refcol: add JSON trace output mode to the ITT API reference collector… #514
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CodeQL" | |
| on: | |
| push: | |
| branches: ["master"] | |
| pull_request: | |
| branches: ["master"] | |
| schedule: | |
| # Run every Monday at midnight | |
| - cron: "0 0 * * 1" | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ["cpp", "python"] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 | |
| with: | |
| category: "/language:${{matrix.language}}" | |
| - name: Generate CodeQL Security Report | |
| uses: rsdmike/github-security-report-action@a149b24539044c92786ec39af8ba38c93496495d # v3.0.4 | |
| with: | |
| template: report | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload CodeQL Security Report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: codeql-report-${{ matrix.language }} | |
| path: report.pdf | |
| analyze_rust: | |
| name: Analyze (Rust) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install clippy | |
| run: rustup component add clippy | |
| - name: Install cargo-binstall | |
| uses: cargo-bins/cargo-binstall@dc19f1e48450eefe5a29b8da6c6b00a87d730b37 # 1.18.1 | |
| - name: Install dependencies | |
| run: cargo binstall --no-confirm clippy-sarif sarif-fmt | |
| - name: Run clippy | |
| working-directory: rust | |
| run: | | |
| cargo clippy --all-features --message-format=json > clippy.json | |
| sed --in-place 's/"file_name":"itt/"file_name":"rust\/itt/g' clippy.json | |
| clippy-sarif --input clippy.json --output clippy.sarif | |
| continue-on-error: true | |
| - name: Print SARIF | |
| run: sarif-fmt --input rust/clippy.sarif | |
| - name: Upload analysis | |
| uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 | |
| with: | |
| sarif_file: rust/clippy.sarif | |
| wait-for-processing: true | |
| analyze_bandit: | |
| name: Analyze (Bandit Scan) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Install dependencies | |
| run: pip install sarif-tools | |
| - name: Perform Bandit Analysis | |
| uses: PyCQA/bandit-action@67a458d90fa11fb1463e91e7f4c8f068b5863c7f # v1.0.1 | |
| continue-on-error: true | |
| with: | |
| targets: "python" | |
| - name: Convert SARIF report to HTML | |
| run: sarif html --output bandit-report.html results.sarif | |
| - name: Upload Bandit Scan report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: bandit-report | |
| path: bandit-report.html |