# This workflow runs CodeQL against the repository. | |
# | |
# Results are uploaded to GitHub Code Scanning. | |
# | |
# Due to a known issue with the CodeQL extractor when building the edk2 | |
# codebase on Linux systems, only Windows agents are used for build with | |
# the VS toolchain. | |
# | |
# Copyright (c) Microsoft Corporation. | |
# SPDX-License-Identifier: BSD-2-Clause-Patent | |
name: "CodeQL" | |
on: | |
push: | |
branches: | |
- master | |
pull_request: | |
branches: | |
- master | |
paths-ignore: | |
- '!**.c' | |
- '!**.h' | |
jobs: | |
analyze: | |
name: Analyze | |
runs-on: windows-2019 | |
permissions: | |
actions: read | |
contents: read | |
security-events: write | |
strategy: | |
fail-fast: false | |
matrix: | |
include: | |
- Package: "ArmPkg" | |
ArchList: "IA32,X64" | |
- Package: "CryptoPkg" | |
ArchList: "IA32" | |
- Package: "CryptoPkg" | |
ArchList: "X64" | |
- Package: "DynamicTablesPkg" | |
ArchList: "IA32,X64" | |
- Package: "FatPkg" | |
ArchList: "IA32,X64" | |
- Package: "FmpDevicePkg" | |
ArchList: "IA32,X64" | |
- Package: "IntelFsp2Pkg" | |
ArchList: "IA32,X64" | |
- Package: "IntelFsp2WrapperPkg" | |
ArchList: "IA32,X64" | |
- Package: "MdeModulePkg" | |
ArchList: "IA32" | |
- Package: "MdeModulePkg" | |
ArchList: "X64" | |
- Package: "MdePkg" | |
ArchList: "IA32,X64" | |
- Package: "PcAtChipsetPkg" | |
ArchList: "IA32,X64" | |
- Package: "PrmPkg" | |
ArchList: "IA32,X64" | |
- Package: "SecurityPkg" | |
ArchList: "IA32,X64" | |
- Package: "ShellPkg" | |
ArchList: "IA32,X64" | |
- Package: "SourceLevelDebugPkg" | |
ArchList: "IA32,X64" | |
- Package: "StandaloneMmPkg" | |
ArchList: "IA32,X64" | |
- Package: "UefiCpuPkg" | |
ArchList: "IA32,X64" | |
- Package: "UnitTestFrameworkPkg" | |
ArchList: "IA32,X64" | |
steps: | |
- name: Checkout repository | |
uses: actions/checkout@v4 | |
- name: Install Python | |
uses: actions/setup-python@v5 | |
with: | |
python-version: '3.11' | |
cache: 'pip' | |
cache-dependency-path: 'pip-requirements.txt' | |
- name: Use Git Long Paths on Windows | |
if: runner.os == 'Windows' | |
shell: pwsh | |
run: | | |
git config --system core.longpaths true | |
- name: Install/Upgrade pip Modules | |
run: pip install -r pip-requirements.txt --upgrade requests sarif-tools | |
- name: Determine CI Settings File Supported Operations | |
id: get_ci_file_operations | |
shell: python | |
run: | | |
import importlib | |
import os | |
import sys | |
from pathlib import Path | |
from edk2toolext.invocables.edk2_ci_setup import CiSetupSettingsManager | |
from edk2toolext.invocables.edk2_setup import SetupSettingsManager | |
# Find the repo CI Settings file | |
ci_settings_file = list(Path(os.environ['GITHUB_WORKSPACE']).rglob('.pytool/CISettings.py')) | |
# Note: At this point, submodules have not been pulled, only one CI Settings file should exist | |
if len(ci_settings_file) != 1 or not ci_settings_file[0].is_file(): | |
print("::error title=Workspace Error!::Failed to find CI Settings file!") | |
sys.exit(1) | |
ci_settings_file = ci_settings_file[0] | |
# Try Finding the Settings class in the file | |
module_name = 'ci_settings' | |
spec = importlib.util.spec_from_file_location(module_name, ci_settings_file) | |
module = importlib.util.module_from_spec(spec) | |
spec.loader.exec_module(module) | |
try: | |
settings = getattr(module, 'Settings') | |
except AttributeError: | |
print("::error title=Workspace Error!::Failed to find Settings class in CI Settings file!") | |
sys.exit(1) | |
# Determine Which Operations Are Supported by the Settings Class | |
ci_setup_supported = issubclass(settings, CiSetupSettingsManager) | |
setup_supported = issubclass(settings, SetupSettingsManager) | |
with open(os.environ['GITHUB_OUTPUT'], 'a') as fh: | |
