HiveMind/.github/workflows/codeql.yml at main · codertds/HiveMind · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Wednesdays 06:00 UTC
    - cron: "0 6 * * 3"
  workflow_dispatch:

permissions:
  contents: read
  security-events: write
  issues: write
  actions: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: javascript-typescript
            build-mode: none
          - language: python
            build-mode: none
          - language: java
            build-mode: manual
    steps:
      - uses: actions/checkout@v4

      - name: Set up Java
        if: matrix.language == 'java'
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"
          cache: maven

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}

      - name: Build Java for CodeQL
        if: matrix.language == 'java'
        working-directory: backend-java
        run: mvn -B -DskipTests package

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"

  open-issue:
    name: Summarize open alerts as Issue
    needs: analyze
    if: always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build alert summary and upsert Issue
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          chmod +x scripts/ci/upsert_automation_issue.sh

          ALERTS_JSON="$(gh api \
            -H "Accept: application/vnd.github+json" \
            "/repos/${GITHUB_REPOSITORY}/code-scanning/alerts?state=open&per_page=100" \
            || echo '[]')"

          COUNT="$(echo "$ALERTS_JSON" | jq 'if type=="array" then length else 0 end')"
          REPORT="codeql-alerts-report.md"

          {
            echo "# CodeQL / code scanning open alerts"
            echo
            echo "Generated: $(date -u +"%Y-%m-%d %H:%M:%S UTC")"
            echo
            echo "Open alerts: **${COUNT}**"
            echo
            echo "Alerts also appear under the repository **Security → Code scanning** tab."
            echo
            echo "Workflow run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
            echo
          } >"$REPORT"

          TITLE="[automation] CodeQL open alerts"

          if [[ "$COUNT" -eq 0 ]]; then
            EXISTING="$(
              gh issue list --state open --limit 100 --json number,title \
                | jq -r --arg t "$TITLE" '.[] | select(.title == $t) | .number' \
                | head -n 1
            )"
            if [[ -n "$EXISTING" ]]; then
              gh issue comment "$EXISTING" --body "No open code scanning alerts remain. Closing. Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
              gh issue close "$EXISTING" --reason completed
              echo "Closed issue #${EXISTING}"
            else
              echo "No open alerts and no tracking issue."
            fi
            exit 0
          fi

          {
            echo "| Severity | Rule | Path | State | URL |"
            echo "|---|---|---|---|---|"
            echo "$ALERTS_JSON" | jq -r '
              .[] |
              [
                (.rule.security_severity_level // .rule.severity // "unknown"),
                (.rule.id // .rule.name // "unknown"),
                (.most_recent_instance.location.path // "n/a"),
                .state,
                .html_url
              ] | @tsv
            ' | while IFS=$'\t' read -r sev rule path state url; do
              echo "| ${sev} | \`${rule}\` | \`${path}\` | ${state} | [alert](${url}) |"
            done
            echo
            echo "<details><summary>Raw alert JSON (truncated)</summary>"
            echo
            echo '```json'
            echo "$ALERTS_JSON" | jq '.[0:20]'
            echo '```'
            echo
            echo "</details>"
          } >>"$REPORT"

          scripts/ci/upsert_automation_issue.sh \
            "$TITLE" \
            "$REPORT" \
            automation \
            security