.github/workflows/codeql.yml: Update actions being deprecated #37

Workflow file for this run

	# This workflow runs CodeQL against the repository.
	#
	# Results are uploaded to GitHub Code Scanning.
	#
	# Due to a known issue with the CodeQL extractor when building the edk2
	# codebase on Linux systems, only Windows agents are used for build with
	# the VS toolchain.
	#
	# Copyright (c) Microsoft Corporation.
	# SPDX-License-Identifier: BSD-2-Clause-Patent

	name: "CodeQL"

	on:
	push:
	branches:
	- master
	pull_request:
	branches:
	- master
	paths-ignore:
	- '!**.c'
	- '!**.h'

	jobs:
	analyze:
	name: Analyze
	runs-on: windows-2019
	permissions:
	actions: read
	contents: read
	security-events: write

	strategy:
	fail-fast: false
	matrix:
	include:
	- Package: "ArmPkg"
	ArchList: "IA32,X64"
	- Package: "CryptoPkg"
	ArchList: "IA32"
	- Package: "CryptoPkg"
	ArchList: "X64"
	- Package: "DynamicTablesPkg"
	ArchList: "IA32,X64"
	- Package: "FatPkg"
	ArchList: "IA32,X64"
	- Package: "FmpDevicePkg"
	ArchList: "IA32,X64"
	- Package: "IntelFsp2Pkg"
	ArchList: "IA32,X64"
	- Package: "IntelFsp2WrapperPkg"
	ArchList: "IA32,X64"
	- Package: "MdeModulePkg"
	ArchList: "IA32"
	- Package: "MdeModulePkg"
	ArchList: "X64"
	- Package: "MdePkg"
	ArchList: "IA32,X64"
	- Package: "PcAtChipsetPkg"
	ArchList: "IA32,X64"
	- Package: "PrmPkg"
	ArchList: "IA32,X64"
	- Package: "SecurityPkg"
	ArchList: "IA32,X64"
	- Package: "ShellPkg"
	ArchList: "IA32,X64"
	- Package: "SourceLevelDebugPkg"
	ArchList: "IA32,X64"
	- Package: "StandaloneMmPkg"
	ArchList: "IA32,X64"
	- Package: "UefiCpuPkg"
	ArchList: "IA32,X64"
	- Package: "UnitTestFrameworkPkg"
	ArchList: "IA32,X64"

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Install Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.11'
	cache: 'pip'
	cache-dependency-path: 'pip-requirements.txt'

	- name: Use Git Long Paths on Windows
	if: runner.os == 'Windows'
	shell: pwsh
	run: \|
	git config --system core.longpaths true

	- name: Install/Upgrade pip Modules
	run: pip install -r pip-requirements.txt --upgrade requests sarif-tools

	- name: Determine CI Settings File Supported Operations
	id: get_ci_file_operations
	shell: python
	run: \|
	import importlib
	import os
	import sys
	from pathlib import Path
	from edk2toolext.invocables.edk2_ci_setup import CiSetupSettingsManager
	from edk2toolext.invocables.edk2_setup import SetupSettingsManager

	# Find the repo CI Settings file
	ci_settings_file = list(Path(os.environ['GITHUB_WORKSPACE']).rglob('.pytool/CISettings.py'))

	# Note: At this point, submodules have not been pulled, only one CI Settings file should exist
	if len(ci_settings_file) != 1 or not ci_settings_file[0].is_file():
	print("::error title=Workspace Error!::Failed to find CI Settings file!")
	sys.exit(1)

	ci_settings_file = ci_settings_file[0]

	# Try Finding the Settings class in the file
	module_name = 'ci_settings'

	spec = importlib.util.spec_from_file_location(module_name, ci_settings_file)
	module = importlib.util.module_from_spec(spec)
	spec.loader.exec_module(module)

	try:
	settings = getattr(module, 'Settings')
	except AttributeError:
	print("::error title=Workspace Error!::Failed to find Settings class in CI Settings file!")
	sys.exit(1)

	# Determine Which Operations Are Supported by the Settings Class
	ci_setup_supported = issubclass(settings, CiSetupSettingsManager)
	setup_supported = issubclass(settings, SetupSettingsManager)

	with open(os.environ['GITHUB_OUTPUT'], 'a') as fh:
	print(f'ci_setup_supported={str(ci_setup_supported).lower()}', file=fh)
	print(f'setup_supported={str(setup_supported).lower()}', file=fh)

