Skip to content

Commit 97557fd

Browse files
ktsaouktsaou
committed
Add Windows CI and CodeQL coverage
1 parent 7d892cd commit 97557fd

3 files changed

Lines changed: 212 additions & 7 deletions

File tree

‎.agents/sow/current/SOW-0014-20260603-maintainability-hotspots.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -879,6 +879,47 @@ Sensitive data gate:
879879

880880
Raw cache, Go typed-facade, apps lookup builder, cgroups lookup builder, apps lookup semantic validation, five Go code-scanning findings, C lookup builder function-level complexity, and C POSIX/Windows service helper duplication are locally remediated; the overall maintainability SOW remains in progress pending the next selected maintainability target and Codacy metric re-check after push.
881881

882+
### 2026-06-04 Windows CI And CodeQL Coverage
883+
884+
- User decision: add Windows CI coverage after discovering that current CodeQL coverage is Linux-shaped, not a CodeQL product limit.
885+
- Purpose: make Windows runtime and Windows static-analysis coverage first-class CI signals for this cross-platform SDK.
886+
- Evidence:
887+
- `.github/workflows/codeql.yml` currently runs every matrix entry on `ubuntu-latest`.
888+
- The C/C++ CodeQL job currently builds only POSIX targets: `netipc_protocol`, `netipc_uds`, `netipc_shm`, and `netipc_service`.
889+
- The Go CodeQL job currently runs `go test ./...` on Linux, so Windows-only Go files guarded by `//go:build windows` are not extracted.
890+
- `CMakeLists.txt` already has Windows runtime targets guarded by `NETIPC_WINDOWS_RUNTIME`.
891+
- Existing Windows validation scripts and local validation use MSYS2/MinGW, not MSVC.
892+
- Decision:
893+
- Add GitHub-hosted Windows CI on `windows-latest`.
894+
- Use MSYS2/MinGW for the Windows runtime build because it matches the existing tested Windows scripts.
895+
- Keep heavyweight Windows coverage and benchmark jobs out of push/PR CI for now; they remain explicit scripts.
896+
- Add Windows CodeQL jobs for C/C++ and Go so Windows-only sources are extracted.
897+
- Risk:
898+
- Windows hosted runners may expose timing flakiness in named-pipe/SHM tests.
899+
- Adding MSYS2 introduces another pinned CI action and package-install surface.
900+
- CodeQL Windows jobs increase CI time and may surface a new backlog of valid Windows-only findings.
901+
- Validation plan:
902+
- Run local action/workflow linting.
903+
- Run relevant local CMake/Go validation.
904+
- Push and verify GitHub Windows runtime and CodeQL jobs.
905+
- Implemented:
906+
- Added a `windows-latest` MSYS2/MinGW runtime job to `.github/workflows/runtime-safety.yml`.
907+
- Expanded CodeQL into distinct POSIX and Windows categories for C/C++ and Go.
908+
- Expanded POSIX C/C++ CodeQL build targets so test, interop, cache, stress, hardening, and benchmark C sources are compiled during extraction.
909+
- Added Windows C/C++ CodeQL build targets for named pipe, Windows SHM, Windows service, Windows interop, guard, stress, and benchmark C sources.
910+
- Added Windows Go CodeQL build execution so Windows build-tagged Go packages are extracted.
911+
- Local validation:
912+
- YAML parsing passed for `.github/workflows/codeql.yml` and `.github/workflows/runtime-safety.yml`.
913+
- `actionlint .github/workflows/codeql.yml .github/workflows/runtime-safety.yml` passed.
914+
- POSIX expanded C/C++ CodeQL target list built locally with `cmake --build build`.
915+
- Windows/MSYS runtime build command passed on the Windows validation host.
916+
- Windows/MSYS runtime CTest slice passed on the Windows validation host: 12/12 targeted Windows tests.
917+
- Windows Go CodeQL build command passed on the Windows validation host for `src/go`, `tests/fixtures/go`, and `bench/drivers/go`.
918+
- Windows C/C++ CodeQL-only `bench_windows_c` target built on the Windows validation host.
919+
- `git diff --check` passed.
920+
- `bash .agents/sow/audit.sh` passed.
921+
- `codacy-analysis analyze --output-format json` passed with 0 issues and 0 errors across Checkov, Opengrep/Semgrep, Trivy, cppcheck, ShellCheck, and Spectral.
922+
882923
## Lessons Extracted
883924

