From patchwork Tue Oct 6 06:39:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Heinrich Schuchardt X-Patchwork-Id: 1377227 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=gmx.de Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=gmx.net header.i=@gmx.net header.a=rsa-sha256 header.s=badeba3b8450 header.b=Jn97ZE3L; dkim-atps=neutral Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4C579Z5xK0z9sTD for ; Tue, 6 Oct 2020 17:39:30 +1100 (AEDT) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 3E06382355; Tue, 6 Oct 2020 08:39:27 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=gmx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; secure) header.d=gmx.net header.i=@gmx.net header.b="Jn97ZE3L"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 4110782356; Tue, 6 Oct 2020 08:39:25 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,FREEMAIL_FROM,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.2 Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 4848B82334 for ; Tue, 6 Oct 2020 08:39:22 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=gmx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=xypron.glpk@gmx.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1601966361; bh=mboGCZlJLsfrh5yu0A9Gm1ZVBLiiYG5PWTUmiP4jDbU=; h=X-UI-Sender-Class:From:To:Cc:Subject:Date; b=Jn97ZE3LfgE/864ZzdqY8WJnco2m5AFdwGVvbkU1PtBoLN+0W2ZmuMqTLMogZqZwq bSDwQzV6eZy3cvxTcGYwNCU3bXvOFudosLKjakJ8nMUCcmeT2cjtgYg4suZvfRnrR4 DnP+MPGkBV5RzPcpb5RMZ3jdDmX1tQwj2nX3o6Z8= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from LT02.fritz.box ([178.202.41.107]) by mail.gmx.com (mrgmx104 [212.227.17.174]) with ESMTPSA (Nemesis) id 1N3KPq-1kZHP115aU-010JTM; Tue, 06 Oct 2020 08:39:21 +0200 From: Heinrich Schuchardt To: Tom Rini Cc: u-boot@lists.denx.de, Heinrich Schuchardt Subject: [PATCH 1/1] Create codeql-analysis.yml Date: Tue, 6 Oct 2020 08:39:16 +0200 Message-Id: <20201006063916.17324-1-xypron.glpk@gmx.de> X-Mailer: git-send-email 2.28.0 MIME-Version: 1.0 X-Provags-ID: V03:K1:31B0vKb6Trx3WzOZb+V6raPMBH9d355xtJwzDpxjhRxHR7gshYX +oV0brxjX2fWkDk9Ts6yq58FgE7MtM/pBNXybh4zYxie2ntIXDmh8iHYkdHmlvj1gyG+8jA E+m3/esPmOP+kJao3cZfBXAHqKBRPsFfra8bRglLK2kPWD4zVxf0XKkq2+XPDqwBIEcIa1L POG+adj6gGzEfJ/4lmisA== X-UI-Out-Filterresults: notjunk:1;V03:K0:bpbP/Fca0/g=:24Ql6BbsXrgey3bp9Tfshq Ald8rhvpW2JSUqCcLEwAdar5ipqbtyK/MJzHl0tO3SleZFhQtB6NPEO+zMwVp64z8TSLF1UOH JHGqouiipe+vjthKUY3QqrwsAt3CiWN93lX56G1bFH/uzS9MQcN5AtFLAGuTbCArRNlHwP32z 1L8kXLKaGx4cu99iyniIsUWltnnwpocGBits/NOtN1tCBUx4PjTPKTRaCDbsagQlLmxgsl7sm /aFao7hyprnXhorKGxxfUNCVqOrQvFNNC1mt8dfC+TbAZzhwXph/3qJzgB5g/6ugTN1PBBn6P AVpcPYOXn5tAUdlouaVSsZrDTJo9nQMQRHgKM6kDU0C+2mCgWl27SSWKgW1oWbNLuP7gYw0PB oHiOBA6jZlz7IxxWgw4fJRUxsqGagtue7SF5PY7WKR17aMJZyt0jzr7quzOv0lWnWdNIZ7NLw 9EivVbOVUiQOKYI5zLrDoNkygzt+x12jABB0bMxZy4OFjwbachmwxpLbfYbUEkDahP/BIfFNs 4Hdh116z3HTFflM5pGSKzgGt5wJmr2CrAaWzIxJlG9dn4inBgMHzXgpeUV+IiVVOHlimVtqao dO/l/NrCF0APEFPg+M5xa7HAr55e1ZQ/sSZay+3wVKzZ6ymWnklY9ywtjbxJWJ3ZgbI3Uea48 Od+E1DI1t70zENOIAI8AFeTz10MSnY7pi9e36xpB3lNP1AKVaBqt5j7+gv4aHnxVeLK9BuCgh