From c328e818fa833a510765547c80d6f0498c3ec939 Mon Sep 17 00:00:00 2001 From: roshan-ku Date: Mon, 13 Jul 2026 10:24:29 +0530 Subject: [PATCH 1/4] ci: add CodeQL Advanced workflow for C/C++ analysis Adds .github/workflows/codeql.yml, adapted from GitHub's default CodeQL Advanced setup template for this repo: - reduced language matrix to c-cpp (only language used in this repo) - build-mode set to manual, reusing the environment-check and build-dvledtx composite actions so CodeQL traces the same meson/ninja build the rest of CI performs - pinned actions/checkout and github/codeql-action to the same SHAs already used elsewhere in this repo's workflows - added concurrency group and job timeout consistent with other workflows in this repo --- .github/workflows/codeql.yml | 91 ++++++++++++++++++++++++++++++++++++ 1 file changed, 91 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..3facf94 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,91 @@ +# +# BSD 3-Clause License +# Copyright (C) 2026 Intel Corporation +# SPDX-License-Identifier: BSD-3-Clause +# +# CodeQL Advanced workflow for dvledtx (C/C++ project built with meson/ninja). +# +# This repository only contains C sources, so the language matrix has been +# reduced to `c-cpp` and the build mode set to `manual`, reusing the existing +# environment-check/build-dvledtx composite actions so CodeQL traces the same +# build the rest of CI performs. +name: "CodeQL Advanced" + +on: + # Allow this to also be manually triggered against a specific branch + workflow_dispatch: + inputs: + branch: + description: 'Branch to run on' + required: true + default: 'main' + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '19 7 * * 1' + +permissions: + contents: read + actions: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + timeout-minutes: 45 + permissions: + # required for all workflows + security-events: write + + # required to fetch internal or private CodeQL packs + packages: read + + # only required for workflows in private repositories + actions: read + contents: read + + strategy: + fail-fast: false + matrix: + include: + # CodeQL supports: 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', + # 'javascript-typescript', 'python', 'ruby', 'swift'. + # dvledtx is a C project built via meson/ninja, so `c-cpp` with a + # manual build step is required (autobuild does not detect meson). + - language: c-cpp + build-mode: manual + + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + ref: ${{ github.event.inputs.branch || github.sha }} + fetch-depth: 0 + persist-credentials: false + + - name: Environment check + uses: ./.github/actions/environment-check + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + + # `c-cpp` always requires a manual build so CodeQL can trace the + # compiler invocations produced by meson/ninja. + - if: matrix.build-mode == 'manual' + name: Build dvledtx + uses: ./.github/actions/build-dvledtx + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + category: "/language:${{matrix.language}}" From 00adaa298da20f336dc117e7c4094bd2be265d5f Mon Sep 17 00:00:00 2001 From: roshan-ku Date: Mon, 13 Jul 2026 11:08:09 +0530 Subject: [PATCH 2/4] ci: align CodeQL workflow with Coverity pattern - codeql.yml: simplified to match coverity.yml (weekly schedule + workflow_dispatch only, single job, minimal permissions), dropping the push/pull_request triggers and language matrix since this repo only analyzes c-cpp. - scan_on_demand.yml: added CodeQL init/build/analyze steps alongside the existing Coverity Scan step, so an on-demand scan also runs CodeQL. --- .github/workflows/codeql.yml | 62 +++++++++------------------- .github/workflows/scan_on_demand.yml | 17 ++++++++ 2 files changed, 36 insertions(+), 43 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3facf94..8790665 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -9,63 +9,40 @@ # reduced to `c-cpp` and the build mode set to `manual`, reusing the existing # environment-check/build-dvledtx composite actions so CodeQL traces the same # build the rest of CI performs. -name: "CodeQL Advanced" +name: CodeQL Scan