Archive-Team
/
zfs
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 103 Wiki Activity
zfs/.github/workflows/codeql.yml

42 lines
853 B
YAML
Raw Normal View History

Add CodeQL workflow CodeQL is a static analyzer from github with a very low false positive rate. We have long wanted to have static analysis runs done on every pull request and using CodeQL, we can. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14087
2022-10-27 16:36:17 +00:00
name: "CodeQL"
on:
push:
pull_request:
jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: [ 'cpp', 'python' ]
steps:
Set multiple make jobs on CodeQL github workflows github supports 2 processors right now, although we use nproc instead of hard coding -j2, so if that ever increases, we will take advantage of it right away. Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com> Reviewed-by: Tino Reichardt <milky-zfs@mcmilk.de> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14217
2022-11-28 21:29:55 +00:00
- name: Set make jobs
run: |
echo "MAKEFLAGS=-j$(nproc)" >> $GITHUB_ENV
Add CodeQL workflow CodeQL is a static analyzer from github with a very low false positive rate. We have long wanted to have static analysis runs done on every pull request and using CodeQL, we can. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14087
2022-10-27 16:36:17 +00:00
- name: Checkout repository
uses: actions/checkout@v3
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
Switch to CodeQL to detect prohibited function use The LLVM/Clang developers pointed out that using the CPP to detect use of functions that our QA policies prohibit risks invoking undefined behavior. To resolve this, we configure CodeQL to detect forbidden function usage. Note that cpp in the context of CodeQL refers to C/C++, rather than the C PreProcessor, which C++ also uses. It really should have been written cxx, but that ship sailed a long time ago. This misuse of the term cpp is retained in the CodeQL configuration for consistency with upstream CodeQL. As a side benefit, verbose make no longer is a wall of text showing a bunch of CPP macros, which can make debugging slightly easier. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #15819 Closes #14134
2024-01-26 22:11:33 +00:00
config-file: .github/codeql-${{ matrix.language }}.yml
Add CodeQL workflow CodeQL is a static analyzer from github with a very low false positive rate. We have long wanted to have static analysis runs done on every pull request and using CodeQL, we can. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: George Melikov <mail@gmelikov.ru> Reviewed-by: Andrew Innes <andrew.c12@gmail.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #14087
2022-10-27 16:36:17 +00:00
languages: ${{ matrix.language }}
- name: Autobuild
uses: github/codeql-action/autobuild@v2
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
with:
category: "/language:${{matrix.language}}"