Skip to content

Run CodeQL on PRs #7070

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Feb 7, 2025
Merged

Run CodeQL on PRs #7070

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
0015800
Run CodeQL on PRs
trask Feb 5, 2025
3858e7c
and benchmarks branch
trask Feb 5, 2025
5ed62c4
no-daemon
trask Feb 5, 2025
0ae4605
fix
trask Feb 5, 2025
d408830
hashes
trask Feb 6, 2025
328cd4f
Merge remote-tracking branch 'upstream/main' into codeql
trask Feb 6, 2025
48cb63b
Apply suggestions from code review
trask Feb 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 0 additions & 44 deletions .github/workflows/codeql-daily.yml
View file
Open in desktop

This file was deleted.

58 changes: 58 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
name: CodeQL

on:
pull_request:
branches:
- main
- release/*
- v0.*
- v1.*
- benchmarks
push:
branches:
- main
- release/*
- v0.*
- v1.*
Copy link
Member

@jack-berg jack-berg Feb 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't have branches matching the v* pattern.

Copy link
Member Author

@trask trask Feb 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/open-telemetry/opentelemetry-java/branches/all?page=3

but I think you're right though that they shouldn't be needed here, let me try removing in instrumentation repo first to make sure OSSF doesn't get mad

Copy link
Member Author

@trask trask Feb 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yup, these aren't needed

Copy link
Member

@jack-berg jack-berg Feb 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah the old release strategy. Yes, we should never push to these branches.

- benchmarks
schedule:
- cron: "29 13 * * 2" # weekly at 13:29 UTC on Tuesday

permissions:
contents: read

jobs:
analyze:
permissions:
contents: read
Copy link
Member

@jack-berg jack-berg Feb 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Redundant?

Suggested change
contents: read

Copy link
Member Author

@trask trask Feb 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

my understanding is

  • technically the non-presence here removes a workflow-level permission (as opposed to being additive)
  • but that since our repos are public, you can never take away contents: read

so I think I can remove them, let me try this in instrumentation repo first also...

Copy link
Member Author

@trask trask Feb 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this didn't work, see explanation in open-telemetry/opentelemetry-java-instrumentation#13247

Copy link
Member

@jack-berg jack-berg Feb 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for trying.

actions: read # for github/codeql-action/init to get workflow details
security-events: write # for github/codeql-action/analyze to upload SARIF results
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- name: Set up Java 17
uses: actions/setup-java@v4
with:
distribution: temurin
java-version: 17

- name: Set up gradle
uses: gradle/actions/setup-gradle@v4

- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: java, actions
# using "latest" helps to keep up with the latest Kotlin support
# see https://github.com/github/codeql-action/issues/1555#issuecomment-1452228433
tools: latest

- name: Assemble
# --no-build-cache is required for codeql to analyze all modules
# --no-daemon is required for codeql to observe the compilation
# (see https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli/preparing-your-code-for-codeql-analysis#specifying-build-commands)
run: ./gradlew assemble --no-build-cache --no-daemon

- name: Perform CodeQL analysis
uses: github/codeql-action/analyze@v3
Loading