Skip to content

Commit d7f8764

Browse files
author
Timothy Mothra
authored
testing fixes for CodeQL (#4198)
1 parent 7c234b7 commit d7f8764

File tree

2 files changed

+103
-8
lines changed

2 files changed

+103
-8
lines changed

‎.github/workflows/codeql-daily.yml

Lines changed: 100 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,16 @@ name: CodeQL (daily)
22

33
on:
44
schedule:
5-
- cron: '30 1 * * *'
5+
- cron: '30 1 * * *' # run daily at 1:30 AM UTC
66
workflow_dispatch:
7+
push:
8+
branches:
9+
- '**'
710

811
jobs:
9-
analyze:
12+
# ===== Java Analysis Job =====
13+
analyze-java:
14+
name: "Analyze Java Code"
1015
permissions:
1116
actions: read # for github/codeql-action/init to get workflow details
1217
security-events: write # for github/codeql-action/analyze to upload SARIF results
@@ -21,27 +26,114 @@ jobs:
2126
distribution: temurin
2227
java-version: 17
2328

29+
- name: Setup Gradle
30+
uses: gradle/actions/setup-gradle@v4
31+
2432
- name: Initialize CodeQL
2533
uses: github/codeql-action/init@v3
2634
with:
27-
languages: java, c-cpp
35+
languages: java
36+
37+
- name: Build Java code
38+
# skipping build cache is needed so that all modules will be analyzed
39+
run: ./gradlew assemble --no-build-cache
40+
41+
- name: Perform CodeQL analysis
42+
uses: github/codeql-action/analyze@v3
43+
with:
44+
category: java
45+
46+
# ===== C++ Analysis Job =====
47+
analyze-cpp:
48+
name: "Analyze C++ Code"
49+
permissions:
50+
actions: read
51+
security-events: write
52+
runs-on: windows-latest
53+
54+
steps:
55+
- uses: actions/checkout@v4
56+
57+
- name: Set up Java 17 (required for JNI compilation)
58+
uses: actions/setup-java@v4
59+
with:
60+
distribution: temurin
61+
java-version: 17
62+
63+
- name: Setup Visual Studio Build Tools
64+
uses: microsoft/setup-msbuild@v1
65+
66+
# This step uses Microsoft's vswhere tool to verify that the official Windows 10 SDK (version 19041) is installed.
67+
# vswhere is a Microsoft-provided command-line utility that locates Visual Studio installations and their components.
68+
- name: Verify Windows SDK installation
69+
run: |
70+
& "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -products * -requires Microsoft.VisualStudio.Component.Windows10SDK.19041 -property installationPath
71+
shell: pwsh
2872

2973
- name: Setup Gradle
3074
uses: gradle/actions/setup-gradle@v4
3175

32-
- name: Assemble
33-
# skipping build cache is needed so that all modules will be analyzed
34-
run: ./gradlew assemble --no-build-cache
76+
- name: Initialize CodeQL
77+
uses: github/codeql-action/init@v3
78+
with:
79+
languages: cpp
80+
debug: true
81+
82+
- name: Build C++ code
83+
shell: cmd
84+
run: |
85+
"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath > vs.txt
86+
set /p VSPATH=<vs.txt
87+
set VCVARS=%VSPATH%\VC\Auxiliary\Build\vcvars64.bat
88+
call "%VCVARS%"
89+
set APPINSIGHTS_WIN10_SDK_PATH=C:\Program Files (x86)\Windows Kits\10
90+
set APPINSIGHTS_VS_PATH=%VSPATH%
91+
set JAVA_HOME=%JAVA_HOME_17_X64%
92+
set sourceDir=etw/native/src/main/cpp
93+
set headerDir=etw/native/src/main/headers
94+
set cppFile=%sourceDir%/etw_provider.cpp
95+
echo Analyzing C++ file: %cppFile%
96+
echo [ > compile_commands.json
97+
echo { >> compile_commands.json
98+
echo "directory": "%CD%/%sourceDir%", >> compile_commands.json
99+
echo "command": "cl.exe /W4 /EHsc /sdl /std:c++14 /I\"%APPINSIGHTS_WIN10_SDK_PATH%/include/10.0.22621.0/um\" /I\"%JAVA_HOME%/include\" /I\"%JAVA_HOME%/include/win32\" /I\"%CD%/%headerDir%\" /c %cppFile%", >> compile_commands.json
100+
echo "file": "%cppFile%" >> compile_commands.json
101+
echo } >> compile_commands.json
102+
echo ] >> compile_commands.json
103+
echo // Simple file to ensure compiler is run > codeql_trigger.cpp
104+
echo #include ^<windows.h^> >> codeql_trigger.cpp
105+
echo #include ^<jni.h^> >> codeql_trigger.cpp
106+
echo #include "etw_provider.h" >> codeql_trigger.cpp
107+
echo int main() { return 0; } >> codeql_trigger.cpp
108+
dir %sourceDir% /s /b *.cpp
109+
dir %headerDir% /s /b *.h
110+
cl.exe /c codeql_trigger.cpp /I"%headerDir%" /I"%sourceDir%" /I"%JAVA_HOME%/include" /I"%JAVA_HOME%/include/win32" /EHsc
111+
if %errorlevel%==0 (
112+
echo C++ preparation completed successfully
113+
echo CPP_BUILD_SUCCEEDED=true>>%GITHUB_ENV%
114+
) else (
115+
echo Warning: C++ build step encountered an error
116+
echo Proceeding with CodeQL analysis anyway
117+
echo CPP_BUILD_SUCCEEDED=false>>%GITHUB_ENV%
118+
)
35119
36120
- name: Perform CodeQL analysis
37121
uses: github/codeql-action/analyze@v3
122+
with:
123+
category: cpp
124+
125+
- name: Report C++ build status
126+
if: env.CPP_BUILD_SUCCEEDED == 'false'
127+
run: |
128+
echo "::warning::C++ build failed but CodeQL scan was attempted anyway. Some C++ issues may not be detected."
38129
39130
scheduled-job-notification:
40131
permissions:
41132
issues: write
42133
needs:
43-
- analyze
134+
- analyze-java
135+
- analyze-cpp
44136
if: always()
45137
uses: ./.github/workflows/reusable-scheduled-job-notification.yml
46138
with:
47-
success: ${{ needs.analyze.result == 'success' }}
139+
success: ${{ needs.analyze-java.result == 'success' && needs.analyze-cpp.result == 'success' }}

‎.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,6 @@ build/
55

66
# Intellij
77
/.idea/
8+
9+
# Visual Studio
10+
.vs

0 commit comments

Comments
 (0)