884925
Pending.

‎.github/workflows/codeql.yml‎

Lines changed: 97 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ concurrency:
2121
jobs:
2222
analyze:
2323
name: Analyze ${{ matrix.name }}
24-
runs-on: ubuntu-latest
24+
runs-on: ${{ matrix.runner }}
2525

2626
permissions:
2727
actions: read
@@ -32,22 +32,93 @@ jobs:
3232
fail-fast: false
3333
matrix:
3434
include:
35-
- name: C/C++
35+
- name: C/C++ POSIX
3636
language: c-cpp
37+
runner: ubuntu-latest
3738
build_mode: manual
39+
category: /language:c-cpp-posix
3840
build_command: |
39-
cmake -S . -B build-codeql -DCMAKE_BUILD_TYPE=Debug
40-
cmake --build build-codeql --parallel --target netipc_protocol netipc_uds netipc_shm netipc_service
41-
- name: Go
41+
cmake -S . -B build-codeql-posix -DCMAKE_BUILD_TYPE=Debug
42+
cmake --build build-codeql-posix --parallel --target \
43+
netipc_protocol \
44+
netipc_uds \
45+
netipc_shm \
46+
netipc_service \
47+
test_protocol \
48+
interop_codec_c \
49+
fuzz_protocol \
50+
test_uds \
51+
interop_uds_c \
52+
test_shm \
53+
interop_shm_c \
54+
test_service \
55+
test_service_extra \
56+
test_service_payload_limits \
57+
test_service_method_limits \
58+
test_multi_server \
59+
interop_service_c \
60+
test_stress \
61+
test_ping_pong \
62+
test_chaos \
63+
test_hardening \
64+
test_cache \
65+
interop_cache_c \
66+
bench_posix_c
67+
- name: C/C++ Windows
68+
language: c-cpp
69+
runner: windows-latest
70+
build_mode: manual
71+
category: /language:c-cpp-windows
72+
msys2: true
73+
build_command: |
74+
cmake -S . -B build-codeql-windows -G Ninja \
75+
-DCMAKE_BUILD_TYPE=Debug \
76+
-DCMAKE_C_COMPILER=/usr/bin/gcc \
77+
-DCMAKE_CXX_COMPILER=/usr/bin/g++
78+
cmake --build build-codeql-windows \
79+
--parallel "$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4)" \
80+
--target \
81+
netipc_protocol \
82+
netipc_named_pipe \
83+
netipc_win_shm \
84+
netipc_service_win \
85+
test_named_pipe \
86+
interop_named_pipe_c \
87+
test_win_shm \
88+
test_win_service \
89+
test_win_service_extra \
90+
test_win_service_payload_limits \
91+
test_win_service_guards \
92+
test_win_service_guards_extra \
93+
test_win_stress \
94+
interop_win_shm_c \
95+
interop_service_win_c \
96+
interop_cache_win_c \
97+
bench_windows_c
98+
- name: Go POSIX
4299
language: go
100+
runner: ubuntu-latest
43101
build_mode: manual
102+
category: /language:go-posix
44103
build_command: |
45104
for module in src/go tests/fixtures/go bench/drivers/go; do
46105
(cd "$module" && go test ./...)
47106
done
107+
- name: Go Windows
108+
language: go
109+
runner: windows-latest
110+
build_mode: manual
111+
category: /language:go-windows
112+
msys2: true
113+
build_command: |
114+
for module in src/go tests/fixtures/go bench/drivers/go; do
115+
(cd "$module" && CGO_ENABLED=0 go test ./...)
116+
done
48117
- name: Rust
49118
language: rust
119+
runner: ubuntu-latest
50120
build_mode: none
121+
category: /language:rust
51122
build_command: ":"
52123

