Commits on Nov 14, 2023

1. Build components in CodeQL pipeline …

   Need to build binaries for CodeQL to work:
   
   > For the compiled languages C/C++, C#, Go, Java, and Swift, the process of populating
   > this database involves building the code and extracting data.
   
   docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#about-the-codeql-analysis-workflow-and-compiled-languages
   
   Without explicit build commands between CodeQL `init` and `analyze`
   steps, CodeQL will attempt to automatically build go code using the
   following logic:
   docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#autobuild-for-go
   
   This can be see in the `CodeQL Analyze` step in out pipelines:
   
   ```
   Attempting to automatically build go code
     Autobuilder was built with go1.21.3, environment has go1.20.10
     LGTM_SRC is /home/runner/work/hcsshim/hcsshim
     Found go.mod, enabling go modules
     Import path is 'github.com/microsoft/hcsshim'
     Makefile found.
     Trying build command make []
     make: *** No rule to make target 'base.tar.gz', needed by 'out/initrd.img'.  Stop.
     Running /usr/bin/make failed, continuing anyway: exit status 2
     Build failed, continuing to install dependencies.
     Skipping dependency installation because a Go vendor directory was found.
     Running extractor command '/opt/hostedtoolcache/CodeQL/2.15.2/x64/codeql/go/tools/linux64/go-extractor [-mod=vendor ./...]' from directory '.'.
     <...>
   ```
   
   Rather than rely on autobuild, explicitly configure CodeQL and build
   necessary targets.
   
   Skip running CodeQL on PRs if no code is changed.
   
   Based on workflow:
   github.com/github/codeql/blob/0342b3eba242476cea815e601942021092d0bc10/.github/workflows/codeql-analysis.yml
   
   Signed-off-by: Hamza El-Saawy <hamzaelsaawy@microsoft.com>

   

   helsaawy committed Nov 14, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for f14bb53
   • Browse repository at this point

   Copy the full SHA

   f14bb53 View commit details

   Browse the repository at this point in the history