print(f'ci_setup_supported={str(ci_setup_supported).lower()}', file=fh) | |
print(f'setup_supported={str(setup_supported).lower()}', file=fh) | |
- name: Convert Arch to Log Format | |
id: convert_arch_hyphen | |
env: | |
ARCH_LIST: ${{ matrix.ArchList }} | |
shell: python | |
run: | | |
import os | |
with open(os.environ['GITHUB_OUTPUT'], 'a') as fh: | |
print(f'arch_list={os.environ["ARCH_LIST"].replace(",", "-")}', file=fh) | |
- name: Setup | |
if: steps.get_ci_file_operations.outputs.setup_supported == 'true' | |
run: stuart_setup -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 | |
- name: Upload Setup Log As An Artifact | |
uses: actions/upload-artifact@v4 | |
if: (success() || failure()) && steps.get_ci_file_operations.outputs.setup_supported == 'true' | |
with: | |
name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-Setup-Log | |
path: | | |
**/SETUPLOG.txt | |
retention-days: 7 | |
if-no-files-found: ignore | |
- name: CI Setup | |
if: steps.get_ci_file_operations.outputs.ci_setup_supported == 'true' | |
run: stuart_ci_setup -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 | |
- name: Upload CI Setup Log As An Artifact | |
uses: actions/upload-artifact@v4 | |
if: (success() || failure()) && steps.get_ci_file_operations.outputs.ci_setup_supported == 'true' | |
with: | |
name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-CI-Setup-Log | |
path: | | |
**/CISETUP.txt | |
retention-days: 7 | |
if-no-files-found: ignore | |
- name: Update | |
run: stuart_update -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 | |
- name: Upload Update Log As An Artifact | |
uses: actions/upload-artifact@v4 | |
if: success() || failure() | |
with: | |
name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-Update-Log | |
path: | | |
**/UPDATE_LOG.txt | |
retention-days: 7 | |
if-no-files-found: ignore | |
- name: Build Tools From Source | |
run: python BaseTools/Edk2ToolsBuild.py -t VS2019 | |
- name: Find CodeQL Plugin Directory | |
id: find_dir | |
shell: python | |
run: | | |
import os | |
import sys | |
from pathlib import Path | |
# Find the plugin directory that contains the CodeQL plugin | |
plugin_dir = list(Path(os.environ['GITHUB_WORKSPACE']).rglob('BaseTools/Plugin/CodeQL')) | |
# This should only be found once | |
if len(plugin_dir) == 1: | |
plugin_dir = str(plugin_dir[0]) | |
with open(os.environ['GITHUB_OUTPUT'], 'a') as fh: | |
print(f'codeql_plugin_dir={plugin_dir}', file=fh) | |
else: | |
print("::error title=Workspace Error!::Failed to find CodeQL plugin directory!") | |
sys.exit(1) | |
- name: Get CodeQL CLI Cache Data | |
id: cache_key_gen | |
env: | |
CODEQL_PLUGIN_DIR: ${{ steps.find_dir.outputs.codeql_plugin_dir }} | |
shell: python | |
run: | | |
import os | |
import yaml | |
codeql_cli_ext_dep_name = 'codeqlcli_windows_ext_dep' | |
codeql_plugin_file = os.path.join(os.environ['CODEQL_PLUGIN_DIR'], codeql_cli_ext_dep_name + '.yaml') | |
with open (codeql_plugin_file) as pf: | |
codeql_cli_ext_dep = yaml.safe_load(pf) | |
cache_key_name = codeql_cli_ext_dep['name'] | |
cache_key_version = codeql_cli_ext_dep['version'] | |
cache_key = f'{cache_key_name}-{cache_key_version}' | |
codeql_plugin_cli_ext_dep_dir = os.path.join(os.environ['CODEQL_PLUGIN_DIR'], codeql_cli_ext_dep['name'].strip() + '_extdep') | |
with open(os.environ['GITHUB_OUTPUT'], 'a') as fh: | |
print(f'codeql_cli_cache_key={cache_key}', file=fh) | |
print(f'codeql_cli_ext_dep_dir={codeql_plugin_cli_ext_dep_dir}', file=fh) | |
- name: Attempt to Load CodeQL CLI From Cache | |
id: codeqlcli_cache | |
uses: actions/cache@v4 | |
with: | |
path: ${{ steps.cache_key_gen.outputs.codeql_cli_ext_dep_dir }} | |
key: ${{ steps.cache_key_gen.outputs.codeql_cli_cache_key }} | |
- name: Download CodeQL CLI | |
if: steps.codeqlcli_cache.outputs.cache-hit != 'true' | |
