ApplicationInsights-Java/.github/workflows/codeql-daily.yml at main · microsoft/ApplicationInsights-Java · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
name: CodeQL (daily)

on:
  schedule:
    - cron: '30 1 * * *' # run daily at 1:30 AM UTC
  workflow_dispatch:
  push:
    branches:
      - main

jobs:
  # ===== Java Analysis Job =====
  analyze-java:
    name: "Analyze Java Code"
    permissions:
      actions: read  # for github/codeql-action/init to get workflow details
      security-events: write  # for github/codeql-action/analyze to upload SARIF results
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Set up Java 21
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v5

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: java

      - name: Build Java code
        # skipping build cache is needed so that all modules will be analyzed
        run: ./gradlew assemble --no-build-cache

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: java

  # ===== C++ Analysis Job =====
  analyze-cpp:
    name: "Analyze C++ Code"
    permissions:
      actions: read
      security-events: write
    runs-on: windows-2022

    steps:
      - uses: actions/checkout@v6

      - name: Set up Java 21 (required for JNI compilation)
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Visual Studio Build Tools
        uses: microsoft/setup-msbuild@v2

      # This step uses Microsoft's vswhere tool to verify that the official Windows 10 SDK (version 19041) is installed.
      # vswhere is a Microsoft-provided command-line utility that locates Visual Studio installations and their components.
      - name: Verify Windows SDK installation
        run: |
          & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -products * -requires Microsoft.VisualStudio.Component.Windows10SDK.19041 -property installationPath
        shell: pwsh

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v5

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: cpp
          debug: true

      - name: Build C++ code
        shell: cmd
        run: |
          "%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath > vs.txt
          set /p VSPATH=<vs.txt
          set VCVARS=%VSPATH%\VC\Auxiliary\Build\vcvars64.bat
          call "%VCVARS%"
          set APPINSIGHTS_WIN10_SDK_PATH=C:\Program Files (x86)\Windows Kits\10
          set APPINSIGHTS_VS_PATH=%VSPATH%
          set JAVA_HOME=%JAVA_HOME_17_X64%
          set sourceDir=etw/native/src/main/cpp
          set headerDir=etw/native/src/main/headers
          set cppFile=%sourceDir%/etw_provider.cpp
          echo Analyzing C++ file: %cppFile%
          echo [ > compile_commands.json
          echo   { >> compile_commands.json
          echo     "directory": "%CD%/%sourceDir%", >> compile_commands.json
          echo     "command": "cl.exe /W4 /EHsc /sdl /std:c++14 /I\"%APPINSIGHTS_WIN10_SDK_PATH%/include/10.0.22621.0/um\" /I\"%JAVA_HOME%/include\" /I\"%JAVA_HOME%/include/win32\" /I\"%CD%/%headerDir%\" /c %cppFile%", >> compile_commands.json
          echo     "file": "%cppFile%" >> compile_commands.json
          echo   } >> compile_commands.json
          echo ] >> compile_commands.json
          echo // Simple file to ensure compiler is run > codeql_trigger.cpp
          echo #include ^<windows.h^> >> codeql_trigger.cpp
          echo #include ^<jni.h^> >> codeql_trigger.cpp
          echo #include "etw_provider.h" >> codeql_trigger.cpp
          echo int main() { return 0; } >> codeql_trigger.cpp
          dir %sourceDir% /s /b *.cpp
          dir %headerDir% /s /b *.h
          cl.exe /c codeql_trigger.cpp /I"%headerDir%" /I"%sourceDir%" /I"%JAVA_HOME%/include" /I"%JAVA_HOME%/include/win32" /EHsc
          if %errorlevel%==0 (
            echo C++ preparation completed successfully
            echo CPP_BUILD_SUCCEEDED=true>>%GITHUB_ENV%
          ) else (
            echo Warning: C++ build step encountered an error
            echo Proceeding with CodeQL analysis anyway
            echo CPP_BUILD_SUCCEEDED=false>>%GITHUB_ENV%
          )

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: cpp

      - name: Report C++ build status
        if: env.CPP_BUILD_SUCCEEDED == 'false'
        run: |
          echo "::warning::C++ build failed but CodeQL scan was attempted anyway. Some C++ issues may not be detected."

  scheduled-job-notification:
    permissions:
      issues: write
    needs:
      - analyze-java
      - analyze-cpp
    if: always()
    uses: ./.github/workflows/reusable-scheduled-job-notification.yml
    with:
      success: ${{ needs.analyze-java.result == 'success' && needs.analyze-cpp.result == 'success' }}