on: - # Allow this to also be manually triggered against a specific branch - workflow_dispatch: - inputs: - branch: - description: 'Branch to run on' - required: true - default: 'main' - push: - branches: [ "main" ] - pull_request: - branches: [ "main" ] schedule: + # Weekly on Monday at 07:19 UTC - cron: '19 7 * * 1' + workflow_dispatch: -permissions: - contents: read - actions: read +permissions: {} concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true jobs: - analyze: - name: Analyze (${{ matrix.language }}) + codeql: + name: CodeQL Scan runs-on: ubuntu-latest timeout-minutes: 45 permissions: - # required for all workflows - security-events: write - - # required to fetch internal or private CodeQL packs - packages: read - - # only required for workflows in private repositories - actions: read contents: read - - strategy: - fail-fast: false - matrix: - include: - # CodeQL supports: 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', - # 'javascript-typescript', 'python', 'ruby', 'swift'. - # dvledtx is a C project built via meson/ninja, so `c-cpp` with a - # manual build step is required (autobuild does not detect meson). - - language: c-cpp - build-mode: manual + security-events: write # Required to upload SARIF results to GitHub Security tab steps: + - name: Clean up previous run + env: + WORKSPACE: ${{ github.workspace }} + run: | + find "$WORKSPACE" -mindepth 1 -maxdepth 1 -exec rm -rf {} + + - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: - ref: ${{ github.event.inputs.branch || github.sha }} + ref: ${{ github.sha }} fetch-depth: 0 persist-credentials: false @@ -76,16 +53,15 @@ jobs: - name: Initialize CodeQL uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} + languages: c-cpp + build-mode: manual # `c-cpp` always requires a manual build so CodeQL can trace the # compiler invocations produced by meson/ninja. - - if: matrix.build-mode == 'manual' - name: Build dvledtx + - name: Build dvledtx uses: ./.github/actions/build-dvledtx - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: - category: "/language:${{matrix.language}}" + category: "/language:c-cpp" diff --git a/.github/workflows/scan_on_demand.yml b/.github/workflows/scan_on_demand.yml index 3214385..b53e089 100644 --- a/.github/workflows/scan_on_demand.yml +++ b/.github/workflows/scan_on_demand.yml @@ -114,6 +114,23 @@ jobs: - name: Trivy Scan uses: ./.github/actions/analysis/trivy + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + languages: c-cpp + build-mode: manual + + # `c-cpp` always requires a manual build so CodeQL can trace the + # compiler invocations produced by meson/ninja. + - name: Build dvledtx (CodeQL) + uses: ./.github/actions/build-dvledtx + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + category: "/language:c-cpp" + - name: Coverity Scan uses: ./.github/actions/analysis/coverity env: From 1f2e3dffd79a56ac04246b6b656fc07a0ba41d6f Mon Sep 17 00:00:00 2001 From: roshan-ku Date: Mon, 13 Jul 2026 11:16:03 +0530 Subject: [PATCH 3/4] ci: extract CodeQL init/build/analyze into a reusable composite action Adds .github/actions/analysis/codeql/action.yml (Initialize CodeQL, Build dvledtx, Perform CodeQL Analysis), matching the pattern used by the other .github/actions/analysis/* actions (coverity, trivy, etc). codeql.yml and scan_on_demand.yml now both call this single composite action instead of duplicating the three inline steps. --- .github/actions/analysis/codeql/action.yml | 27 ++++++++++++++++++++++ .github/workflows/codeql.yml | 18 ++------------- .github/workflows/scan_on_demand.yml | 18 ++------------- 3 files changed, 31 insertions(+), 32 deletions(-) create mode 100644 .github/actions/analysis/codeql/action.yml diff --git a/.github/actions/analysis/codeql/action.yml b/.github/actions/analysis/codeql/action.yml new file mode 100644 index 0000000..1296205 --- /dev/null +++ b/.github/actions/analysis/codeql/action.yml @@ -0,0 +1,27 @@ +# +# BSD 3-Clause License +# Copyright (C) 2026 Intel Corporation +# SPDX-License-Identifier: BSD-3-Clause +# +name: 'CodeQL Scan' +description: 'Initialize CodeQL, build dvledtx, and