Skip to content

Commit f030a81

Browse files
kgrytekgryte
committed
build: remove autobuild step and analysis of C/C++
The default configuration is not tenable, as building every native add-on for each push and PR would lead to an enormous amt of consumed resources. Ideally, we would limit C/C++ analysis to only newly committed code.
1 parent f8f5c15 commit f030a81

File tree

1 file changed

+138
-48
lines changed

1 file changed

+138
-48
lines changed

‎.github/workflows/codeql.yml‎

Lines changed: 138 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,81 +1,171 @@
1-
# For most projects, this workflow file will not need changing; you simply need
2-
# to commit it to your repository.
1+
#/
2+
# @license Apache-2.0
33
#
4-
# You may wish to alter this file to override the set of languages analyzed,
5-
# or to provide custom queries or build logic.
4+
# Copyright (c) 2023 The Stdlib Authors.
65
#
7-
# ******** NOTE ********
8-
# We have attempted to detect the languages in your repository. Please check
9-
# the `language` matrix defined below to confirm you have the correct set of
10-
# supported CodeQL languages.
6+
# Licensed under the Apache License, Version 2.0 (the "License");
7+
# you may not use this file except in compliance with the License.
8+
# You may obtain a copy of the License at
119
#
12-
name: "CodeQL"
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing, software
13+
# distributed under the License is distributed on an "AS IS" BASIS,
14+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
# See the License for the specific language governing permissions and
16+
# limitations under the License.
17+
#/
18+
19+
name: CodeQL
1320

21+
# Workflow triggers:
1422
on:
15-
push:
16-
branches: [ "develop", "master" ]
17-
pull_request:
18-
branches: [ "develop", "master" ]
23+
# push:
24+
# branches: [ "develop", "master" ]
25+
# pull_request:
26+
# branches: [ "develop", "master" ]
1927
schedule:
20-
- cron: '16 2 * * 3'
28+
# Run the workflow once a week (Sunday at midnight):
29+
- cron: '0 0 * * 0'
2130

31+
# Workflow jobs:
2232
jobs:
33+
34+
# Define a job for performing CodeQL analysis...
2335
analyze:
24-
name: Analyze
25-
# Runner size impacts CodeQL analysis time. To learn more, please see:
26-
# - https://gh.io/recommended-hardware-resources-for-running-codeql
27-
# - https://gh.io/supported-runners-and-hardware-resources
28-
# - https://gh.io/using-larger-runners
29-
# Consider using larger runners for possible analysis time improvements.
30-
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
31-
timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
36+
37+
# Define a display name:
38+
name: 'Analyze'
39+
40+
# Define the type of virtual host machine.
41+
#
42+
# ## Notes
43+
#
44+
# - Runner size impacts CodeQL analysis time. To learn more, please see:
45+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
46+
# - https://gh.io/supported-runners-and-hardware-resources
47+
# - https://gh.io/using-larger-runners
48+
#
49+
# - For analysis time improvements, consider using larger runners.
50+
runs-on: ubuntu-latest
51+
52+
# Limit how long the job can run:
53+
timeout-minutes: 360
54+
55+
# Restrict the type of data which is accessible to this job:
3256
permissions:
3357
actions: read
3458
contents: read
3559
security-events: write
3660

61+
# Define the build matrix strategy...
3762
strategy:
63+
64+
# Specify whether to cancel all in-progress jobs if any matrix job fails:
3865
fail-fast: false
66+
67+
# Define the build matrix:
3968
matrix:
40-
language: [ 'c-cpp', 'javascript-typescript', 'python' ]
41-
# CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
42-
# Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
43-
# Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
44-
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
4569

70+
# CodeQL supports the following languages:
71+
#
72+
# [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
73+
#
74+
# Use only 'java-kotlin' to analyze code written in Java, Kotlin, or both.
75+
#
76+
# Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript, or both.
77+
language: [ 'javascript-typescript', 'python' ]
78+
79+
# Define the sequence of job steps:
4680
steps:
47-
- name: Checkout repository
48-
uses: actions/checkout@v3
4981

