blob: 393f69dffa422e7e03d5543e8f088516a647c2b9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
|
# This workflow runs the latest CodeQL CLI and checks against CodeQL's Cpp library.
# This is the source for the GitHub Security Code Scanning job.
# On push/schedule: samples are split across 4 parallel shards to reduce wall-clock
# time while keeping ThrottleLimit 1 per shard (required for accurate CodeQL tracing).
# On pull_request: only changed samples are built in a single job (no sharding needed).
name: "CodeQL Analysis"
on:
push:
branches:
- main
- develop
paths-ignore:
- '**.md'
- 'LICENSE'
pull_request:
# The branches below must be a subset of the branches above
branches:
- main
- develop
paths-ignore:
- '**.md'
- 'LICENSE'
# Allow manual scheduling
workflow_dispatch:
jobs:
# -----------------------------------------------------------------------
# PR job: single runner, builds only changed samples
# -----------------------------------------------------------------------
analyze-pr:
name: Analysis (PR)
if: github.event_name == 'pull_request'
runs-on: windows-latest
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: [c-cpp]
build-mode: [manual]
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
submodules: 'recursive'
- name: Install Nuget Packages
run: nuget restore .\packages.config -PackagesDirectory .\packages\
- name: Get changed files
id: get-changed-files
uses: tj-actions/changed-files@v41
with:
separator: ","
- name: Initialize CodeQL
uses: github/codeql-action/init@v4
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
config-file: microsoft/Windows-Driver-Developer-Supplemental-Tools/config/codeql-config.yml@development
- name: Build changed samples (PR)
run: |
$changedFiles = "${{ steps.get-changed-files.outputs.all_changed_files }}".Split(',')
.\.github\scripts\Build-ChangedSamples.ps1 -ChangedFiles $changedFiles -Verbose
env:
WDS_Configuration: Debug
WDS_Platform: x64
WDS_WipeOutputs: ${{ true }}
- name: Perform CodeQL analysis
uses: github/codeql-action/analyze@v4
with:
category: "/language:${{ matrix.language }}"
# -----------------------------------------------------------------------
# Push/schedule job: 4 parallel shards, each builds a slice of all samples
# -----------------------------------------------------------------------
analyze:
name: Analysis (shard ${{ matrix.shard }} of 4)
if: github.event_name != 'pull_request'
runs-on: windows-latest
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: [c-cpp]
build-mode: [manual]
shard: [1, 2, 3, 4]
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
submodules: 'recursive'
- name: Install Nuget Packages
run: nuget restore .\packages.config -PackagesDirectory .\packages\
- name: Initialize CodeQL
uses: github/codeql-action/init@v4
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
config-file: microsoft/Windows-Driver-Developer-Supplemental-Tools/config/codeql-config.yml@development
- name: Build sample shard ${{ matrix.shard }} of 4
run: |
$totalShards = 4
$shardIndex = ${{ matrix.shard }} - 1
$allSamples = .\ListAllSamples.ps1
$shardSize = [Math]::Ceiling($allSamples.Count / $totalShards)
$start = $shardIndex * $shardSize
$mySamples = $allSamples | Select-Object -Skip $start -First $shardSize
Write-Output "Shard ${{ matrix.shard }}/$totalShards — building $($mySamples.Count) of $($allSamples.Count) samples (indices $start..$($start + $mySamples.Count - 1))"
.\Build-Samples.ps1 -Samples $mySamples -Verbose -ThrottleLimit 1
env:
WDS_Configuration: Debug
WDS_Platform: x64
WDS_WipeOutputs: ${{ true }}
- name: Perform CodeQL analysis
uses: github/codeql-action/analyze@v4
with:
category: "/language:${{ matrix.language }}/shard-${{ matrix.shard }}"
|