53124
steps:
@@ -63,6 +134,20 @@ jobs:
63134
go-version-file: src/go/go.mod
64135
cache: false
65136

137+
- name: Set up MSYS2
138+
if: matrix.msys2 == true
139+
uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2
140+
with:
141+
msystem: MSYS
142+
update: true
143+
path-type: inherit
144+
install: >-
145+
base-devel
146+
gcc
147+
cmake
148+
ninja
149+
git
150+
66151
- name: Initialize CodeQL
67152
uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
68153
with:
@@ -71,10 +156,15 @@ jobs:
71156
config-file: ./.github/codeql.yml
72157

73158
- name: Build for CodeQL
74-
if: matrix.build_mode == 'manual'
159+
if: matrix.build_mode == 'manual' && matrix.msys2 != true
160+
run: ${{ matrix.build_command }}
161+
162+
- name: Build for CodeQL on MSYS2
163+
if: matrix.build_mode == 'manual' && matrix.msys2 == true
164+
shell: msys2 {0}
75165
run: ${{ matrix.build_command }}
76166

77167
- name: Analyze
78168
uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
79169
with:
80-
category: /language:${{ matrix.language }}
170+
category: ${{ matrix.category }}

‎.github/workflows/runtime-safety.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,3 +96,77 @@ jobs:
9696

9797
- name: Run Go race detector
9898
run: bash tests/run-go-race.sh
99+
100+
windows-msys:
101+
name: Windows MSYS2 Runtime
102+
runs-on: windows-latest
103+
timeout-minutes: 45
104+
105+
defaults:
106+
run:
107+
shell: msys2 {0}
108+
109+
steps:
110+
- name: Checkout
111+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
112+
with:
113+
persist-credentials: false
114+
115+
- name: Set up Go
116+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
117+
with:
118+
go-version-file: src/go/go.mod
119+
cache: false
120+
121+
- name: Set up MSYS2
122+
uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2
123+
with:
124+
msystem: MSYS
125+
update: true
126+
path-type: inherit
127+
install: >-
128+
base-devel
129+
gcc
130+
cmake
131+
ninja
132+
git
133+
134+
- name: Build Windows runtime targets
135+
run: |
136+
set -euo pipefail
137+
windows_cargo_home="${CARGO_HOME:-}"
138+
if [[ -z "$windows_cargo_home" && -n "${USERPROFILE:-}" ]]; then
139+
windows_cargo_home="$(cygpath -u "$USERPROFILE")/.cargo"
140+
fi
141+
windows_cargo_home="${windows_cargo_home:-$HOME/.cargo}"
142+
export PATH="$windows_cargo_home/bin:$PATH"
143+
cmake -S . -B build-windows -G Ninja \
144+
-DCMAKE_BUILD_TYPE=RelWithDebInfo \
145+
-DCMAKE_C_COMPILER=/usr/bin/gcc \
146+
-DCMAKE_CXX_COMPILER=/usr/bin/g++
147+
cmake --build build-windows \
148+
--parallel "$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4)" \
149+
--target \
150+
test_named_pipe \
151+
test_win_shm \
152+
test_win_service \
153+
test_win_service_payload_limits \
154+
test_win_service_extra \
155+
test_win_stress \
156+
interop_named_pipe_c \
157+
interop_named_pipe_rs \
158+
interop_named_pipe_go \
159+
interop_win_shm_c \
160+
interop_win_shm_rs \
161+
interop_win_shm_go \
162+
interop_service_win_c \
163+
interop_service_win_rs \
164+
interop_service_win_go \
165+
interop_cache_win_c \
166+
interop_cache_win_rs \
167+
interop_cache_win_go
168+
169+
- name: Run Windows runtime tests
170+
run: |
171+
set -euo pipefail
172+
ctest --test-dir build-windows --output-on-failure -j1 -R "^(test_named_pipe|test_win_shm|test_win_service|test_win_service_payload_limits|test_win_service_extra|test_named_pipe_interop|test_win_shm_interop|test_service_win_interop|test_service_win_shm_interop|test_cache_win_interop|test_cache_win_shm_interop|test_win_stress)$"

0 commit comments

Comments
 (0)