yg5XEWWSYC6zZt/E2mOohwcCfcK8Zcz5c+CQtxqDdS8LY4u9xfuzGk2auZcURe5ebP1gNxy8a lpQXas2M13a5eK3T65dUzBXk4qk9jbbdgZQ83skLKDdYIgoy6shsl810ikguKRK+UEMD8Zk6X XxIaWxaBn9ox7zIsAj+kraMrnchV+6JCgb2tsv+l0FZB/omLDVF0elN12c4hMzqjWxrvOIIpW 0UjW3rFd7x8wgusNqvc50+tpssLO2jvgXtVugS6dh7cYMY08byupZGIHSpXyjN1xW30NAas2F RP6WyQYpynJzLyNFUQCNxEJoGnpB/F0TCycmWrh1odCiXSs4FWP0CxKyaUGZoBTGo7LaHXwxI uXm6UYxirCMRk/2Nd+uuU4Z8pUJqNszhInQC+v9oIeLHwU1yxaQ/Eb8OS9zfHvMRQzOWU7ySz c3OtSV1hY4rmUBMHHck22J5uimuUzWjhGA5RmI4Fv2URZlmuPbGW1S7XqsMlSrOG9lkYo85n9 78os/WnxKkJtoIi1v4BOprxovi5hyCk0HDEMYZg== X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.3 at phobos.denx.de X-Virus-Status: Clean Enable CodeQL Analysis on Github. CodeQL produces a static code analysis. Signed-off-by: Heinrich Schuchardt --- I am not sure that everybody wants this enabled on his Github repository. But we should look into the warnings. You can see example output here: https://github.com/xypron2/u-boot/security/code-scanning --- .github/workflows/codeql-analysis.yml | 72 +++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 .github/workflows/codeql-analysis.yml -- 2.28.0 diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml new file mode 100644 index 0000000000..6035378c7a --- /dev/null +++ b/.github/workflows/codeql-analysis.yml @@ -0,0 +1,72 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +name: "CodeQL" + +on: + push: + branches: [efi-2021-01] + pull_request: + # The branches below must be a subset of the branches above + branches: [efi-2021-01] + schedule: + - cron: '0 11 * * 3' + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + # Override automatic language detection by changing the below list + # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python'] + language: ['cpp', 'python'] + # Learn more... + # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + with: + # We must fetch at least the immediate parents so that if this is + # a pull request then we can checkout the head. + fetch-depth: 2 + + # If this run was triggered by a pull request event, then checkout + # the head of the pull request instead of the merge commit. + - run: git checkout HEAD^2 + if: ${{ github.event_name == 'pull_request' }} + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v1 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + # queries: ./path/to/local/query, your-org/your-repo/queries@main + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + # - name: Autobuild + # uses: github/codeql-action/autobuild@v1 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 https://git.io/JvXDl + + # ✏ī¸ If the Autobuild fails above, remove it and uncomment the following three lines + # and modify them (or add more) to build your code if your project + # uses a compiled language + + - run: | + sudo apt-get install bc bison build-essential coccinelle device-tree-compiler dfu-util flex gdisk liblz4-tool libncurses-dev libsdl2-dev libssl-dev lzma-alone openssl swig + make sandbox_defconfig + make + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v1