envoy/.github/workflows/codeql-push.yml at main · qerogram/envoy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
name: CodeQL/push

permissions:
  contents: read

on:
  push:
    paths:
    - include/**
    - source/common/**
    branches:
    - main
  pull_request:
    branches:
    - main

concurrency:
  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
  cancel-in-progress: true

env:
  SEARCH_FOLDER: //source/common/...


jobs:
  CodeQL-Build:
    permissions:
      actions: read
      contents: read
      # for github/codeql-action/analyze to upload SARIF results
      security-events: write
      pull-requests: read
    runs-on: ubuntu-22.04
    if: github.repository == 'envoyproxy/envoy'
    steps:
    - uses: envoyproxy/toolshed/gh-actions/bind-mounts@actions-v0.3.35
      if: |
        ! github.event.repository.private
      with:
        mounts: |
          - src: /mnt/workspace
            target: GITHUB_WORKSPACE
            chown: "runner:runner"
          - src: /mnt/runner-cache
            target: /home/runner/.cache
            chown: "runner:runner"
    - name: Free disk space
      if: |
        env.BUILD_TARGETS != ''
        && github.event.repository.private
      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.3.35
      with:
        to_remove: |
          /usr/local/.ghcup
          /usr/local/lib/android

    - name: Checkout repository
      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
      with:
        fetch-depth: 2

    - name: Get build targets
      run: |
        # TODO(phlax): Shift this to an action
        compare_head () {
            while IFS= read -r line; do
                if [[ -n "$line" ]]; then
                    bazel query "rdeps($SEARCH_FOLDER, $line, 1)"  2> /dev/null
                fi
            done < <(git diff --name-only HEAD "${1}" -- source/* include/*)
        }
        if [[ "$GIT_EVENT" == "pull_request" ]]; then
            git fetch "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" main 2> /dev/null
            TO_OTHER=FETCH_HEAD
        else
            TO_OTHER=HEAD^1
        fi
        BUILD_TARGETS="$(compare_head "$TO_OTHER" | grep -v '\.cc\|\.h' | sort -u | head -n 3)"
        echo 'BUILD_TARGETS<<EOF' >> $GITHUB_ENV
        echo "$BUILD_TARGETS" >> $GITHUB_ENV
        echo 'EOF' >> $GITHUB_ENV
      env:
        GIT_EVENT: ${{ github.event_name }}

    - name: Set default build target
      if: ${{ env.BUILD_TARGETS == '' }}
      run: |
        echo "MINIMAL_BUILD_TARGET=//source/common/common:assert_lib" > $GITHUB_ENV

    - name: Initialize CodeQL
      uses: github/codeql-action/init@cf1bb45a277cb3c205638b2cd5c984db1c46a412  # codeql-bundle-v4.31.7
      with:
        languages: cpp
        trap-caching: false

    - name: Install deps
      shell: bash
      run: |
       sudo apt-get -qq update --error-on=any
       sudo apt-get -qq install --yes \
           libtool libtinfo5 automake autoconf curl unzip
       # Note: the llvm/clang version should match the version specifed in:
       #  - bazel/repository_locations.bzl
       #  - .github/workflows/codeql-daily.yml
       #  - https://github.com/envoyproxy/envoy-build-tools/blob/main/build_container/build_container_ubuntu.sh#L84
       mkdir -p bin/clang18.1.8
       cd bin/clang18.1.8
       wget -q https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.8/clang+llvm-18.1.8-x86_64-linux-gnu-ubuntu-18.04.tar.xz
       tar -xf clang+llvm-18.1.8-x86_64-linux-gnu-ubuntu-18.04.tar.xz --strip-components 1

    - name: Build
      run: |
        bazel shutdown
        bazel build \
            -c fastbuild \
            --repo_env=BAZEL_LLVM_PATH="$(realpath bin/clang18.1.8)" \
            --spawn_strategy=local \
            --discard_analysis_cache \
            --nouse_action_cache \
            --features="-layering_check" \
            --config=clang \
            --config=ci \
            ${BUILD_TARGETS:-${MINIMAL_BUILD_TARGET}}
        echo -e "Built targets...\n${BUILD_TARGETS:-${MINIMAL_BUILD_TARGET}}"

    - name: Clean Artifacts
      run: |
        git clean -xdf

    - name: Perform CodeQL Analysis
      # if: ${{ env.BUILD_TARGETS != '' }}
      uses: github/codeql-action/analyze@cf1bb45a277cb3c205638b2cd5c984db1c46a412  # codeql-bundle-v4.31.7