run: stuart_update -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 --codeql | |
- name: Remove CI Plugins Irrelevant to CodeQL | |
shell: python | |
env: | |
CODEQL_PLUGIN_DIR: ${{ steps.find_dir.outputs.codeql_plugin_dir }} | |
run: | | |
import os | |
import shutil | |
from pathlib import Path | |
# Only these two plugins are needed for CodeQL | |
plugins_to_keep = ['CompilerPlugin'] | |
plugin_dir = Path('.pytool/Plugin').absolute() | |
if plugin_dir.is_dir(): | |
for dir in plugin_dir.iterdir(): | |
if str(dir.stem) not in plugins_to_keep: | |
shutil.rmtree(str(dir.absolute()), ignore_errors=True) | |
- name: CI Build | |
env: | |
STUART_CODEQL_PATH: ${{ steps.cache_key_gen.outputs.codeql_cli_ext_dep_dir }} | |
run: stuart_ci_build -c .pytool/CISettings.py -t DEBUG -p ${{ matrix.Package }} -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 --codeql | |
- name: Build Cleanup | |
id: build_cleanup | |
shell: python | |
run: | | |
import os | |
import shutil | |
from pathlib import Path | |
dirs_to_delete = ['ia32', 'x64', 'arm', 'aarch64'] | |
def delete_dirs(path: Path): | |
if path.exists() and path.is_dir(): | |
if path.name.lower() in dirs_to_delete: | |
print(f'Removed {str(path)}') | |
shutil.rmtree(path) | |
return | |
for child_dir in path.iterdir(): | |
delete_dirs(child_dir) | |
build_path = Path(os.environ['GITHUB_WORKSPACE'], 'Build') | |
delete_dirs(build_path) | |
- name: Upload Build Logs As An Artifact | |
uses: actions/upload-artifact@v4 | |
if: success() || failure() | |
with: | |
name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-Build-Logs | |
path: | | |
**/BUILD_REPORT.TXT | |
**/OVERRIDELOG.TXT | |
**/BUILDLOG_*.md | |
**/BUILDLOG_*.txt | |
**/CI_*.md | |
**/CI_*.txt | |
retention-days: 7 | |
if-no-files-found: ignore | |
- name: Prepare Env Data for CodeQL Upload | |
id: env_data | |
env: | |
PACKAGE_NAME: ${{ matrix.Package }} | |
shell: python | |
run: | | |
import logging | |
import os | |
from edk2toollib.utility_functions import RunCmd | |
from io import StringIO | |
from pathlib import Path | |
package = os.environ['PACKAGE_NAME'].strip().lower() | |
directory_name = 'codeql-analysis-' + package + '-debug' | |
file_name = 'codeql-db-' + package + '-debug-0.sarif' | |
sarif_path = Path('Build', directory_name, file_name) | |
with open(os.environ['GITHUB_OUTPUT'], 'a') as fh: | |
if sarif_path.is_file(): | |
emacs_file_path = sarif_path.with_name(sarif_path.stem + "-emacs.txt") | |
out_stream_buffer = StringIO() | |
exit_code = RunCmd("sarif", f"emacs {sarif_path} --output {emacs_file_path} --no-autotrim", | |
outstream=out_stream_buffer, | |
logging_level=logging.NOTSET) | |
print(f'upload_sarif_file=true', file=fh) | |
print(f'emacs_file_path={emacs_file_path}', file=fh) | |
print(f'sarif_file_path={sarif_path}', file=fh) | |
else: | |
print(f'upload_sarif_file=false', file=fh) | |
- name: Upload CodeQL Results (SARIF) As An Artifact | |
uses: actions/upload-artifact@v4 | |
if: steps.env_data.outputs.upload_sarif_file == 'true' | |
with: | |
name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-CodeQL-SARIF | |
path: | | |
${{ steps.env_data.outputs.emacs_file_path }} | |
${{ steps.env_data.outputs.sarif_file_path }} | |
retention-days: 14 | |
if-no-files-found: warn | |
- name: Upload CodeQL Results (SARIF) To GitHub Code Scanning | |
uses: github/codeql-action/upload-sarif@v3 | |
if: steps.env_data.outputs.upload_sarif_file == 'true' | |
with: | |
# Path to SARIF file relative to the root of the repository. | |
sarif_file: ${{ steps.env_data.outputs.sarif_file_path }} | |
# Optional category for the results. Used to differentiate multiple results for one commit. | |
# Each package is a separate category. | |
category: ${{ matrix.Package }} |