From 394159498d623ed7bea601245dda91832abc1683 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Tue, 7 Dec 2021 14:14:39 +0100 Subject: [PATCH 1/4] ci: add a missing SPDX header --- .lgtm.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.lgtm.yml b/.lgtm.yml index e27fa169c5..86fd0e742c 100644 --- a/.lgtm.yml +++ b/.lgtm.yml @@ -1,5 +1,6 @@ --- # vi: ts=2 sw=2 et: +# SPDX-License-Identifier: LGPL-2.1-or-later # Explicitly enable certain checks which are hidden by default queries: From 64f625a212f1e51f06506d62bdd40ef3d46b05cf Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Tue, 7 Dec 2021 12:06:29 +0100 Subject: [PATCH 2/4] ci: sync the list of CodeQL queries with LGTM --- .github/codeql-config.yml | 9 ++++++++ .github/codeql-custom.qls | 33 +++++++++++++++++++++++++++ .github/workflows/codeql-analysis.yml | 1 + 3 files changed, 43 insertions(+) create mode 100644 .github/codeql-config.yml create mode 100644 .github/codeql-custom.qls diff --git a/.github/codeql-config.yml b/.github/codeql-config.yml new file mode 100644 index 0000000000..a702e0bc7e --- /dev/null +++ b/.github/codeql-config.yml @@ -0,0 +1,9 @@ +--- +# vi: ts=2 sw=2 et: +# SPDX-License-Identifier: LGPL-2.1-or-later +name: "CodeQL config" + +disable-default-queries: false + +queries: + - uses: ./.github/codeql-custom.qls diff --git a/.github/codeql-custom.qls b/.github/codeql-custom.qls new file mode 100644 index 0000000000..c5b842cc1c --- /dev/null +++ b/.github/codeql-custom.qls @@ -0,0 +1,33 @@ +--- +# vi: ts=2 sw=2 et syntax=yaml: +# SPDX-License-Identifier: LGPL-2.1-or-later +# +# Note: it is not recommended to directly reference the respective queries from +# the github/codeql repository, so we have to "dance" around it using +# a custom QL suite +# See: +# - https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#running-additional-queries +# - https://github.com/github/codeql-action/issues/430#issuecomment-806092120 +# - https://codeql.github.com/docs/codeql-cli/creating-codeql-query-suites/ + +- import: codeql-suites/cpp-lgtm.qls + from: codeql/cpp-queries +- include: + id: + - cpp/bad-strncpy-size + - cpp/declaration-hides-variable + - cpp/inconsistent-null-check + - cpp/mistyped-function-arguments + - cpp/nested-loops-with-same-variable + - cpp/sizeof-side-effect + - cpp/suspicious-pointer-scaling + - cpp/suspicious-pointer-scaling-void + - cpp/suspicious-sizeof + - cpp/unsafe-strcat + - cpp/unsafe-strncat + - cpp/unsigned-difference-expression-compared-zero + - cpp/unused-local-variable + tags: + - "security" + - "correctness" + severity: "error" diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index db264e6490..ffb9be431f 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -41,6 +41,7 @@ jobs: uses: github/codeql-action/init@546b30f35ae5a3db0e0be1843008c2224f71c3b0 with: languages: ${{ matrix.language }} + config-file: ./.github/codeql-config.yml - run: sudo -E .github/workflows/unit_tests.sh SETUP From a6319961c9a1baa51abfc14e2b02497e0b459b97 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Tue, 7 Dec 2021 12:18:06 +0100 Subject: [PATCH 3/4] ci: run the CodeQL action also when its configuration changes Just to make sure we didn't break anything. --- .github/workflows/codeql-analysis.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index ffb9be431f..492061353f 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -7,6 +7,10 @@ name: "CodeQL" on: pull_request: branches: [main] + paths: + - .github/codeql-config.yml + - .github/codeql-custom.qls + - .github/workflows/codeql-analysis.yml # It takes the workflow approximately 30 minutes to analyze the code base # so it doesn't seem to make much sense to trigger it on every PR or commit. # It runs daily at 01:00 to avoid colliding with the Coverity workflow. @@ -20,7 +24,6 @@ jobs: analyze: name: Analyze runs-on: ubuntu-latest - if: github.event_name == 'schedule' || github.event.pull_request.user.login == 'dependabot[bot]' concurrency: group: ${{ github.workflow }}-${{ matrix.language }}-${{ github.ref }} cancel-in-progress: true From a3f0533ffcea4ded1d730cfac8e11261148d9d2f Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Tue, 7 Dec 2021 14:57:09 +0100 Subject: [PATCH 4/4] ci: pack-ify our custom CodeQL queries and enable them in Actions Unlike LGTM, the CodeQL Action requires the custom queries to have their own qlpack.yml file, so let's provide one. --- .github/codeql-config.yml | 5 ++++- .lgtm/cpp-queries/qlpack.yml | 11 +++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 .lgtm/cpp-queries/qlpack.yml diff --git a/.github/codeql-config.yml b/.github/codeql-config.yml index a702e0bc7e..447e53bd1b 100644 --- a/.github/codeql-config.yml +++ b/.github/codeql-config.yml @@ -6,4 +6,7 @@ name: "CodeQL config" disable-default-queries: false queries: - - uses: ./.github/codeql-custom.qls + - name: Enable possibly useful queries which are disabled by default + uses: ./.github/codeql-custom.qls + - name: systemd-specific CodeQL queries + uses: ./.lgtm/cpp-queries/ diff --git a/.lgtm/cpp-queries/qlpack.yml b/.lgtm/cpp-queries/qlpack.yml new file mode 100644 index 0000000000..a1a2dec6d6 --- /dev/null +++ b/.lgtm/cpp-queries/qlpack.yml @@ -0,0 +1,11 @@ +--- +# vi: ts=2 sw=2 et syntax=yaml: +# SPDX-License-Identifier: LGPL-2.1-or-later + +library: false +name: systemd/cpp-queries +version: 0.0.1 +dependencies: + codeql/cpp-all: "*" + codeql/suite-helpers: "*" +extractor: cpp