[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 1/2] codeql: add support for analyzing C, Python and Go
- To: <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Roger Pau Monne <roger.pau@xxxxxxxxxx>
- Date: Fri, 25 Feb 2022 16:19:30 +0100
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Lewhc8J3qtovseDH6VSo3lWF3jCtfrt5D8YHKkcpQFU=; b=aZetWlHAY6f98Rodk8tfeSjp8QM59B1n3O2jcyKaj3pIJY2n1VxujCBIPJMMwWrnuvm8zS4OnC3GOkA/utCwtRde/RzGIDgpz5JyjgHmGkiRyIuSbIgtovB0vSXah+E7v1bZoolYzrfE/c/ZKI0B/g9B4Z5sNGwI3F2/UN1rZN7OptKTSEDQ6tvjvf+MzqBzW31ou7toTo8fVfDVfiTV9nVCCDimrmAC4E8FGmrYcEsovG7Xy0UmEvJY7ScIaDJESHw1jWyxFuW43sYtShb35S+zAxgL+rn1GdoYlu2UA/QL7n7gD93ksabUBri5DHQfjyHnC+nd+tyvoh6XG2++Vw==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=M4p00J74PvYcXoqXJrFE1wlWVQb5r+BcXoG+V58L6yWxCodQgCHcRcJP6V0Je/mTVFz0HsPPZHb3QqxL/3dAmjSq5WxG3jY7rf1W11jBJXbywH598JpmHN7WSf1Ma4MYUvlTiCRaD6URnkHPrEmkwye6Ux8NHbiIaXrNp5XpqM0pUT9QUO7LuDZfm1FyC59L2uby5Iy0sf0ILfemlN3kDIEQeIbwC7K0VvRfoVjI74PYudxsNVgKotr64Q9hpMYpdcA7xG6eSNmg1eI3LvpOg0nnojbr56hbJsz8TueRykyidTEUOSXtE1dKARkfqRdu35PDEHFGTyjwM3oERkrYww==
- Authentication-results: esa3.hc3370-68.iphmx.com; dkim=pass (signature verified) header.i=@citrix.onmicrosoft.com
- Cc: Roger Pau Monne <roger.pau@xxxxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, George Dunlap <george.dunlap@xxxxxxxxxx>, Jan Beulich <jbeulich@xxxxxxxx>, Julien Grall <julien@xxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Wei Liu <wl@xxxxxxx>
- Delivery-date: Fri, 25 Feb 2022 15:20:03 +0000
- Ironport-data: A9a23:qYkdqqKvAQIQa2h7FE+R75UlxSXFcZb7ZxGr2PjKsXjdYENS0GNRm GsbCjqFa6qPZmX1eYh1bISy/EoOv8fTz4RiGwRlqX01Q3x08seUXt7xwmUcns+xwm8vaGo9s q3yv/GZdJhcokf0/0vrav67xZVF/fngqoDUUYYoAQgsA148IMsdoUg7wbRh2NQ12YLR7z6l4 rseneWOYDdJ5BYsWo4kw/rrRMRH5amaVJsw5zTSVNgT1LPsvyB94KE3fMldG0DQUIhMdtNWc s6YpF2PEsE1yD92Yj+tuu6TnkTn2dc+NyDW4pZdc/DKbhSvOkXee0v0XRYRQR4/ttmHozx+4 JJwuMGpcgVxBfznle0ACUV/CGY9JIQTrdcrIVDn2SCS50jPcn+qyPRyFkAme4Yf/46bA0kXq 6ZecmpUKEne2aTmm9pXScE17ignBNPsM44F/Glp0BnSDOo8QICFSKLPjTNd9Gls15EeTKiED yYfQWRQQT7sMx5ABhQOEbIAmuLriFzAXQQN/Tp5ooJoujOOnWSdyoPFK8HJc9aHQcFUmEewp W/c+Wn9RBYAO7S31j6t4n+qwOjVkkvTWp8WFbC+3u5nhhuU3GN7IA0bUx63rOe0jma6WslDM AoE9yw2t68w+Ue3CN7nUHWQonSJoxodUNp4CPAh5UeGza+83uqCLjFaFHgbMoVg7ZJoA2xxv rOUoz/3LXtSveCMcnDFzea/oDqvY3QyNihBfAZRGGPp/OLfiI00ixvOSPNqH6i0ksD5FFnM/ tyakMQtr+5N1JBWjs1X6XiC2mvx/caREmbZ8y2KBjrN0+9vWGKyi2VEA3D/5O0IEouWR0LpU JMsy5nHt7Bm4X1geUWwrAQx8FOBu6ft3N702wcH83wdG9KFoS/LkWd4umwWGauRGpxYEQIFm WeK0e+r2LddPWGxcYh8aJ+rBsIhwMDITIq5C6+IN4YTOsApLGdrGR2Cg2bKjggBd2B2zMkC1 WqzK57wXR7294w9pNZJewvt+eBynX1vrY8ibZv60w6mwdKjiI29Et843K+1Rrlhtsus+VyNm /4Gbpfi40gPAYXWP3iMmaZOfA9iEJTOLc2vwyChXrXYeVQO9aBII6K5/I7NjKQ+x/UFzrqTp yrlMqKaoXKm7UD6xcyxQikLQJvkXIplrGJ9OiopPF2y3GMkb5rp56AaH6bbt5F+nAC/5ZaYl 8U4Rvg=
