feat(codeql): add CodeQL enablement check as a dedicated extension

charts/bootstrapping/values.documentation.yaml

@@ -516,6 +516,41 @@ extensions_cfg:
     # - warning: skip processing and log a warning message (default)
     on_unsupported: warning
 
+  # @param extensions_cfg.codeql worker which checks whether GitHub Advanced Security CodeQL is
+  # enabled for each OCM source artefact and creates findings for languages that are configured but
+  # not actively scanned
+  codeql:
+    # @param extensions_cfg.codeql.enabled allows disabling of extension without removing its
+    # configuration
+    enabled: true
+    # @param extensions_cfg.codeql.delivery_service_url url to access the delivery-service (cluster
+    # internal url is sufficient)
+    # e.g.
+    # delivery_service_url: http://delivery-service.<namespace>.svc.cluster.local:8080
+    delivery_service_url: ""
+    # @param extensions_cfg.codeql.interval time (in seconds) after which a component should be
+    # re-checked the latest
+    interval: 86400 # 24h
+    # @param extensions_cfg.codeql.languages list of programming languages to check CodeQL coverage
+    # for. A finding is emitted for each language that is present in the repository but not actively
+    # scanned by CodeQL. Use the language names as returned by the GitHub repository languages API
+    # (e.g. 'go', 'python', 'javascript'). The extension automatically handles CodeQL-specific
+    # language identifiers (e.g. maps 'javascript-typescript' back to 'javascript').
+    # e.g.
+    # languages:
+    #   - go
+    #   - python
+    #   - javascript
+    languages:
+      - ""
+    # @param extensions_cfg.codeql.on_unsupported behaviour in case the detected artefact
+    # kind/type/access is not supported
+    # options:
+    # - fail: raise an exception
+    # - ignore: skip processing
+    # - warning: skip processing and log a warning message (default)
+    on_unsupported: warning
+
   # @param extensions_cfg.issue_replicator worker which takes care of the GitHub issue lifecycle for
   # detected findings
   issue_replicator:
@@ -1163,6 +1198,7 @@ features_cfg:
 findings:
     # @param findings[].type type of finding this configuration is used for
     # options:
+    # - finding/codeql
     # - finding/crypto
     # - finding/diki
     # - finding/falco
@@ -1543,6 +1579,7 @@ profiles:
     # @param profiles[].finding_types list of finding types which should be displayed for users who
     # selected this profile in the delivery-dashboard
     # options:
+    # - finding/codeql
     # - finding/crypto
     # - finding/diki
     # - finding/falco

charts/extensions/Chart.yaml

@@ -29,6 +29,9 @@ dependencies:
   - name: ghas
     repository: file://charts/ghas
     condition: ghas.enabled
+  - name: codeql
+    repository: file://charts/codeql
+    condition: codeql.enabled
   - name: issue-replicator
     repository: file://charts/issue-replicator
     condition: issue-replicator.enabled

charts/extensions/charts/codeql/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+name: codeql
+version: 0.1.0

charts/extensions/charts/codeql/templates/codeql.yaml

@@ -0,0 +1,111 @@
+{{- $podName := "codeql" }}
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $podName }}
+  namespace: {{ .Values.target_namespace | default .Release.Namespace }}
+  {{- if default dict (.Values.deployment).annotations }}
+  annotations:
+  {{- range $annotation, $value := .Values.deployment.annotations }}
+    {{ $annotation }}: {{ $value }}
+  {{- end }}
+  {{- end }}
+spec:
+  replicas: 0 # will be scaled automatically by backlog-controller
+  selector:
+    matchLabels:
+      app: {{ $podName }}
+      delivery-gear.gardener.cloud/service: codeql
+  template:
+    metadata:
+      labels:
+        app: {{ $podName }}
+        delivery-gear.gardener.cloud/service: codeql
+    spec:
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app: {{ $podName }}
+      terminationGracePeriodSeconds: 300 # 5 min
+      containers:
+        - name: {{ $podName }}
+          image: {{ include "image" .Values.global.image }}
+          imagePullPolicy: IfNotPresent
+          command:
+            - python3
+            - -m
+            - codeql
+          securityContext:
+            allowPrivilegeEscalation: false
+          env:
+            - name: SECRET_FACTORY_PATH
+              value: /secrets
+            - name: EXTENSIONS_CFG_PATH
+              value: /extensions_cfg/extensions_cfg
+            - name: FINDINGS_CFG_PATH
+              value: /findings_cfg/findings_cfg
+            - name: OCM_REPO_MAPPINGS_PATH
+              value: /ocm_repo_mappings/ocm_repo_mappings
+            - name: K8S_TARGET_NAMESPACE
+              value: {{ .Values.target_namespace | default .Release.Namespace }}
+          volumeMounts:
+            - name: github
+              mountPath: /secrets/github
+            - name: github-app
+              mountPath: /secrets/github-app
+            - name: extensions-cfg
+              mountPath: /extensions_cfg
+            - name: findings-cfg
+              mountPath: /findings_cfg
+            - name: ocm-repo-mappings
+              mountPath: /ocm_repo_mappings
+              readOnly: true
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - sleep
+                  - "60"
+          resources:
+            requests:
+              memory: 100Mi
+              cpu: 250m
+            limits:
+              memory: 300Mi
+              cpu: 500m
+      volumes:
+        - name: github
+          secret:
+            secretName: secret-factory-github
+            optional: true
+        - name: github-app
+          secret:
+            secretName: secret-factory-github-app
+            optional: true
+        - name: extensions-cfg
+          configMap:
+            name: extensions-cfg
+        - name: findings-cfg
+          configMap:
+            name: findings-cfg
+        - name: ocm-repo-mappings
+          configMap:
+            name: ocm-repo-mappings
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-egress-from-codeql
+  namespace: {{ .Values.target_namespace | default .Release.Namespace }}
+spec:
+  podSelector:
+    matchLabels:
+      app: {{ $podName }}
+  policyTypes:
+    - Egress
+  egress:
+    - {}  # Allows all egress traffic to any destination and port

charts/extensions/values.yaml

@@ -21,6 +21,10 @@ clamav:
   deployment:
     annotations: []
   enabled: false
+codeql:
+  deployment:
+    annotations: []
+  enabled: false
 crypto:
   deployment:
     annotations: []

src/artefact_enumerator.py

@@ -381,6 +381,23 @@ def _process_compliance_snapshot_of_artefact(
         if uncommitted_backlog_item:
             uncommitted_backlog_items.append(uncommitted_backlog_item)
 
+    if (
+        extensions_cfg.codeql
+        and extensions_cfg.codeql.enabled
+        and extensions_cfg.codeql.is_supported(artefact_kind=artefact.artefact_kind)
+    ):
+        compliance_snapshot, uncommitted_backlog_item = _create_backlog_item_for_extension(
+            finding_cfgs=finding_cfgs,
+            finding_types=(odg.model.Datatype.CODEQL_FINDING,),
+            artefact=artefact,
+            compliance_snapshot=compliance_snapshot,
+            service=odg.extensions_cfg.Services.CODEQL,
+            interval_seconds=extensions_cfg.codeql.interval,
+            now=now,
+        )
+        if uncommitted_backlog_item:
+            uncommitted_backlog_items.append(uncommitted_backlog_item)
+
     if (
         extensions_cfg.osid
         and extensions_cfg.osid.enabled