perform CodeQL analysis for C/C++' + +runs: + using: composite + steps: + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + languages: c-cpp + build-mode: manual + + # `c-cpp` always requires a manual build so CodeQL can trace the + # compiler invocations produced by meson/ninja. + - name: Build dvledtx + uses: ./.github/actions/build-dvledtx + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + category: "/language:c-cpp" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 8790665..58d9afd 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -49,19 +49,5 @@ jobs: - name: Environment check uses: ./.github/actions/environment-check - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - with: - languages: c-cpp - build-mode: manual - - # `c-cpp` always requires a manual build so CodeQL can trace the - # compiler invocations produced by meson/ninja. - - name: Build dvledtx - uses: ./.github/actions/build-dvledtx - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - with: - category: "/language:c-cpp" + - name: CodeQL Scan + uses: ./.github/actions/analysis/codeql diff --git a/.github/workflows/scan_on_demand.yml b/.github/workflows/scan_on_demand.yml index b53e089..7e523ee 100644 --- a/.github/workflows/scan_on_demand.yml +++ b/.github/workflows/scan_on_demand.yml @@ -114,22 +114,8 @@ jobs: - name: Trivy Scan uses: ./.github/actions/analysis/trivy - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - with: - languages: c-cpp - build-mode: manual - - # `c-cpp` always requires a manual build so CodeQL can trace the - # compiler invocations produced by meson/ninja. - - name: Build dvledtx (CodeQL) - uses: ./.github/actions/build-dvledtx - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - with: - category: "/language:c-cpp" + - name: CodeQL Scan + uses: ./.github/actions/analysis/codeql - name: Coverity Scan uses: ./.github/actions/analysis/coverity From e0453c78a33b127683e30c1de12a0a338eb56866 Mon Sep 17 00:00:00 2001 From: roshan-ku Date: Mon, 13 Jul 2026 13:49:23 +0530 Subject: [PATCH 4/4] ci(scan_on_demand): make each scanner step independent Add if: always() to every analysis step so a failure in one scanner (e.g. CodeQL Scan) no longer skips the remaining steps (Coverity Scan, AFL Fuzz, libFuzzer, etc). Also guard the Coverity SARIF upload with a hashFiles() check so it no longer errors with 'Path does not exist' when the Coverity Scan step didn't run/produce a report. Root cause of the reported failure: the run was manually dispatched with the default 'branch: main' input while the CodeQL composite action only existed on this PR branch at the time, so the local './.github/actions/analysis/codeql' action wasn't found in the checked-out main ref. That step failing then cascaded into skipping Coverity Scan, which made the always()-guarded SARIF upload fail too. --- .github/workflows/scan_on_demand.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scan_on_demand.yml b/.github/workflows/scan_on_demand.yml index 7e523ee..3efa0de 100644 --- a/.github/workflows/scan_on_demand.yml +++ b/.github/workflows/scan_on_demand.yml @@ -103,21 +103,27 @@ jobs: cat "$REPORT" - name: ShellCheck + if: always() uses: ./.github/actions/analysis/shellcheck - name: zizmor Scan + if: always() uses: ./.github/actions/analysis/zizmor - name: cppcheck + if: always() uses: ./.github/actions/analysis/cppcheck - name: Trivy Scan + if: always() uses: ./.github/actions/analysis/trivy - name: CodeQL Scan + if: always() uses: ./.github/actions/analysis/codeql - name: Coverity Scan + if: always() uses: ./.github/actions/analysis/coverity env: COVERITY_TOKEN: ${{ secrets.COVERITY_TOKEN }} @@ -125,17 +131,19 @@ jobs: - name: Upload SARIF to Security tab uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - if: always() + if: always() && hashFiles('reports/coverity-results.sarif') != '' with: sarif_file: reports/coverity-results.sarif category: coverity - name: AFL Fuzz + if: always() uses: ./.github/actions/analysis/afl-fuzz with: max-seconds: '300' - name: libFuzzer + if: always() uses: ./.github/actions/analysis/libfuzzer with: max-seconds: '300'