CI: ghcr image for apt deps + intensive wolfSSL/ibmswtpm2 build caching #29
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| branches: [ 'master', 'main', 'release/**' ] | |
| pull_request: | |
| branches: [ '*' ] | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| schedule: | |
| - cron: '0 7 * * 1' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| # Required so CodeQL can upload findings to the Security tab. | |
| security-events: write | |
| jobs: | |
| analyze: | |
| name: CodeQL (C, security) | |
| if: github.event_name != 'pull_request' || github.event.pull_request.draft == false | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 40 | |
| steps: | |
| - name: Checkout wolfTPM | |
| uses: actions/checkout@v4 | |
| # CodeQL's action is fiddly inside a custom container, so keep this job | |
| # on the host runner and just make apt resilient to mirror timeouts. | |
| - name: Install build tools | |
| uses: ./.github/actions/apt-retry | |
| with: | |
| packages: autoconf automake libtool | |
| # Full-feature wolfSSL so every wolfTPM code path is compiled and | |
| # therefore visible to CodeQL. | |
| - name: Setup wolfSSL | |
| uses: ./.github/actions/setup-wolfssl | |
| with: | |
| configure-flags: --enable-wolftpm --enable-pkcallbacks --enable-keygen | |
| cflags: -DWC_RSA_NO_PADDING | |
| prefix: /tmp/wolfssl-install | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: c-cpp | |
| build-mode: manual | |
| # security-extended runs only the security query suites. The default | |
| # "security-and-quality" pack also flags maintainability nits (long | |
| # functions, comment density), which we intentionally exclude here. | |
| queries: security-extended | |
| config-file: ./.github/codeql/codeql-config.yml | |
| - name: Build wolfTPM | |
| run: | | |
| ./autogen.sh | |
| ./configure --enable-swtpm --enable-fwtpm \ | |
| --with-wolfcrypt=/tmp/wolfssl-install | |
| make -j"$(nproc)" | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:c-cpp" |