@@ -13,12 +13,12 @@ name: "CodeQL"
1313
1414on :
1515 push :
16- branches : [ "master", "feat/ci" ]
16+ branches : ["master", "feat/ci"]
1717 pull_request :
1818 # The branches below must be a subset of the branches above
19- branches : [ "master" ]
19+ branches : ["master"]
2020 schedule :
21- - cron : ' 43 14 * * *'
21+ - cron : " 43 14 * * *"
2222 workflow_dispatch :
2323
2424jobs :
2929 # - https://gh.io/supported-runners-and-hardware-resources
3030 # - https://gh.io/using-larger-runners
3131 # Consider using larger runners for possible analysis time improvements.
32- runs-on : ' ubuntu-latest'
32+ runs-on : " ubuntu-latest"
3333 timeout-minutes : 360
3434 permissions :
3535 actions : read
3939 strategy :
4040 fail-fast : false
4141 matrix :
42- language : [ ' cpp' ]
42+ language : [" cpp" ]
4343 # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
4444 # Use only 'java' to analyze code written in Java, Kotlin or both
4545 # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
@@ -52,137 +52,137 @@ jobs:
5252 RELEASE_VERSION : ${{ vars.RELEASE_VERSION }}
5353 TOKEN : ${{ secrets.DEPENDABOT }}
5454 REF_NAME : ${{ github.ref_name }}
55-
55+
5656 steps :
57- - name : Checkout Firmware Files
58- uses : actions/checkout@v3
59- with :
60- repository : " ${{ vars.REPO_UNLEASHED }}"
61- clean : " true"
62- submodules : " true"
63- ref : " dev"
64- fetch-depth : ' 0 '
65-
66- - name : Checkout Repo Files
67- uses : actions/checkout@v3
68- with :
69- repository : " ${{ vars.REPO_SELF }}"
70- clean : " true"
71- submodules : " true"
72- path : " ${{ env.OFW_PATH }}"
73- fetch-depth : ' 0 '
74-
75- - name : Remove other apps
76- shell : pwsh
77- if : ${{ success() }}
78- # rm to remove problem FAP which includes non-existent files
79- run : |
80- Remove-Item -Force -Recurse ./applications/debug -ErrorAction SilentlyContinue
81- Remove-Item -Force -Recurse ./applications/examples -ErrorAction SilentlyContinue
82-
83- name : Set refname
84- env :
85- REF_NAME : ${{ env.REF_NAME }}
86- shell : pwsh
87- run : |
88- $ReleaseVersion = ([string]::IsNullOrWhitespace($env:REF_NAME) ? 'dev' : $env:REF_NAME)
89- Write-Output ('REF_NAME={0}' -f $ReleaseVersion) >> $env:GITHUB_ENV
90-
91- # Initializes the CodeQL tools for scanning.
92- - name : Initialize CodeQL
93- uses : github/codeql-action/init@v2
94- with :
95- languages : ${{ matrix.language }}
96- setup-python-dependencies : true
97- # debug: true
98- # If you wish to specify custom queries, you can do so here or in a config file.
99- # By default, queries listed here will override any specified in a config file.
100- # Prefix the list here with "+" to use these queries and those in the config file.
