envoy/.github/workflows/codeql-push.yml at main · wbpcode/envoy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
name: CodeQL/push

permissions:
  contents: read

on:
  push:
    branches:
    - main
  pull_request:
    branches:
    - main

concurrency:
  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
  cancel-in-progress: true

env:
  SEARCH_FOLDER: //source/common/...

jobs:
  targets:
    if: github.repository == 'envoyproxy/envoy'
    permissions:
      contents: read
    runs-on: ubuntu-22.04
    outputs:
      build_targets: ${{ steps.build-targets.outputs.targets }}
      cpp_changed: ${{ steps.detect.outputs.cpp_changed }}
    steps:
    - name: Checkout repository
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
      with:
        fetch-depth: 2

    - name: Detect C++ changes
      id: detect
      run: |
        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            git fetch --depth=1 "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" main 2>/dev/null
            TO_OTHER=FETCH_HEAD
        else
            TO_OTHER=HEAD^1
        fi
        echo "to_other=${TO_OTHER}" >> "$GITHUB_OUTPUT"
        if git diff --name-only HEAD "${TO_OTHER}" -- source/common/ envoy/ | grep -q .; then
            echo "cpp_changed=true" >> "$GITHUB_OUTPUT"
        else
            echo "cpp_changed=false" >> "$GITHUB_OUTPUT"
        fi

    - name: Get build targets
      id: build-targets
      if: steps.detect.outputs.cpp_changed == 'true'
      env:
        TO_OTHER: ${{ steps.detect.outputs.to_other }}
      run: |
        # TODO(phlax): Shift this to an action
        compare_head () {
            while IFS= read -r line; do
                if [[ -n "$line" ]]; then
                    bazel query "rdeps($SEARCH_FOLDER, $line, 1)" 2>/dev/null
                fi
            done < <(git diff --name-only HEAD "${TO_OTHER}" -- source/common/* envoy/*)
        }
        BUILD_TARGETS="$(compare_head | grep -v '\.cc\|\.h' | sort -u | head -n 3)"
        if [[ -z "$BUILD_TARGETS" ]]; then
            BUILD_TARGETS="//source/common/common:assert_lib"
        fi
        {
            echo 'targets<<EOF'
            sed 's|^//|@envoy//|' <<< "$BUILD_TARGETS"
            echo 'EOF'
        } >> "$GITHUB_OUTPUT"

  CodeQL-Build:
    if: needs.targets.outputs.cpp_changed == 'true'
    needs: targets
    permissions:
      actions: read
      contents: read
      security-events: write
      pull-requests: read
    uses: ./.github/workflows/_codeql.yml
    with:
      targets: ${{ needs.targets.outputs.build_targets }}

  CodeQL-Noop:
    if: needs.targets.outputs.cpp_changed != 'true'
    needs: targets
    permissions:
      actions: read
      contents: read
      security-events: write
    runs-on: ubuntu-22.04
    steps:
    - name: Checkout repository
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

    # No-op analysis satisfies Scorecard SAST when no C++ changes are present.
    - name: Initialize CodeQL (noop)
      uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463  # codeql-bundle-v4.36.1
      with:
        languages: javascript
        trap-caching: false

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463  # codeql-bundle-v4.36.1