Skip to content

Commit 9ce17fc

Browse files
ppkarwaszppkarwasz
authored
feat: Add reusable codeql-analysis-reusable.yml workflow (#699)
Adds a reusable CodeQL analysis workflow and refactors `codeql-analysis.yml` to call it instead of running the analysis inline. Centralizing the workflow in `commons-parent` means dependency upgrades (e.g. `codeql-action`) only need to be done once for all repositories. Referencing the `master` branch is safe because the same PMC controls both `commons-parent` and the other `commons-*` repositories. Assisted-By: Copilot <175728472+Copilot@users.noreply.github.com>
1 parent 93de136 commit 9ce17fc

3 files changed

Lines changed: 151 additions & 55 deletions

File tree

‎.github/workflows/README.md‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
<!---
2+
Licensed to the Apache Software Foundation (ASF) under one or more
3+
contributor license agreements. See the NOTICE file distributed with
4+
this work for additional information regarding copyright ownership.
5+
The ASF licenses this file to You under the Apache License, Version 2.0
6+
(the "License"); you may not use this file except in compliance with
7+
the License. You may obtain a copy of the License at
8+
9+
https://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
-->
17+
18+
# Reusable Workflows
19+
20+
This directory contains
21+
[reusable GitHub Actions workflows](https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows)
22+
shared across Apache Commons projects. They provide a consistent and secure CI setup without duplicating configuration in each repository.
23+
24+
## CodeQL (`codeql-analysis-reusable.yml`)
25+
26+
Runs a [CodeQL](https://codeql.github.com/) security analysis and uploads the results to GitHub's
27+
code-scanning dashboard. A separate job is created for each analyzed language.
28+
29+
To speed up the Java autobuild step, the workflow tries to restore a Maven dependency cache saved by
30+
a prior build job. For the cache to be found, the build workflow must store it under the key:
31+
32+
```
33+
${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
34+
```
35+
36+
### Inputs
37+
38+
| Input | Type | Default | Description |
39+
|-------------|--------|-------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
40+
| `languages` | string | `"["actions", "java"]"` | JSON array of [CodeQL language identifiers](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-language-support) to analyze. |
41+
42+
### Required permissions
43+
44+
The caller job must grant:
45+
46+
```yaml
47+
permissions:
48+
actions: read
49+
contents: read
50+
security-events: write
51+
```
52+
53+
### Usage example
54+
55+
```yaml
56+
name: CodeQL
57+
58+
on:
59+
push:
60+
branches: [ "master" ]
61+
pull_request: { }
62+
schedule:
63+
- cron: '33 9 * * 4' # Randomize this expression
64+
65+
# Explicitly drop all permissions for security.
66+
permissions: { }
67+
68+
jobs:
69+
codeql:
70+
# Intentionally not pinned: maintained by the same PMC.
71+
uses: apache/commons-parent/.github/workflows/codeql-analysis-reusable.yml@master
72+
permissions:
73+
actions: read
74+
contents: read
75+
security-events: write
76+
```

‎.github/workflows/codeql-analysis-reusable.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one or more
2+
# contributor license agreements. See the NOTICE file distributed with
3+
# this work for additional information regarding copyright ownership.
4+
# The ASF licenses this file to You under the Apache License, Version 2.0
5+
# (the "License"); you may not use this file except in compliance with
6+
# the License. You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
name: CodeQL (reusable)
17+
18+
on:
19+
workflow_call:
20+
inputs:
21+
languages:
22+
type: string
23+
description: Languages to analyze
24+
default: '["actions", "java"]'
25+
26+
# Explicitly drop all permissions inherited from the caller for security.
27+
permissions: { }
28+
29+
jobs:
30+
31+
codeql-analysis:
32+
runs-on: ubuntu-latest
33+
permissions:
34+
actions: read
35+
contents: read
36+
security-events: write
37+
38+
strategy:
39+
fail-fast: false
40+
matrix:
41+
language: ${{ fromJSON(inputs.languages) }}
42+
43+
steps:
44+
- name: Checkout repository
45+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
46+
with:
47+
persist-credentials: false
48+
49+
# If available, restore the cache created by a build job
50+
- name: Restore Maven cache
51+
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae #v5.0.5
52+
with:
53+
path: ~/.m2/repository
54+
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
55+
restore-keys: |
56+
${{ runner.os }}-maven-
57+
58+
- name: Initialize CodeQL
59+
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
60+
with:
61+
languages: ${{ matrix.language }}
62+
63+
- name: Autobuild
64+
uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
65+
66+
- name: Perform CodeQL Analysis
67+
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 8 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -19,68 +19,21 @@ on:
1919
push:
2020
branches: [ master ]
2121
pull_request:
22-
# The branches below must be a subset of the branches above
2322
branches: [ master ]
2423
schedule:
2524
- cron: '33 9 * * 4'
2625

27-
permissions:
28-
contents: read
26+
# Explicitly drop all permissions for security.
27+
permissions: { }
2928

3029
jobs:
31-
analyze:
32-
name: Analyze
33-
runs-on: ubuntu-latest
30+
codeql-analysis:
31+
# Differs from documentation, since this allows testing the workflow in PRs
32+
uses: ./.github/workflows/codeql-analysis-reusable.yml
3433
permissions:
3534
actions: read
3635
contents: read
3736
security-events: write
38-
39-
strategy:
40-
max-parallel: 20
41-
fail-fast: false
42-
matrix:
43-
language: [ 'javascript' ]
44-
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
45-
# Learn more about CodeQL language support at https://git.io/codeql-language-support
46-
47-
steps:
48-
- name: Checkout repository
49-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
50-
with:
51-
persist-credentials: false
52-
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae #v5.0.5
53-
with:
54-
path: ~/.m2/repository
55-
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
56-
restore-keys: |
57-
${{ runner.os }}-maven-
58-
59-
# Initializes the CodeQL tools for scanning.
60-
- name: Initialize CodeQL
61-
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
62-
with:
63-
languages: ${{ matrix.language }}
64-
# If you wish to specify custom queries, you can do so here or in a config file.
65-
# By default, queries listed here will override any specified in a config file.
66-
# Prefix the list here with "+" to use these queries and those in the config file.
67-
# queries: ./path/to/local/query, your-org/your-repo/queries@main
68-
69-
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
70-
# If this step fails, then you should remove it and run the build manually (see below)
71-
- name: Autobuild
72-
uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
73-
74-
# ℹ️ Command-line programs to run using the OS shell.
75-
# 📚 https://git.io/JvXDl
76-
77-
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
78-
# and modify them (or add more) to build your code if your project
79-
# uses a compiled language
80-
81-
#- run: |
82-
# make bootstrap
83-
# make release
84-
85-
- name: Perform CodeQL Analysis
86-
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
37+
# This repository does not contain any Java code
38+
with:
39+
languages: '["actions"]'

0 commit comments

Comments
 (0)