101-
102- # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
103- # queries: security-extended,security-and-quality
104-
105- - name : Restore cached FW
106- id : cache-fw-restore
107- uses : actions/cache/restore@v3
108- with :
109- path : |
110- ./build
111- ./dist
112- ./firmware
113- key : ${{ runner.os }}-fw
114-
115- - name : Build Firmware
116- shell : bash
117- if : ${{ success() }}
118- env :
119- FBT_NO_SYNC : 0
120- DIST_SUFFIX : ' codeql'
121- WORKFLOW_BRANCH_OR_TAG : release-cfw
122- run : |
57+ - name : Checkout Firmware Files
58+ uses : actions/checkout@v3
59+ with :
60+ repository : " ${{ vars.REPO_UNLEASHED }}"
61+ clean : " true"
62+ submodules : " true"
63+ ref : " dev"
64+ fetch-depth : " 0 "
65+
66+ - name : Checkout Repo Files
67+ uses : actions/checkout@v3
68+ with :
69+ repository : " ${{ vars.REPO_SELF }}"
70+ clean : " true"
71+ submodules : " true"
72+ path : " ${{ env.OFW_PATH }}"
73+ fetch-depth : " 0 "
74+
75+ - name : Remove other apps
76+ shell : pwsh
77+ if : ${{ success() }}
78+ # rm to remove problem FAP which includes non-existent files
79+ run : |
80+ Remove-Item -Force -Recurse ./applications/debug -ErrorAction SilentlyContinue
81+ Remove-Item -Force -Recurse ./applications/examples -ErrorAction SilentlyContinue
82+
83+ - name : Set refname
84+ env :
85+ REF_NAME : ${{ env.REF_NAME }}
86+ shell : pwsh
87+ run : |
88+ $ReleaseVersion = ([string]::IsNullOrWhitespace($env:REF_NAME) ? 'dev' : $env:REF_NAME)
89+ Write-Output ('REF_NAME={0}' -f $ReleaseVersion) >> $env:GITHUB_ENV
90+
91+ # Initializes the CodeQL tools for scanning.
92+ - name : Initialize CodeQL
93+ uses : github/codeql-action/init@v2
94+ with :
95+ languages : ${{ matrix.language }}
96+ setup-python-dependencies : true
97+ # debug: true
98+ # If you wish to specify custom queries, you can do so here or in a config file.
99+ # By default, queries listed here will override any specified in a config file.
100+ # Prefix the list here with "+" to use these queries and those in the config file.
101+
102+ # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
103+ # queries: security-extended,security-and-quality
104+
105+ # - name: Restore cached FW
106+ # id: cache-fw-restore
107+ # uses: actions/cache/restore@v3
108+ # with:
109+ # path: |
110+ # ./build
111+ # ./dist
112+ # ./firmware
113+ # key: ${{ runner.os }}-fw
114+
115+ - name : Build Firmware
116+ shell : bash
117+ if : ${{ success() }}
118+ env :
119+ FBT_NO_SYNC : 0
120+ DIST_SUFFIX : " codeql"
121+ WORKFLOW_BRANCH_OR_TAG : release-cfw
122+ run : |
123123 ./fbt COMPACT=1 DEBUG=0 FBT_NO_SYNC=${{ env.FBT_NO_SYNC }}
124-
125- name : Build FAPs
126- shell : bash
127- if : ${{ success() }}
128- env :
129- FBT_NO_SYNC : 0
130- DIST_SUFFIX : ' codeql'
131- WORKFLOW_BRANCH_OR_TAG : release-cfw
132- # rm to remove problem FAP which includes non-existent files
133- run : |
124+
125+ - name : Build FAPs
126+ shell : bash
127+ if : ${{ success() }}
128+ env :
129+ FBT_NO_SYNC : 0
130+ DIST_SUFFIX : " codeql"
131+ WORKFLOW_BRANCH_OR_TAG : release-cfw
132+ # rm to remove problem FAP which includes non-existent files
133+ run : |
134134 ./fbt COMPACT=1 DEBUG=0 FBT_NO_SYNC=${{ env.FBT_NO_SYNC }} fap_dist
135135
136-
137- - name : Save cached FW
138- id : cache-primes- save
139- uses : actions/cache/save@v3
140- with :
141- path : |
142- ./build
143- ./dist
144- ./firmware
145- key : ${{ steps.cache-fw-restore.outputs.cache-primary-key }}
146- # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
147- # If this step fails, then you should remove it and run the build manually (see below)
148- # - name: Autobuild
149- # run: |
150- # echo "Run, Build Application using script"
151- # ls -lha
152- # ./fbt
153- # uses: github/codeql-action/autobuild@v2
154- - name : Resolve CodeQL Build Env
155- uses : github/codeql-action/resolve-environment@v2
156- with :
157- language : ${{ matrix.language }}
158-
159- - name : Perform CodeQL Analysis
160- uses : github/codeql-action/analyze@v2
161- env :
162- REF_NAME : ${{ env.REF_NAME }}
163- CHECKOUT_PATH : ${{ env.OFW_PATH }}
164- with :
165- category : " /language:${{matrix.language}}"
166- token : ${{ secrets.DEPENDABOT }}
167- # Must be used only with sha
168- # ref: ${{ env.REF_NAME }}
169- # sha: ${{ github.sha }}
170- output : " a${{ env.CHECKOUT_PATH }}/.github/results.sarif"
171- check_name : " _"
172- upload-database : false
173- upload : ' failure-only'
174- checkout_path : " ${{ github.workspace }}/${{ env.CHECKOUT_PATH }}"
175-
176- - name : Upload CodeQL SARIF
177- uses : github/codeql-action/upload-sarif@v2
178- env :
179- REF_NAME : ${{ env.REF_NAME }}
180- CHECKOUT_PATH : ${{ env.OFW_PATH }}
181- with :
182- category : " /language:${{matrix.language}}"
183- # token: ${{ secrets.DEPENDABOT }}
184- # Must be used only with sha
185- # ref: ${{ env.REF_NAME }}
186- # sha: ${{ github.sha }}
187- sarif_file : " a${{ env.CHECKOUT_PATH }}/.github/results.sarif"
188- checkout_path : " ${{ github.workspace }}/${{ env.CHECKOUT_PATH }}"
136+ # - name: Save cached FW
137+ # id: cache-primes-save
138+ # uses: actions/ cache/ save@v3
139+ # with:
140+ # path: |
141+ # ./build
142+ # ./dist
143+ # ./firmware
144+ # key: ${{ steps.cache-fw-restore.outputs.cache-primary-key }}
145+
146+ # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
147+ # If this step fails, then you should remove it and run the build manually (see below)
148+ # - name: Autobuild
149+ # run: |
150+ # echo "Run, Build Application using script"
151+ # ls -lha
152+ # ./fbt
153+ # uses: github/codeql-action/autobuild@v2
154+ - name : Resolve CodeQL Build Env
155+ uses : github/codeql-action/resolve-environment@v2
156+ with :
157+ language : ${{ matrix.language }}
158+
159+ - name : Perform CodeQL Analysis
160+ uses : github/codeql-action/analyze@v2
161+ env :
162+ REF_NAME : ${{ env.REF_NAME }}
163+ CHECKOUT_PATH : ${{ env.OFW_PATH }}
164+ with :
165+ category : " /language:${{matrix.language}}"
166+ token : ${{ secrets.DEPENDABOT }}
167+ # Must be used only with sha
168+ # ref: ${{ env.REF_NAME }}
169+ # sha: ${{ github.sha }}
170+ output : " a${{ env.CHECKOUT_PATH }}/.github/results.sarif"
171+ check_name : " _"
172+ upload-database : false
173+ upload : " failure-only"
174+ checkout_path : " ${{ github.workspace }}/${{ env.CHECKOUT_PATH }}"
175+
176+ - name : Upload CodeQL SARIF
177+ uses : github/codeql-action/upload-sarif@v2
178+ env :
179+ REF_NAME : ${{ env.REF_NAME }}
180+ CHECKOUT_PATH : ${{ env.OFW_PATH }}
181+ with :
182+ category : " /language:${{matrix.language}}"
183+ # token: ${{ secrets.DEPENDABOT }}
184+ # Must be used only with sha
185+ # ref: ${{ env.REF_NAME }}
186+ # sha: ${{ github.sha }}
187+ sarif_file : " a${{ env.CHECKOUT_PATH }}/.github/results.sarif"
188+ checkout_path : " ${{ github.workspace }}/${{ env.CHECKOUT_PATH }}"
0 commit comments