1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
# .github/workflows/codeql-advanced.yml
# This file was autogenerated by github/codeql-action.
# It is designed to be largely self-configuring.
#
# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL Advanced"
on:
push:
branches:
pull_request:
branches:
schedule:
- cron: '24 4 * * 6' # Weekly on Saturday at 04:24 UTC
jobs:
analyze:
name: Analyze (${{ matrix.language }})
# Runner size impacts CodeQL analysis time. To learn more, please see:
# - https://gh.io/recommended-hardware-resources-for-running-codeql
# - https://gh.io/supported-runners-and-hardware-resources
# - https://gh.io/using-larger-runners (GitHub.com only)
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
permissions:
# required for all workflows
security-events: write
# required to fetch internal or private CodeQL packs
packages: read
# only required for workflows in private repositories
actions: read
contents: read
strategy:
fail-fast: false
matrix:
include:
- language: actions
build-mode: none
- language: javascript-typescript
build-mode: none
- language: rust
build-mode: none # Keep build-mode as 'none' per CodeQL requirement.
# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
# Use `c-cpp` to analyze code written in C, C++ or both
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
submodules: recursive # Important for repos with submodules
# --- START OF RUST ENVIRONMENT SETUP FOR CODEQL ---
# This step ensures that all necessary targets are available for CodeQL's internal build.
- if: matrix.language == 'rust'
name: Prepare Rust environment for CodeQL
shell: bash
run: |
echo "Preparing Rust environment for CodeQL analysis..."
# Update and set default Rust toolchain (stable is usually good unless specified otherwise)
rustup update --no-self-update stable
rustup default stable
rustup show
# Define targets from your [dist] config that can be installed on Linux/macOS runners.
# We explicitly omit x86_64-pc-windows-msvc for Linux/macOS runners due to cross-compilation complexity.
# For comprehensive MSVC analysis, consider a dedicated job on a 'windows-latest' runner.
LINUX_TARGETS="aarch64-unknown-linux-gnu x86_64-unknown-linux-musl"
MACOS_TARGETS="aarch64-apple-darwin x86_64-apple-darwin"
targets_to_add=""
if [[ "${{ runner.os }}" == "Linux" ]]; then
echo "On Linux runner, checking for Linux cross-compilation targets."
for target in $LINUX_TARGETS; do
if ! rustup target list | grep -q "$target (installed)"; then
targets_to_add+=" $target"
fi
done
elif [[ "${{ runner.os }}" == "macOS" ]]; then
echo "On macOS runner, checking for Apple targets."
for target in $MACOS_TARGETS; do
if ! rustup target list | grep -q "$target (installed)"; then
targets_to_add+=" $target"
fi
done
elif [[ "${{ runner.os }}" == "Windows" ]]; then
echo "On Windows runner, native Windows targets are usually sufficient."
# If you ever run this job on Windows, and need specific MSVC targets, you might add them here.
# Example: if ! rustup target list | grep -q 'x86_64-pc-windows-msvc (installed)'; then targets_to_add+=" x86_64-pc-windows-msvc"; fi
fi
if [ -n "$targets_to_add" ]; then
echo "Adding Rust targets: $targets_to_add"
# Use 'sh' compatibility for rustup target add
rustup target add $targets_to_add || echo "Warning: Failed to add some Rust targets. Code analysis for these might be incomplete."
else
echo "All necessary Rust targets already installed or not applicable for this runner."
fi
echo "Rust environment preparation complete."
# --- END OF RUST ENVIRONMENT SETUP FOR CODEQL ---
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
# Removed 'build-arguments' as it is not a valid input for github/codeql-action/init@v3.
# The correct way to pass extra arguments to the Rust autobuilder is via CODEQL_ACTION_EXTRA_OPTIONS.
env:
# Pass arguments to CodeQL's internal Rust autobuilder via environment variables.
# These environment variables influence CodeQL's internal 'autobuild' process for Rust.
# They are set only when the current matrix language is Rust.
CODEQL_ACTION_EXTRA_OPTIONS: >-
${{ matrix.language == 'rust' && '--release' || '' }}
${{ matrix.language == 'rust' && runner.os == 'Linux' && '--all-targets --target aarch64-unknown-linux-gnu --target x86_64-unknown-linux-musl' || '' }}
${{ matrix.language == 'rust' && runner.os == 'macOS' && '--all-targets --target aarch64-apple-darwin --target x86_64-apple-darwin' || '' }}
# If a Windows runner were part of the matrix, the following would apply to analyze MSVC builds:
# ${{ matrix.language == 'rust' && runner.os == 'Windows' && '--all-targets --target x86_64-pc-windows-msvc' || '' }}
# Note: CODEQL_ACTION_EXTRA_OPTIONS applies to the autobuilder.
# For manual build mode, you would specify the commands directly in a 'run' step.
# Since Rust requires build-mode: none, this environment variable is appropriate.
# This 'run' step is left here from the original template for other languages.
# For Rust, with build-mode: none, CodeQL handles the build internally.
- if: matrix.build-mode == 'manual'
shell: bash
run: |
echo 'If you are using a "manual" build mode for one or more of the' \
'languages you are analyzing, replace this with the commands to build' \
'your code, for example:'
echo ' make bootstrap'
echo ' make release'
# Do NOT exit 1 here, as other languages might actually use this.
# However, for Rust, this block will NOT execute due to `build-mode: none`.
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: "/language:${{matrix.language}}"