Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions .github/workflows/native-build.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
name: Build javascript-templates Component in Native Environment

on:
push:
branches: [ main, 'sprint/**', 'release/**', develop ]
pull_request:
branches: [ main, 'sprint/**', 'release/**', topic/RDK*, develop ]

jobs:
build-jst-on-pr:
name: Build javascript-templates component in github rdkcentral
runs-on: ubuntu-latest
container:
image: ghcr.io/rdkcentral/docker-rdk-ci:latest

steps:
- name: Checkout code
uses: actions/checkout@v3

- name: native build
run: |
# Trust the workspace
git config --global --add safe.directory '*'
# Pull the latest changes for the native build system
git submodule update --init --recursive --remote
# Build and install dependencies
chmod +x build_tools_workflows/cov_docker_script/setup_dependencies.sh
./build_tools_workflows/cov_docker_script/setup_dependencies.sh ./cov_docker_script/component_config.json
# Build component
chmod +x build_tools_workflows/cov_docker_script/build_native.sh
./build_tools_workflows/cov_docker_script/build_native.sh ./cov_docker_script/component_config.json "$(pwd)"
env:
GITHUB_TOKEN: ${{ secrets.RDKCM_RDKE }}
Comment on lines +11 to +33

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 6 months ago

In general, this issue is fixed by explicitly specifying a permissions block for the workflow or for individual jobs, restricting the GITHUB_TOKEN to the least privileges needed (often just contents: read for build/test workflows). This avoids inheriting potentially broad organization or repository defaults.

For this specific workflow, the safest and simplest fix without changing behavior is to add a permissions block at the workflow root level (just under name: and before on:) or at the jobs.build-jst-on-pr level. Since the job only checks out code and runs build scripts, it does not need write privileges to the repository; a minimal contents: read permission is sufficient. Adding it at the root will apply to all jobs (currently only build-jst-on-pr). No imports or additional methods are needed because this is a YAML configuration change only.

Concretely, in .github/workflows/native-build.yml, insert:

permissions:
  contents: read

between line 1 (name: ...) and line 3 (on:). This will constrain the default GITHUB_TOKEN (if used in the future) to read-only repository contents, while leaving the existing use of secrets.RDKCM_RDKE unchanged.

Suggested changeset 1
.github/workflows/native-build.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/native-build.yml b/.github/workflows/native-build.yml
--- a/.github/workflows/native-build.yml
+++ b/.github/workflows/native-build.yml
@@ -1,5 +1,8 @@
 name: Build javascript-templates Component in Native Environment
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ main, 'sprint/**', 'release/**', develop ]
EOF
@@ -1,5 +1,8 @@
name: Build javascript-templates Component in Native Environment

permissions:
contents: read

on:
push:
branches: [ main, 'sprint/**', 'release/**', develop ]
Copilot is powered by AI and may make mistakes. Always verify output.
4 changes: 4 additions & 0 deletions .gitmodules
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
[submodule "build_tools_workflows"]
path = build_tools_workflows
url = https://github.com/rdkcentral/build_tools_workflows
branch = develop
1 change: 1 addition & 0 deletions build_tools_workflows
Submodule build_tools_workflows added at 3d000d
3 changes: 3 additions & 0 deletions cov_docker_script/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
# 🔧 Coverity Native Build System for RDK-B Components

The documentation and source for the RDK-B native build system has been centralized in [rdkcentral/build_tools_workflows](https://github.com/rdkcentral/build_tools_workflows/blob/develop/cov_docker_script/README.md)
99 changes: 99 additions & 0 deletions cov_docker_script/component_config.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
{
"_comment": "Component Build Configuration for Coverity/Native Builds",
"_version": "2.0",
"_description": "Defines dependencies and build settings for the native component",

