-
Notifications
You must be signed in to change notification settings - Fork 2
110 lines (94 loc) · 2.94 KB
/
internal-pr-bundle-integration-test-cpp.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
name: ⚙️ Integration Test Bundle on PR (CPP)
on:
push:
branches:
- 'main'
pull_request:
branches:
- 'main'
workflow_dispatch:
jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: [ 'cpp' ]
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Install QLT
id: install-qlt
uses: ./.github/actions/install-qlt-local
with:
qlt-version: 'latest'
add-to-path: true
- name: Validate QLT Installation
shell: bash
run: |
echo -e "Checking QLT Version:"
echo "QLT Home: ${{ steps.install-qlt.outputs.qlt-home }}"
qlt version
- name: Create Bundle (compiled)
shell: bash
run: |
if ! qlt codeql run install --base example/ --custom-bundle ; then
echo "Failed to generate bundle."
exit 1
fi
# ensure bundle runs
if ! qlt query run install-packs --use-bundle --base example/ ; then
echo "Failed to install query packs with tool."
exit 1
fi
- name: Validate Bundle Existence
shell: bash
run: |
echo "Checking Bundle Existence"
ls -l ${{ env.QLT_CODEQL_HOME }}/../out/
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
queries: security-extended
tools: ${{ env.QLT_CODEQL_BUNDLE_PATH }}
- name: Autobuild
uses: github/codeql-action/autobuild@v2
with:
working-directory: example/integration-tests/cpp/src/ # Path containing the example application
- name: Perform CodeQL Analysis
id: analysis
uses: github/codeql-action/analyze@v2
- name: Validate SARIF Location
shell: bash
run: |
# validate we have the actual sarif results
echo "Checking SARIF file location at: ${{ steps.analysis.outputs.sarif-output }}"
ls -l ${{ steps.analysis.outputs.sarif-output }}
- name: Upload SARIF Results
uses: actions/upload-artifact@v2
with:
name: actual.sarif
path: |
${{ steps.analysis.outputs.sarif-output }}/*.sarif
if-no-files-found: error
- name: Upload Bundles
uses: actions/upload-artifact@v2
with:
name: codeql-bundles
path: |
${{ env.QLT_CODEQL_BUNDLE_PATH_LINUX64 }}
${{ env.QLT_CODEQL_BUNDLE_PATH_WIN64 }}
${{ env.QLT_CODEQL_BUNDLE_PATH_OSX64 }}
if-no-files-found: error
compression-level: 0
- name: Validate SARIF Results
shell: bash
run: |
# Compare the expected vs the actual
qlt bundle run validate-integration-tests --expected example/integration-tests/cpp/expected.sarif --actual ${{ steps.analysis.outputs.sarif-output }}/cpp.sarif