Add a CodeQL analysis workflow. (#13812)
* Add a CodeQL analysis workflow. This currently is limited to checking C/C++ code and Python code. Analysis is run on PRs, pushes to the master branch, and as a scheduled run every Monday morning. The PR checks auto-skip analysis for languages that have no code changes. * Use a label to force running CodeQL checks on PRs. * Add config to skip things we don’t need to scan for Python. * Linting fixes. * Add notice in workflow for finding label to run all checks. * Fix CodeQL warnings on PR. * Skip vendored Python modules in Python scanning.
Austin S. Hemmelgarn committed
Oct 14, 2022 at 14:14 UTC
3eeebf7bace136a565a9c8d7040ebfc69283eacd
2 files changed
+127
.github/codeql/python-config.yml
new
+10
@@ -0,0 +1,10 @@
1
+paths-ignore:
2
+ - .github
3
+ - build_external/
4
+ - ml/dlib
5
+ - ml/json
6
+ - tests/api
7
+ - web/gui
8
+ - collectors/python.d.plugin/python_modules/pyyaml*
9
+ - collectors/python.d.plugin/python_modules/third_party
10
+ - collectors/python.d.plugin/python_modules/urllib3
.github/workflows/codeql.yml
new
+117
@@ -0,0 +1,117 @@
1
+---
2
+# Run CodeQL to analyze C/C++ and Python code.
3
+name: CodeQL
4
+on:
5
+ pull_request:
6
+ types: [opened, reopened, labeled, synchronize]
7
+ branches: [master]
8
+ push:
9
+ branches: [master]
10
+ schedule:
11
+ - cron: "27 2 * * 1"
12
+env:
13
+ DISABLE_TELEMETRY: 1
14
+concurrency:
15
+ group: codeql-${{ github.ref }}
16
+ cancel-in-progress: true
17
+jobs:
18
+ prepare:
19
+ name: Prepare Jobs
20
+ runs-on: ubuntu-latest
21
+ outputs:
22
+ cpp: ${{ steps.cpp.outputs.run }}
23
+ python: ${{ steps.python.outputs.run }}
24
+ steps:
25
+ - name: Clone repository
26
+ uses: actions/checkout@v3
27
+ with:
28
+ submodules: recursive
29
+ fetch-depth: 0
30
+ - name: Check if we should always run
31
+ id: always
32
+ run: |
33
+ if [ "${{ github.event_name }}" = "pull_request" ]; then
34
+ if [ "${{ contains(github.event.pull_request.labels.*.name, 'ci/codeql') }}" = "true" ]; then
35
+ echo '::set-output name=run::true'
36
+ echo '::notice::Found ci/codeql label, unconditionally running all CodeQL checks.'
37
+ else
38
+ echo '::set-output name=run::false'
39
+ fi
40
+ else
41
+ echo '::set-output name=run::true'
42
+ fi
43
+ - name: Check for C/C++ changes
44
+ id: cpp
45
+ run: |
46
+ if [ "${{ steps.always.outputs.run }}" = "false" ]; then
47
+ if git diff --name-only origin/${{ github.base_ref }} HEAD | grep -Eq '.*\.[ch](xx|\+\+)?' ; then
48
+ echo '::set-output name=run::true'
49
+ echo '::notice::C/C++ code has changed, need to run CodeQL.'
50
+ else
51
+ echo '::set-output name=run::false'
52
+ fi
53
+ else
54
+ echo '::set-output name=run::true'
55
+ fi
56
+ - name: Check for python changes
57
+ id: python
58
+ run: |
59
+ if [ "${{ steps.always.outputs.run }}" = "false" ]; then
60
+ if git diff --name-only origin/${{ github.base_ref }} HEAD | grep -Eq 'collectors/python.d.plugin/.*\.py' ; then
61
+ echo '::set-output name=run::true'
62
+ echo '::notice::Python code has changed, need to run CodeQL.'
63
+ else
64
+ echo '::set-output name=run::false'
65
+ fi
66
+ else
67
+ echo '::set-output name=run::true'
68
+ fi
69
+
70
+ analyze-cpp:
71
+ name: Analyze C/C++
72
+ runs-on: ubuntu-latest
73
+ needs: prepare
74
+ if: needs.prepare.outputs.cpp == 'true'
75
+ permissions:
76
+ security-events: write
77
+ steps:
78
+ - name: Git clone repository
79
+ uses: actions/checkout@v3
80
+ with:
81
+ submodules: recursive
82
+ fetch-depth: 0
83
+ - name: Initialize CodeQL
84
+ uses: github/codeql-action/init@v2
85
+ with:
86
+ languages: cpp
87
+ - name: Prepare environment
88
+ run: ./packaging/installer/install-required-packages.sh --dont-wait --non-interactive netdata
89
+ - name: Build netdata
90
+ run: ./netdata-installer.sh --dont-start-it --disable-telemetry --dont-wait --install /tmp/install --one-time-build
91
+ - name: Run CodeQL
92
+ uses: github/codeql-action/analyze@v2
93
+ with:
94
+ category: "/language:cpp"
95
+
96
+ analyze-python:
97
+ name: Analyze Python
98
+ runs-on: ubuntu-latest
99
+ needs: prepare
100
+ if: needs.prepare.outputs.python == 'true'
101
+ permissions:
102
+ security-events: write
103
+ steps:
104
+ - name: Git clone repository
105
+ uses: actions/checkout@v3
106
+ with:
107
+ submodules: recursive
108
+ fetch-depth: 0
109
+ - name: Initialize CodeQL
110
+ uses: github/codeql-action/init@v2
111
+ with:
112
+ config-file: ./.github/codeql/python-config.yml
113
+ languages: python
114
+ - name: Run CodeQL
115
+ uses: github/codeql-action/analyze@v2
116
+ with:
117
+ category: "/language:python"