foxguard 0.12.0

A security scanner as fast as a linter, written in Rust. 200+ built-in rules across 12 source languages.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

name: Linux CodeQL Dirty Frag Calibration

on:
  workflow_dispatch:
    inputs:
      linux_repo:
        description: Linux repository URL
        required: true
        default: https://github.com/torvalds/linux.git
      vulnerable_ref:
        description: Vulnerable parent of the ESP shared-frag fix
        required: true
        default: 14acf9652e5690de3c7486c6db5fb8dafd0a32a3
      fixed_ref:
        description: ESP shared-frag fix commit
        required: true
        default: f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4

jobs:
  calibrate:
    name: ${{ matrix.kind }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        include:
          - kind: vulnerable
          - kind: fixed

    steps:
      - uses: actions/checkout@v6

      - name: Install kernel build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            bc \
            bison \
            build-essential \
            clang \
            flex \
            libelf-dev \
            libssl-dev \
            lld \
            llvm \
            python3 \
            rsync

      - name: Install CodeQL CLI
        run: |
          curl -fsSL -o "$RUNNER_TEMP/codeql-bundle.tar.gz" \
            https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.gz
          mkdir -p "$RUNNER_TEMP/codeql"
          tar -xzf "$RUNNER_TEMP/codeql-bundle.tar.gz" -C "$RUNNER_TEMP/codeql" --strip-components=1
          "$RUNNER_TEMP/codeql/codeql" version

      - name: Build and analyze Linux CodeQL database
        env:
          CODEQL: ${{ runner.temp }}/codeql/codeql
          KERNEL_REF: ${{ matrix.kind == 'vulnerable' && inputs.vulnerable_ref || inputs.fixed_ref }}
          LINUX_REPO: ${{ inputs.linux_repo }}
          OUT_DIR: ${{ runner.temp }}/dirty-frag-${{ matrix.kind }}
          WORKDIR: ${{ runner.temp }}/linux-${{ matrix.kind }}
        run: scripts/linux-codeql-dirty-frag.sh

      - name: Upload calibration artifacts
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: linux-codeql-dirty-frag-${{ matrix.kind }}
          path: ${{ runner.temp }}/dirty-frag-${{ matrix.kind }}
          if-no-files-found: error