Fix #412, git error in CodeQL Analyze Action #413

astrogeco · 2022-01-21T17:48:13Z

Checklist (Please check before submitting)

I reviewed the Contributing Guide.
I signed and emailed the appropriate Contributor License agreement to GSFC-SoftwareRelease@mail.nasa.gov and copied cfs-program@lists.nasa.gov.

Describe the contribution

Adds new component-path input parameter
Use git clone instead of checkout@v2 for the cFS-Bundle
Use symlink to map calling repo workspace to expected cFS Bundle
directory location
Repurpose tests input to be a boolean tied to "ENABLE_UNIT_TESTS" flag
Enable "code snippets" option to CodeQL Analyze action
Archives sarif files from analysis output
Removes code duplication by using a matrix build for security and coding standard analyses
Alphabetizes workflow inputs and order based on "required" flag

Testing performed
Called codeql analysis action in bundle repo
https://github.com/astrogeco/cFS/actions/runs/1791252476

Called fork implementation from cFE repo. See actions run in nasa/cFE#2035,
https://github.com/astrogeco/cFE/runs/5056853287?check_suite_focus=true

Expected behavior changes

CodeQL Action executes successfully.
Sarif files are stored as a run artifact
Unit Test code is scanned

System(s) tested on

Github actions, Ubuntu 18.04

Additional context

Will break current CodeQL implementation in cFS components.

Contributor Info - All information REQUIRED for consideration of pull request
Gerardo E. Cruz-Ortiz, NASA

ArielSAdamsNASA · 2022-01-24T16:53:06Z

Since component-path is required, does this need to be added in codeql-build-reuse.yml?

Adds new parameters to match updated cFS-CodeQL workflow interface introduced in nasa/cFS#413

astrogeco · 2022-01-24T16:55:48Z

.github/workflows/codeql-build.yml


-      - name: Run tests
-        run: ${{ inputs.tests }}
+      # - name: Run tests


@ArielSAdamsNASA, what is the use case for including tests in the CodeQL workflow?

That can be removed

If we don't run the unit tests here, where do they get run?

Note I just went through a significant effort to fix a large number of uninitialized variables being used in app unit tests, something that I'd expect analysis tools to catch early and avoid. I'm in favor of doing analysis on the unit tests, since the sort of warnings/errors that show up really should be addressed (earlier in the unit test development phase the better).

I think as long as we build the tests, the analysis tools should catch problems with them. My question was whether it makes sense to run them here or in a different workflow like https://github.com/nasa/cFS/blob/main/.github/workflows/build-cfs.yml

Copy and concur! As long as they still get analyzed, and the tests get run somewhere in CI I'm happy!

Adds new parameters to match updated cFS-CodeQL workflow interface introduced in nasa/cFS#413

- Add new parameters to match updated cFS-CodeQL workflow interface introduced in nasa/cFS#413 - Add file-exclusion checks to Action trigger so workflow doesn't run if only changes in commit or pull request are to documentation

Renames workflows to better describe what each one does. The CodeQL "reusable" workflow is meant to be used by other workflows. The CodeQL "Analysis" workflow calls the "reusable" CodeQL workflow to execute the static analysis runs. Co-authored-by: Ariel Adams <ArielSAdamsNASA@users.noreply.github.com>

Fixes errors in CodeQL results uploads step. Update parameters in CodeQL "reusable" workflow. BREAKING Interface changes: - Renames callable workflow to `codeql-reusable.yml`, submodules will have to be updated - Adds required `component-path` input parameter - Repurpose tests input to be a boolean tied to "ENABLE_UNIT_TESTS" flag Internal changes: - Use git clone instead of checkout@v2 for the cFS-Bundle - Use symlink to map calling repo workspace to expected cFS Bundle directory location - Enable "code snippets" option to CodeQL Analyze action - Archives sarif files from analysis output - Removes code duplication by using a matrix build for security and coding standard analyses - Alphabetizes workflow inputs and order based on "required" flag