	- name: Convert Arch to Log Format
	id: convert_arch_hyphen
	env:
	ARCH_LIST: ${{ matrix.ArchList }}
	shell: python
	run: \|
	import os

	with open(os.environ['GITHUB_OUTPUT'], 'a') as fh:
	print(f'arch_list={os.environ["ARCH_LIST"].replace(",", "-")}', file=fh)

	- name: Setup
	if: steps.get_ci_file_operations.outputs.setup_supported == 'true'
	run: stuart_setup -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019

	- name: Upload Setup Log As An Artifact
	uses: actions/upload-artifact@v4
	if: (success() \|\| failure()) && steps.get_ci_file_operations.outputs.setup_supported == 'true'
	with:
	name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-Setup-Log
	path: \|
	**/SETUPLOG.txt
	retention-days: 7
	if-no-files-found: ignore

	- name: CI Setup
	if: steps.get_ci_file_operations.outputs.ci_setup_supported == 'true'
	run: stuart_ci_setup -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019

	- name: Upload CI Setup Log As An Artifact
	uses: actions/upload-artifact@v4
	if: (success() \|\| failure()) && steps.get_ci_file_operations.outputs.ci_setup_supported == 'true'
	with:
	name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-CI-Setup-Log
	path: \|
	**/CISETUP.txt
	retention-days: 7
	if-no-files-found: ignore

	- name: Update
	run: stuart_update -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019

	- name: Upload Update Log As An Artifact
	uses: actions/upload-artifact@v4
	if: success() \|\| failure()
	with:
	name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-Update-Log
	path: \|
	**/UPDATE_LOG.txt
	retention-days: 7
	if-no-files-found: ignore

	- name: Build Tools From Source
	run: python BaseTools/Edk2ToolsBuild.py -t VS2019

	- name: Find CodeQL Plugin Directory
	id: find_dir
	shell: python
	run: \|
	import os
	import sys
	from pathlib import Path

	# Find the plugin directory that contains the CodeQL plugin
	plugin_dir = list(Path(os.environ['GITHUB_WORKSPACE']).rglob('BaseTools/Plugin/CodeQL'))

	# This should only be found once
	if len(plugin_dir) == 1:
	plugin_dir = str(plugin_dir[0])

	with open(os.environ['GITHUB_OUTPUT'], 'a') as fh:
	print(f'codeql_plugin_dir={plugin_dir}', file=fh)
	else:
	print("::error title=Workspace Error!::Failed to find CodeQL plugin directory!")
	sys.exit(1)

	- name: Get CodeQL CLI Cache Data
	id: cache_key_gen
	env:
	CODEQL_PLUGIN_DIR: ${{ steps.find_dir.outputs.codeql_plugin_dir }}
	shell: python
	run: \|
	import os
	import yaml

	codeql_cli_ext_dep_name = 'codeqlcli_windows_ext_dep'
	codeql_plugin_file = os.path.join(os.environ['CODEQL_PLUGIN_DIR'], codeql_cli_ext_dep_name + '.yaml')

	with open (codeql_plugin_file) as pf:
	codeql_cli_ext_dep = yaml.safe_load(pf)

	cache_key_name = codeql_cli_ext_dep['name']
	cache_key_version = codeql_cli_ext_dep['version']
	cache_key = f'{cache_key_name}-{cache_key_version}'

	codeql_plugin_cli_ext_dep_dir = os.path.join(os.environ['CODEQL_PLUGIN_DIR'], codeql_cli_ext_dep['name'].strip() + '_extdep')

	with open(os.environ['GITHUB_OUTPUT'], 'a') as fh:
	print(f'codeql_cli_cache_key={cache_key}', file=fh)
	print(f'codeql_cli_ext_dep_dir={codeql_plugin_cli_ext_dep_dir}', file=fh)

	- name: Attempt to Load CodeQL CLI From Cache
	id: codeqlcli_cache
	uses: actions/cache@v4
	with:
	path: ${{ steps.cache_key_gen.outputs.codeql_cli_ext_dep_dir }}
	key: ${{ steps.cache_key_gen.outputs.codeql_cli_cache_key }}

	- name: Download CodeQL CLI
	if: steps.codeqlcli_cache.outputs.cache-hit != 'true'
	run: stuart_update -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 --codeql

