206 category: "/language:rust"