Fix #412, git error in CodeQL Analyze Action

- Add new parameters to match updated cFS-CodeQL workflow interface introduced in nasa/cFS#413 - Add file-exclusion checks to Action trigger so workflow doesn't run if only changes in commit or pull request are to documentation

astrogeco force-pushed the fix-codeql-workflow branch from cab2521 to 15685d7 Compare January 21, 2022 17:49

astrogeco requested a review from ArielSAdamsNASA January 21, 2022 18:05

This was referenced Jan 21, 2022

CodeQL Workflow Fails after "upload" stage nasa/cFE#2034

Closed

Fix #2034, Update CodeQL workflow nasa/cFE#2035

Merged

astrogeco added the CCB:Ready Pull request is ready for discussion at the Configuration Control Board (CCB) label Jan 21, 2022

astrogeco added a commit to astrogeco/cFE that referenced this pull request Jan 24, 2022

Fix nasa#2034, Fix git error in CodeQL workflow

aa984b8

Adds new parameters to match updated cFS-CodeQL workflow interface introduced in nasa/cFS#413

astrogeco commented Jan 24, 2022

View reviewed changes

astrogeco force-pushed the fix-codeql-workflow branch 7 times, most recently from 7839272 to 9078af5 Compare January 26, 2022 23:24

astrogeco added a commit to astrogeco/cFE that referenced this pull request Jan 26, 2022

Fix nasa#2034, Fix git error in CodeQL workflow

ca1a43e

Adds new parameters to match updated cFS-CodeQL workflow interface introduced in nasa/cFS#413

astrogeco force-pushed the fix-codeql-workflow branch 4 times, most recently from 1f2cf94 to f281f71 Compare January 26, 2022 23:46

astrogeco added breaking continuous-integration labels Jan 26, 2022

astrogeco added breaking and removed breaking CCB:Ready Pull request is ready for discussion at the Configuration Control Board (CCB) labels Jan 26, 2022

astrogeco force-pushed the fix-codeql-workflow branch 4 times, most recently from 7986c51 to e3f8b77 Compare February 1, 2022 23:55

astrogeco force-pushed the fix-codeql-workflow branch 16 times, most recently from b56c955 to 169cfdb Compare February 3, 2022 19:00

astrogeco force-pushed the fix-codeql-workflow branch from 169cfdb to 98e2ef8 Compare February 3, 2022 19:20

astrogeco added a commit that referenced this pull request Feb 3, 2022

Merge pull request #413 from astrogeco/fix-codeql-workflow

1864992

Fix #412, git error in CodeQL Analyze Action

astrogeco mentioned this pull request Feb 3, 2022

cFS Bundle Integration Candidate: Caelum+dev3 #414

Merged

2 tasks

astrogeco merged commit d6bca6e into nasa:main Feb 3, 2022

This was referenced Feb 23, 2022

CodeQL Workflow Broken due to Name Change nasa/ci_lab#104

Closed

CodeQL Workflow Broken due to Name Change nasa/osal#1225

Closed

CodeQL Workflow Broken due to Name Change nasa/tblCRCTool#63

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix #412, git error in CodeQL Analyze Action #413

Fix #412, git error in CodeQL Analyze Action #413

astrogeco commented Jan 21, 2022 •

edited

Loading

ArielSAdamsNASA commented Jan 24, 2022

astrogeco Jan 24, 2022

ArielSAdamsNASA Jan 24, 2022

skliper Jan 24, 2022

skliper Jan 24, 2022

astrogeco Jan 24, 2022 •

edited

Loading

skliper Jan 24, 2022

Fix #412, git error in CodeQL Analyze Action #413

Fix #412, git error in CodeQL Analyze Action #413

Conversation

astrogeco commented Jan 21, 2022 • edited Loading

ArielSAdamsNASA commented Jan 24, 2022

astrogeco Jan 24, 2022

Choose a reason for hiding this comment

ArielSAdamsNASA Jan 24, 2022

Choose a reason for hiding this comment

skliper Jan 24, 2022

Choose a reason for hiding this comment

skliper Jan 24, 2022

Choose a reason for hiding this comment

astrogeco Jan 24, 2022 • edited Loading

Choose a reason for hiding this comment

skliper Jan 24, 2022

Choose a reason for hiding this comment

astrogeco commented Jan 21, 2022 •

edited

Loading

astrogeco Jan 24, 2022 •

edited

Loading