- Ironport-hdrordr: A9a23:O0hgnqoYywXifAftIrZS13UaV5oveYIsimQD101hICG9Ffbo8P xG/c5rsSMc7Qx7ZJhOo7y90cW7Lk80lqQU3WByB9mftWDd0QPDQb2KhrGC/xTQXwH46+5Bxe NBXsFFebjN5IFB/KXHCd+DYrQd/OU=
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
Introduce CodeQL support for Xen and analyze the C, Python and Go
files.
Note than when analyzing Python or Go we avoid building the hypervisor
and only build the tools.
Requested-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
---
TBD: there's no limit in the number of scans here unlike Coverity, but
each takes github minutes and we are limited to 2000 per month IIRC.
We might want to not perform a scan for each push.
TBD: should we also disable the shim build? I'm not sure there's much
value in analyzing it.
---
.github/workflows/codeql.yml | 59 ++++++++++++++++++++++++++++++++++++
1 file changed, 59 insertions(+)
create mode 100644 .github/workflows/codeql.yml
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000000..5bfe478983
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,59 @@
+name: CodeQL
+
+on:
+ workflow_dispatch:
+ push:
+ branches: [staging]
+ schedule:
+ - cron: '18 10 * * WED,SUN' # Bi-weekly at 10:18 UTC
+
+jobs:
+ analyse:
+
+ strategy:
+ matrix:
+ language: [ 'cpp', 'python', 'go' ]
+
+ runs-on: ubuntu-latest
+
+ steps:
+ - name: Install build dependencies
+ run: |
+ sudo apt-get install -y wget git \
+ libbz2-dev build-essential \
+ zlib1g-dev libncurses5-dev iasl \
+ libbz2-dev e2fslibs-dev uuid-dev libyajl-dev \
+ autoconf libtool liblzma-dev \
+ python3-dev golang python-dev libsystemd-dev
+
+ - uses: actions/checkout@v2
+ with:
+ ref: staging
+
+ - name: Configure Xen
+ run: |
+ ./configure --with-system-qemu=/bin/true \
+ --with-system-seabios=/bin/true \
+ --with-system-ovmf=/bin/true
+
+ - name: Pre build stuff
+ run: |
+ make -j`nproc` mini-os-dir
+
+ - uses: github/codeql-action/init@v1
+ with:
+ languages: ${{matrix.language}}
+ queries: security-and-quality
+
+ - if: matrix.language == 'cpp'
+ name: Full Build
+ run: |
+ make -j`nproc` build-xen build-tools
+ make -j`nproc` -C extras/mini-os/
+
+ - if: matrix.language == 'python' || matrix.language == 'go'
+ name: Tools Build
+ run: |
+ make -j`nproc` build-tools
+
+ - uses: github/codeql-action/analyze@v1
--
2.34.1
|
