envoy/.github/workflows/codeql-daily.yml at main · envoyproxy/envoy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
name: CodeQL/daily

permissions:
  contents: read

on:
  schedule:
  - cron: '0 12 * * 4'

concurrency:
  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
  cancel-in-progress: true


jobs:
  CodeQL-Build:

    permissions:
      security-events: write  # for github/codeql-action/analyze to upload SARIF results
      pull-requests: read
    strategy:
      fail-fast: false

    # CodeQL runs on ubuntu-24.04
    runs-on: ubuntu-22.04
    if: github.repository == 'envoyproxy/envoy'

    steps:

    - uses: envoyproxy/toolshed/actions/bind-mounts@8d5d8d4b9eeb5e4e76b92341b0b1b1f6438af231  # v0.4.5
      if: |
        ! github.event.repository.private
      with:
        mounts: |
          - src: /mnt/workspace
            target: GITHUB_WORKSPACE
            chown: "runner:runner"
          - src: /mnt/runner-home
            target: /home/runner/.cache
            chown: "runner:runner"
    - name: Free disk space
      if: |
        env.BUILD_TARGETS != ''
        && github.event.repository.private
      uses: envoyproxy/toolshed/actions/diskspace@8d5d8d4b9eeb5e4e76b92341b0b1b1f6438af231  # v0.4.5
      with:
        to_remove: |
          /usr/local/.ghcup
          /usr/local/lib/android

    - name: Checkout repository
      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1

    - name: Initialize CodeQL
      uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e  # codeql-bundle-v4.32.4
      with:
        languages: cpp
        trap-caching: false

    - name: Install deps
      shell: bash
      run: |
       sudo apt-get update --error-on=any
       sudo apt-get install --yes \
           libtool libtinfo5 automake autoconf curl unzip
       # Note: the llvm/clang version should match the version specifed in:
       #  - bazel/repository_locations.bzl
       #  - .github/workflows/codeql-push.yml
       #  - https://github.com/envoyproxy/envoy-build-tools/blob/main/build_container/build_container_ubuntu.sh#L84
       mkdir -p bin/clang18.1.8
       cd bin/clang18.1.8
       wget -q https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.8/clang+llvm-18.1.8-x86_64-linux-gnu-ubuntu-18.04.tar.xz
       tar -xf clang+llvm-18.1.8-x86_64-linux-gnu-ubuntu-18.04.tar.xz --strip-components 1

    - name: Build
      run: |
       bazelisk shutdown
       bazel build \
           -c fastbuild \
           --repo_env=BAZEL_LLVM_PATH="$(realpath bin/clang18.1.8)" \
           --spawn_strategy=local \
           --discard_analysis_cache \
           --nouse_action_cache \
           --features="-layering_check" \
           --config=clang-local \
           --config=ci \
           //source/common/http/...

    - name: Clean Artifacts
      run: |
        git clean -xdf

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e  # codeql-bundle-v4.32.4