RDKB-63154 RDKB-63013 Native Build Integration - #10
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds native build integration for RDKB components to enable Coverity static analysis and non-Yocto builds. It provides wrapper scripts that clone build tools from a separate repository and orchestrate dependency setup and component builds.
Changes:
- Added wrapper scripts (run_setup_dependencies.sh, run_native_build.sh) that manage build tool repository cloning and execute build processes
- Created configuration files (component_config.json, configure_options.conf) defining dependencies and build flags
- Added comprehensive README.md with usage instructions, troubleshooting guides, and architecture documentation
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 14 comments.
Show a summary per file
| File | Description |
|---|---|
| cov_docker_script/run_setup_dependencies.sh | Wrapper script that clones build_tools_workflows repo and executes dependency setup |
| cov_docker_script/run_native_build.sh | Wrapper script that verifies build tools exist and executes native component build |
| cov_docker_script/component_config.json | JSON configuration defining external dependencies (rbus, trower-base64, common-library, dbus) and component build settings |
| cov_docker_script/configure_options.conf | Autotools configuration file with CPPFLAGS, CFLAGS, and LDFLAGS for the build |
| cov_docker_script/README.md | Comprehensive documentation covering build pipeline, configuration format, troubleshooting, and workflow integration |
| .gitignore | Excludes build_tools_workflows/ and build/ directories from version control |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 7 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 9 changed files in this pull request and generated 7 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Build javascript-templates component in github rdkcentral | ||
| runs-on: ubuntu-latest | ||
| container: | ||
| image: ghcr.io/rdkcentral/docker-rdk-ci:latest | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: native build | ||
| run: | | ||
| # Trust the workspace | ||
| git config --global --add safe.directory '*' | ||
| # Pull the latest changes for the native build system | ||
| git submodule update --init --recursive --remote | ||
| # Build and install dependencies | ||
| chmod +x build_tools_workflows/cov_docker_script/setup_dependencies.sh | ||
| ./build_tools_workflows/cov_docker_script/setup_dependencies.sh ./cov_docker_script/component_config.json | ||
| # Build component | ||
| chmod +x build_tools_workflows/cov_docker_script/build_native.sh | ||
| ./build_tools_workflows/cov_docker_script/build_native.sh ./cov_docker_script/component_config.json "$(pwd)" | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.RDKCM_RDKE }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
In general, this issue is fixed by explicitly specifying a permissions block for the workflow or for individual jobs, restricting the GITHUB_TOKEN to the least privileges needed (often just contents: read for build/test workflows). This avoids inheriting potentially broad organization or repository defaults.
For this specific workflow, the safest and simplest fix without changing behavior is to add a permissions block at the workflow root level (just under name: and before on:) or at the jobs.build-jst-on-pr level. Since the job only checks out code and runs build scripts, it does not need write privileges to the repository; a minimal contents: read permission is sufficient. Adding it at the root will apply to all jobs (currently only build-jst-on-pr). No imports or additional methods are needed because this is a YAML configuration change only.
Concretely, in .github/workflows/native-build.yml, insert:
permissions:
contents: readbetween line 1 (name: ...) and line 3 (on:). This will constrain the default GITHUB_TOKEN (if used in the future) to read-only repository contents, while leaving the existing use of secrets.RDKCM_RDKE unchanged.
| @@ -1,5 +1,8 @@ | ||
| name: Build javascript-templates Component in Native Environment | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ main, 'sprint/**', 'release/**', develop ] |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "type": "cmake", | ||
| "cmake_flags": "-DBUILD_RDK=ON -DCMAKE_C_FLAGS=\"-I$HOME/usr/include/rdkb -I/usr/include/dbus-1.0 -I/usr/lib/x86_64-linux-gnu/dbus-1.0/include -DBUILD_RBUS\" -DCMAKE_EXE_LINKER_FLAGS='-Wl,--allow-shlib-undefined -Wl,--unresolved-symbols=ignore-all' -DCMAKE_C_STANDARD_LIBRARIES=\"-L$HOME/usr/local/lib\"" |
There was a problem hiding this comment.
In the native build, we should pass the direct flags using the .conf file. If CMake is not available in the native build, then we should introduce flexibility in the core scripts and use it accordingly.
RDKB-63154 RDKB-63013 Native Build Integration
Successful compilation log attached.
Jst_compilation_log.txt