50-
# Initializes the CodeQL tools for scanning.
51-
- name: Initialize CodeQL
82+
# Checkout the repository:
83+
- name: 'Checkout repository'
84+
# Pin action to full length commit SHA corresponding to v4.1.0
85+
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
86+
with:
87+
# Specify whether to remove untracked files before checking out the repository:
88+
clean: false
89+
90+
# Limit clone depth to the most recent 100 commits:
91+
fetch-depth: 100
92+
93+
# Specify whether to download Git-LFS files:
94+
lfs: false
95+
timeout-minutes: 10
96+
97+
# Initialize CodeQL tools for scanning:
98+
- name: 'Initialize CodeQL'
99+
100+
# FIXME: pin action to full length commit SHA
52101
uses: github/codeql-action/init@v2
53102
with:
54103
languages: ${{ matrix.language }}
55-
# If you wish to specify custom queries, you can do so here or in a config file.
56-
# By default, queries listed here will override any specified in a config file.
57-
# Prefix the list here with "+" to use these queries and those in the config file.
58-
59-
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
60-
# queries: security-extended,security-and-quality
61104

105+
# Install compilers:
106+
- name: 'Install compilers'
107+
run: |
108+
sudo -E apt-add-repository -y "ppa:ubuntu-toolchain-r/test"
109+
sudo -E apt-get update -q
110+
sudo -E apt-get -yq --no-install-suggests --no-install-recommends --allow-downgrades --allow-remove-essential --allow-change-held-packages install binutils gcc-9 gcc-9-multilib g++-9 g++-9-multilib gfortran-9 gfortran-9-multilib
111+
mkdir -p $HOME/bin
112+
echo "$HOME/bin" >> $GITHUB_PATH
113+
ln -s /usr/bin/gcc-9 $HOME/bin/gcc
114+
ln -s /usr/bin/g++-9 $HOME/bin/g++
115+
ln -s /usr/bin/gfortran-9 $HOME/bin/gfortran
116+
timeout-minutes: 10
62117

63-
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
64-
# If this step fails, then you should remove it and run the build manually (see below)
65-
- name: Autobuild
66-
uses: github/codeql-action/autobuild@v2
118+
# Install Node.js:
119+
- name: 'Install Node.js'
120+
# Pin action to full length commit SHA corresponding to v3.8.1
121+
uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d
122+
with:
123+
node-version: '20' # 'lts/*'
124+
timeout-minutes: 5
67125

68-
# ℹ️ Command-line programs to run using the OS shell.
69-
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
126+
# Print debug info:
127+
- name: 'Print debug info'
128+
run: |
129+
echo 'PATH:'
130+
echo $PATH
131+
echo ''
132+
echo 'gcc:'
133+
gcc --version
134+
echo ''
135+
echo 'g++:'
136+
g++ --version
137+
echo ''
138+
echo 'gfortran:'
139+
gfortran --version
140+
echo ''
141+
echo 'Git:'
142+
git --version
143+
echo ''
144+
echo 'Node.js:'
145+
file $(which node)
146+
node --version
147+
node -p 'process.platform + "@" + process.arch'
148+
echo ''
149+
echo 'npm:'
150+
npm --version
151+
npm config get registry
152+
timeout-minutes: 2
70153

71-
# If the Autobuild fails above, remove it and uncomment the following three lines.
72-
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
154+
# Install dependencies (accounting for possible network failures, etc, when installing node module dependencies):
155+
- name: 'Install dependencies'
156+
run: |
157+
make install-node-modules || make install-node-modules || make install-node-modules
158+
timeout-minutes: 15
73159

74-
# - run: |
75-
# echo "Run, Build Application using script"
160+
# Build native add-ons:
161+
# - name: 'Build native add-ons'
162+
# run: |
76163
# ./location_of_script_within_repo/buildscript.sh
77164

78-
- name: Perform CodeQL Analysis
165+
# Perform CodeQL analysis:
166+
- name: 'Perform CodeQL Analysis'
167+
168+
# FIXME: pin action to full length commit SHA
79169
uses: github/codeql-action/analyze@v2
80170
with:
81171
category: "/language:${{matrix.language}}"

0 commit comments

Comments
 (0)