This repository was archived by the owner on Aug 27, 2021. It is now read-only.
Create codeql-analysis.yml #38
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| paths-ignore: | ||
| - '**/vendor/*' | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| name: "CodeQL" | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ main ] | ||
| pull_request: | ||
| # The branches below must be a subset of the branches above | ||
| branches: [ main ] | ||
| schedule: | ||
| - cron: '17 23 * * 3' # run at 08:17 AM Thursdays, JST | ||
|
Contributor
There was a problem hiding this comment. By the way, why
Collaborator
Author
There was a problem hiding this comment. I don't know why, but it's the time listed in the template 😕
Contributor
There was a problem hiding this comment. Okay, then let's change it as we like! |
||
|
|
||
| jobs: | ||
| analyze: | ||
| name: Analyze | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| actions: read | ||
| contents: read | ||
| security-events: write | ||
kmiya marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| language: [ 'cpp', 'python' ] | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v2 | ||
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v1 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| config-file: ./.github/codeql/codeql-config.yml | ||
|
|
||
| - name: Setup ROS environment | ||
| uses: ros-tooling/[email protected] | ||
| with: | ||
| required-ros-distributions: foxy | ||
|
|
||
| - name: Search packages in this repository | ||
| id: list_packages | ||
| run: | | ||
| echo ::set-output name=package_list::$(colcon list --names-only) | ||
|
|
||
| - name: Concat build_depends.repos | ||
| run: | | ||
| curl -sSL -H "Authorization: token ${{ secrets.REPO_TOKEN }}" https://raw.githubusercontent.com/tier4/autoware.iv/main/build_depends.repos | sed '1d' >> build_depends.repos | ||
|
|
||
| - name: Run action-ros-ci | ||
| id: action_ros_ci_step | ||
| uses: ros-tooling/[email protected] | ||
| with: | ||
| package-name: ${{ steps.list_packages.outputs.package_list }} | ||
| target-ros2-distro: foxy | ||
| vcs-repo-file-url: build_depends.repos | ||
| import-token: ${{ secrets.REPO_TOKEN }} | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v1 | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
IMHO: In the security point of view, it might be useful to scan the vendor packages as well. If the scan for vendor packages is found to be annoying, let's ignore them.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
How about testing vendor packages in another workflow?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah, that might be a perfect solution!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I also agree with @kmiya san 's opinion.
I'd like to see what it means to test in another workflow, does that mean it should be tested in the vendor's repository?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No, I meant to add
codeql-vendor-config.yml!