"dependencies": {
"_comment": "External repositories needed by this component",
"repos": [
{
"name": "rbus",
"repo": "https://github.com/rdkcentral/rbus.git",
"branch": "v2.7.0",
"header_paths": [
{ "source": "include", "destination": "$HOME/usr/include/rdkb/rbus" },
{ "source": "src/rbus", "destination": "$HOME/usr/include/rdkb/rbus" },
{ "source": "src/core", "destination": "$HOME/usr/include/rdkb/rbus" },
{ "source": "src/rtmessage", "destination": "$HOME/usr/include/rdkb/rtmessage" }
],
"build": {
"type": "cmake",
"build_dir": "build",
"cmake_flags": "-DCMAKE_INSTALL_PREFIX=$HOME/usr -DCMAKE_PREFIX_PATH=/usr -DBUILD_FOR_DESKTOP=ON -DCMAKE_BUILD_TYPE=Debug"
}
},
{
"name": "trower-base64",
"repo": "https://github.com/xmidt-org/trower-base64.git",
"branch": "v1.2.7",
"header_paths": [
{ "source": "include", "destination": "$HOME/usr/include/rdkb" }
],
"build": {
"type": "commands",
"commands": [
"meson setup build --prefix=$HOME/usr",
"meson compile -C build"
]
}
},
{
"name": "common-library",
"repo": "https://github.com/rdkcentral/common-library.git",
"branch": "develop",
"header_paths": [
{ "source": "source/ccsp/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/ccsp/components/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/ccsp/custom", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/cosa/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/cosa/include/linux", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/cosa/include/linux", "destination": "$HOME/usr/include/rdkb/linux" },
{ "source": "source/cosa/package/slap/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/debug_api/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/util_api/http/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/util_api/ansc/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/ccsp/components/common/MessageBusHelper/include", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/dm_pack", "destination": "$HOME/usr/include/rdkb" },
{ "source": "source/ccsp/components/common/PoamIrepFolder", "destination": "$HOME/usr/include/rdkb" }
],
"source_patches": [
{
"file": "source/ccsp/include/ccsp_message_bus.h",
"search": "typedef struct _CCSP_MESSAGE_BUS_CONNECTION",
"replace": "typedef struct DBusLoop DBusLoop;\n\ntypedef struct _CCSP_MESSAGE_BUS_CONNECTION"
},
{
"file": "$HOME/usr/include/rdkb/ccsp_message_bus.h",
"search": "typedef struct _CCSP_MESSAGE_BUS_CONNECTION",
"replace": "typedef struct DBusLoop DBusLoop;\n\ntypedef struct _CCSP_MESSAGE_BUS_CONNECTION"
Comment thread
Suganya-Sugumar marked this conversation as resolved.
}
],
"build": {
"type": "script",
"script": "build_tools_workflows/cov_docker_script/common_external_build.sh"
}
},
{
"name": "dbus",
"repo": "https://github.com/deepin-community/dbus.git",
"branch" : "master",
Comment thread
Suganya-Sugumar marked this conversation as resolved.
"build": {
"type": "cmake",
"build_dir": "build",
"cmake_flags": "-DCMAKE_INSTALL_PREFIX=$HOME/usr -DCMAKE_PREFIX_PATH=/usr -DBUILD_FOR_DESKTOP=ON -DCMAKE_BUILD_TYPE=Debug"
Comment thread
Suganya-Sugumar marked this conversation as resolved.
}
}
Comment thread
Suganya-Sugumar marked this conversation as resolved.
]
},

"native_component": {
"_comment": "Configuration for the main component being built",
"name": "javascript-templates",
"include_path": "$HOME/usr/include/rdkb",
"lib_output_path": "$HOME/usr/local/lib",
"build": {
"type": "cmake",
"configure_options_file": "cov_docker_script/configure_options.conf"
}
}
}
43 changes: 43 additions & 0 deletions cov_docker_script/configure_options.conf
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
# Javascript-templates Configure Options
# This file contains autotools configure options for the javascript-templates component
# Each section can be edited independently for better maintainability

# ============================================================================
# CPPFLAGS - Preprocessor flags (includes and defines)
# ============================================================================
[CPPFLAGS]
# Include paths
-I$HOME/usr/include/rdkb/
-I/usr/include/dbus-1.0
-I/usr/lib/x86_64-linux-gnu/dbus-1.0/include

# ANSC framework defines
-D_ANSC_USER
-D_ANSC_LINUX
-D_ANSC_LITTLE_ENDIAN_

# Build system
-DBUILD_RDK=ON
Comment thread
Suganya-Sugumar marked this conversation as resolved.

# Standard defines
-D_GNU_SOURCE
-D__USE_XOPEN

# ============================================================================
# CFLAGS - Compiler flags
# ============================================================================
[CFLAGS]
-ffunction-sections
-fdata-sections
-fomit-frame-pointer
-fno-strict-aliasing

# ============================================================================
# LDFLAGS - Linker flags
# ============================================================================
[LDFLAGS]
-L$HOME/usr/local/lib
-L/usr/lib/x86_64-linux-gnu
-Wl,--allow-shlib-undefined
-Wl,--unresolved-symbols=ignore-all
-Wl,--no-as-needed
Loading