mirror of
https://github.com/DarkFlippers/unleashed-firmware.git
synced 2026-10-13 19:37:17 +00:00
Mykhailo ShevchukandClaude Opus 5
a56750ffe7
CodeQL runs are still reporting green, but every run carries a failure-level annotation: "CodeQL Action major versions v1 and v2 have been deprecated." It is running on a compatibility shim. Move all four pins to v4, and bump checkout from v3 to v6 to match the rest of the repo and clear the Node 20 deprecation warning. Drop setup-python-dependencies, which the run log confirms has had no effect since CodeQL 2.16. Add a concurrency group so back-to-back pushes to dev no longer run several full firmware builds plus analyses at once. pr-comment.yml trusted pr_number.txt from the report artifact and validated it only as an integer. That artifact is written by a job that checks out and runs the PR's own code, so both the comment body and its destination were attacker-controlled: a malicious fork PR could make the privileged commenter post arbitrary markdown onto any open thread in the repo. Check the named PR's head SHA against the triggering run's head_sha, which comes from the event payload and cannot be forged, and refuse to comment on a mismatch. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
120 lines
4.0 KiB
YAML
120 lines
4.0 KiB
YAML
# For most projects, this workflow file will not need changing; you simply need
|
|
# to commit it to your repository.
|
|
#
|
|
# You may wish to alter this file to override the set of languages analyzed,
|
|
# or to provide custom queries or build logic.
|
|
#
|
|
# ******** NOTE ********
|
|
# We have attempted to detect the languages in your repository. Please check
|
|
# the `language` matrix defined below to confirm you have the correct set of
|
|
# supported CodeQL languages.
|
|
#
|
|
name: "CodeQL"
|
|
run-name: "CodeQL Analyze ${{ github.ref_name }} by @${{ github.ACTOR }}"
|
|
|
|
on:
|
|
push:
|
|
branches: ["dev"]
|
|
workflow_dispatch:
|
|
|
|
# A full firmware build plus CodeQL analysis is expensive; back-to-back pushes to
|
|
# dev shouldn't run several at once. Matches the other workflows in this repo.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze
|
|
# Runner size impacts CodeQL analysis time. To learn more, please see:
|
|
# - https://gh.io/recommended-hardware-resources-for-running-codeql
|
|
# - https://gh.io/supported-runners-and-hardware-resources
|
|
# - https://gh.io/using-larger-runners
|
|
# Consider using larger runners for possible analysis time improvements.
|
|
runs-on: [ "ubuntu-latest" ]
|
|
timeout-minutes: 60
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
security-events: write
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
language: ["cpp"]
|
|
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
|
|
# Use only 'java' to analyze code written in Java, Kotlin or both
|
|
# Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
|
|
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
|
|
env:
|
|
PATH_SARIF_DIR: ".github/results.sarif"
|
|
PATH_SARIF_FILE: ".github/results.sarif/${{ matrix.language }}.sarif"
|
|
FBT_NO_SYNC: 0
|
|
DIST_SUFFIX: "codeql"
|
|
WORKFLOW_BRANCH_OR_TAG: release-cfw
|
|
LANG_CATEGORY: "/language:${{matrix.language}}"
|
|
|
|
steps:
|
|
- name: Checkout Firmware Files
|
|
uses: actions/checkout@v6
|
|
with:
|
|
clean: "true"
|
|
submodules: "true"
|
|
fetch-depth: "0"
|
|
|
|
# Initializes the CodeQL tools for scanning.
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@v4
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
|
|
- name: Resolve CodeQL Build Env
|
|
uses: github/codeql-action/resolve-environment@v4
|
|
with:
|
|
language: ${{ matrix.language }}
|
|
#debug: true
|
|
|
|
- name: Build Firmware
|
|
shell: bash
|
|
if: ${{ success() }}
|
|
run: |
|
|
./fbt COMPACT=1 DEBUG=0 FBT_NO_SYNC=${{ env.FBT_NO_SYNC }}
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@v4
|
|
if: ${{ success() }}
|
|
with:
|
|
threads: 4
|
|
category: "${{ env.LANG_CATEGORY }}"
|
|
output: "${{ env.PATH_SARIF_DIR }}"
|
|
upload-database: false
|
|
upload: "failure-only" # disable the upload here - we will upload in a different action
|
|
|
|
- name: Filter dirs for SARIF
|
|
uses: advanced-security/filter-sarif@v1
|
|
if: ${{ success() }}
|
|
with:
|
|
# filter out all test files unless they contain a sql-injection vulnerability
|
|
patterns: |
|
|
-build/**
|
|
-dist/**
|
|
-toolchain/**
|
|
-lib/**
|
|
input: "${{ env.PATH_SARIF_FILE }}"
|
|
output: "${{ env.PATH_SARIF_FILE }}"
|
|
|
|
- name: Upload CodeQL SARIF
|
|
uses: github/codeql-action/upload-sarif@v4
|
|
if: ${{ success() }}
|
|
with:
|
|
category: "${{ env.LANG_CATEGORY }}"
|
|
sarif_file: "${{ env.PATH_SARIF_FILE }}"
|
|
|
|
# optional: for debugging the uploaded sarif
|
|
# - name: Upload loc as a Build Artifact
|
|
# uses: actions/upload-artifact@v3
|
|
# with:
|
|
# name: sarif-results
|
|
# path: sarif-results
|
|
# retention-days: 1
|