From b29b5982d7e8a836ca08d05c67464a2e30afdd1a Mon Sep 17 00:00:00 2001 From: Zou Guangxian Date: Fri, 6 Mar 2026 18:03:58 +0000 Subject: [PATCH] chore: add CodeQL analysis and ShellCheck linting workflow --- .devcontainer/post-create | 20 ++--- .github/workflows/codeql.yml | 150 ++++++++++++++++------------------- bootstrap | 3 +- 3 files changed, 81 insertions(+), 92 deletions(-) diff --git a/.devcontainer/post-create b/.devcontainer/post-create index 822da07..c9d62af 100755 --- a/.devcontainer/post-create +++ b/.devcontainer/post-create @@ -1,20 +1,20 @@ -#!/usr/bin/env sh +#!/usr/bin/env bash set -e # Function to patch the code script patch_code() { - # Check if the code binary path doesn't exist or if cursor handling logic is already present - local bin_path="$1" - [ ! -f "$bin_path" ] || grep -q 'cursor' "$bin_path" && return + # Check if the code binary path doesn't exist or if cursor handling logic is already present + local bin_path="$1" + [ ! -f "$bin_path" ] || grep -q 'cursor' "$bin_path" && return - # Insert the cursor handling logic before the specified line - sed -i '/exec code-insiders/a \ + # Insert the cursor handling logic before the specified line + sed -i '/exec code-insiders/a \ elif [ "$(command -v cursor)" ]; then \ exec cursor "$@"' "$bin_path" - if [ $? -ne 0 ]; then - echo "Error: Failed to insert cursor handling logic into $bin_path." - fi + if [ $? -ne 0 ]; then + echo "Error: Failed to insert cursor handling logic into $bin_path." + fi } -patch_code /usr/local/bin/code \ No newline at end of file +patch_code /usr/local/bin/code diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ffa0a1c..8b807b0 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,101 +1,89 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: "CodeQL Advanced" +name: CodeQL on: push: - branches: [ "main" ] + branches: + - main + - dev pull_request: - branches: [ "main" ] + branches: + - main + - dev + merge_group: + branches: + - main + - dev schedule: - - cron: '27 12 * * 4' + - cron: "27 12 * * 4" + +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +permissions: + contents: read + security-events: write + packages: read + actions: read jobs: analyze: name: Analyze (${{ matrix.language }}) - # Runner size impacts CodeQL analysis time. To learn more, please see: - # - https://gh.io/recommended-hardware-resources-for-running-codeql - # - https://gh.io/supported-runners-and-hardware-resources - # - https://gh.io/using-larger-runners (GitHub.com only) - # Consider using larger runners or machines with greater resources for possible analysis time improvements. - runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} - permissions: - # required for all workflows - security-events: write - - # required to fetch internal or private CodeQL packs - packages: read - - # only required for workflows in private repositories - actions: read - contents: read + runs-on: ubuntu-latest + timeout-minutes: 30 strategy: fail-fast: false matrix: include: - - language: actions - build-mode: none - - language: rust - build-mode: none - # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift' - # Use `c-cpp` to analyze code written in C, C++ or both - # Use 'java-kotlin' to analyze code written in Java, Kotlin or both - # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both - # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, - # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. - # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how - # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages + - language: actions + build-mode: none + - language: rust + build-mode: none + steps: - - name: Checkout repository - uses: actions/checkout@v4 + - name: Checkout repository + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - # Add any setup steps before running the `github/codeql-action/init` action. - # This includes steps like installing compilers or runtimes (`actions/setup-node` - # or others). This is typically only required for manual builds. - # - name: Setup runtime (example) - # uses: actions/setup-example@v1 + - name: Initialize CodeQL + uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + queries: security-extended - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v4 - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4 + with: + category: "/language:${{ matrix.language }}" - # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality + shellcheck: + name: Shell Script Lint + runs-on: ubuntu-latest + timeout-minutes: 5 - # If the analyze step fails for one of the languages you are analyzing with - # "We were unable to automatically build your code", modify the matrix above - # to set the build mode to "manual" for that language. Then modify this step - # to build your code. - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - name: Run manual build steps - if: matrix.build-mode == 'manual' - shell: bash - run: | - echo 'If you are using a "manual" build mode for one or more of the' \ - 'languages you are analyzing, replace this with the commands to build' \ - 'your code, for example:' - echo ' make bootstrap' - echo ' make release' - exit 1 + permissions: + contents: read + security-events: write - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 - with: - category: "/language:${{matrix.language}}" + steps: + - name: Checkout repository + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + + - name: Run ShellCheck + uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0 + with: + scandir: "." + format: gcc + severity: warning + + all-checks: + name: CodeQL + needs: [analyze, shellcheck] + if: ${{ !cancelled() }} + runs-on: ubuntu-latest + steps: + - name: Conclusion + run: | + jq -C <<< '${{ toJson(needs) }}' + jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}' diff --git a/bootstrap b/bootstrap index dca74ff..21815ad 100755 --- a/bootstrap +++ b/bootstrap @@ -4,7 +4,8 @@ set -eu -o pipefail TARGET_OS="" -readonly ROOT="$(git rev-parse --show-toplevel 2>/dev/null || (cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd))" +ROOT="$(git rev-parse --show-toplevel 2>/dev/null || (cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd))" +readonly ROOT readonly TMPDIR=${TMPDIR:-/tmp} readonly RISCV_DIR="$HOME/.local/riscv"