	- name: Remove CI Plugins Irrelevant to CodeQL
	shell: python
	env:
	CODEQL_PLUGIN_DIR: ${{ steps.find_dir.outputs.codeql_plugin_dir }}
	run: \|
	import os
	import shutil
	from pathlib import Path

	# Only these two plugins are needed for CodeQL
	plugins_to_keep = ['CompilerPlugin']

	plugin_dir = Path('.pytool/Plugin').absolute()
	if plugin_dir.is_dir():
	for dir in plugin_dir.iterdir():
	if str(dir.stem) not in plugins_to_keep:
	shutil.rmtree(str(dir.absolute()), ignore_errors=True)

	- name: CI Build
	env:
	STUART_CODEQL_PATH: ${{ steps.cache_key_gen.outputs.codeql_cli_ext_dep_dir }}
	run: stuart_ci_build -c .pytool/CISettings.py -t DEBUG -p ${{ matrix.Package }} -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 --codeql

	- name: Build Cleanup
	id: build_cleanup
	shell: python
	run: \|
	import os
	import shutil
	from pathlib import Path

	dirs_to_delete = ['ia32', 'x64', 'arm', 'aarch64']

	def delete_dirs(path: Path):
	if path.exists() and path.is_dir():
	if path.name.lower() in dirs_to_delete:
	print(f'Removed {str(path)}')
	shutil.rmtree(path)
	return

	for child_dir in path.iterdir():
	delete_dirs(child_dir)

	build_path = Path(os.environ['GITHUB_WORKSPACE'], 'Build')
	delete_dirs(build_path)

	- name: Upload Build Logs As An Artifact
	uses: actions/upload-artifact@v4
	if: success() \|\| failure()
	with:
	name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-Build-Logs
	path: \|
	**/BUILD_REPORT.TXT
	**/OVERRIDELOG.TXT
	*/BUILDLOG_.md
	*/BUILDLOG_.txt
	*/CI_.md
	*/CI_.txt
	retention-days: 7
	if-no-files-found: ignore

	- name: Prepare Env Data for CodeQL Upload
	id: env_data
	env:
	PACKAGE_NAME: ${{ matrix.Package }}
	shell: python
	run: \|
	import logging
	import os
	from edk2toollib.utility_functions import RunCmd
	from io import StringIO
	from pathlib import Path

	package = os.environ['PACKAGE_NAME'].strip().lower()
	directory_name = 'codeql-analysis-' + package + '-debug'
	file_name = 'codeql-db-' + package + '-debug-0.sarif'
	sarif_path = Path('Build', directory_name, file_name)

	with open(os.environ['GITHUB_OUTPUT'], 'a') as fh:
	if sarif_path.is_file():
	emacs_file_path = sarif_path.with_name(sarif_path.stem + "-emacs.txt")
	out_stream_buffer = StringIO()
	exit_code = RunCmd("sarif", f"emacs {sarif_path} --output {emacs_file_path} --no-autotrim",
	outstream=out_stream_buffer,
	logging_level=logging.NOTSET)
	print(f'upload_sarif_file=true', file=fh)
	print(f'emacs_file_path={emacs_file_path}', file=fh)
	print(f'sarif_file_path={sarif_path}', file=fh)
	else:
	print(f'upload_sarif_file=false', file=fh)

	- name: Upload CodeQL Results (SARIF) As An Artifact
	uses: actions/upload-artifact@v4
	if: steps.env_data.outputs.upload_sarif_file == 'true'
	with:
	name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-CodeQL-SARIF
	path: \|
	${{ steps.env_data.outputs.emacs_file_path }}
	${{ steps.env_data.outputs.sarif_file_path }}
	retention-days: 14
	if-no-files-found: warn

	- name: Upload CodeQL Results (SARIF) To GitHub Code Scanning
	uses: github/codeql-action/upload-sarif@v3
	if: steps.env_data.outputs.upload_sarif_file == 'true'
	with:
	# Path to SARIF file relative to the root of the repository.
	sarif_file: ${{ steps.env_data.outputs.sarif_file_path }}
	# Optional category for the results. Used to differentiate multiple results for one commit.
	# Each package is a separate category.
	category: ${{ matrix.Package }}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

.github/workflows/codeql.yml: Update actions being deprecated #37

Workflow file

.github/workflows/codeql.yml: Update actions being deprecated #37

Jobs

Run details

Workflow file for this run