Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: c1393bd4867b9b1cc2ec1e203eac2e2520ad6ce7
https://github.com/tianocore/edk2/commit/c1393bd4867b9b1cc2ec1e203eac2e2520ad6ce7
Author: Michael Kubacki <[email protected]>
Date: 2023-11-07 (Tue, 07 Nov 2023)
Changed paths:
R .github/codeql/codeql-config.yml
R .github/codeql/edk2.qls
R .github/workflows/codeql-analysis.yml
Log Message:
-----------
Remove existing CodeQL infrastructure
CodeQL currently runs via the codeql-analysis.yml GitHub workflow
which uses the `github/codeql-action/init@v2` action (pre-build)
and the `github/codeql-action/analyze@v2` action (post-build) to
setup the CodeQL environment and extract results.
This infrastructure is removed in preparation for a new design that
will directly run the CodeQL CLI as part of the build. This will
allow CodeQL to be run locally as part of the normal build process
with results that match 1:1 with CI builds.
Cc: Sean Brogan <[email protected]>
Cc: Michael D Kinney <[email protected]>
Signed-off-by: Michael Kubacki <[email protected]>
Reviewed-by: Sean Brogan <[email protected]>
Acked-by: Laszlo Ersek <[email protected]>
Acked-by: Michael D Kinney <[email protected]>
Commit: 5464d0bed60ccdb160f6d32c2ad9af203c1542c9
https://github.com/tianocore/edk2/commit/5464d0bed60ccdb160f6d32c2ad9af203c1542c9
Author: Michael Kubacki <[email protected]>
Date: 2023-11-07 (Tue, 07 Nov 2023)
Changed paths:
A BaseTools/Plugin/CodeQL/CodeQlAnalyzePlugin.py
A BaseTools/Plugin/CodeQL/CodeQlAnalyze_plug_in.yaml
A BaseTools/Plugin/CodeQL/CodeQlBuildPlugin.py
A BaseTools/Plugin/CodeQL/CodeQlBuild_plug_in.yaml
A BaseTools/Plugin/CodeQL/CodeQlQueries.qls
A BaseTools/Plugin/CodeQL/Readme.md
A BaseTools/Plugin/CodeQL/analyze/__init__.py
A BaseTools/Plugin/CodeQL/analyze/analyze_filter.py
A BaseTools/Plugin/CodeQL/analyze/globber.py
A BaseTools/Plugin/CodeQL/codeqlcli_ext_dep.yaml
A BaseTools/Plugin/CodeQL/codeqlcli_linux_ext_dep.yaml
A BaseTools/Plugin/CodeQL/codeqlcli_windows_ext_dep.yaml
A BaseTools/Plugin/CodeQL/common/__init__.py
A BaseTools/Plugin/CodeQL/common/codeql_plugin.py
Log Message:
-----------
BaseTools/Plugin/CodeQL: Add CodeQL build plugin
Adds a CodeQL plugin that supports CodeQL in the build system.
1. CodeQlBuildPlugin - Generates a CodeQL database for a given build.
2. CodeQlAnalyzePlugin - Analyzes a CodeQL database and interprets
results.
3. External dependencies - Assist with downloading the CodeQL CLI and
making it available to the CodeQL plugins.
4. CodeQlQueries.qls - A C/C++ CodeQL query set run against the code.
5. Readme.md - A comprehensive readme file to help:
- Platform integrators understand how to configure the plugin
- Developers understand how to modify the plugin
- Users understand how to use the plugin
Read Readme.md for additional details.
Cc: Bob Feng <[email protected]>
Cc: Liming Gao <[email protected]>
Cc: Michael D Kinney <[email protected]>
Cc: Rebecca Cran <[email protected]>
Cc: Sean Brogan <[email protected]>
Cc: Yuwei Chen <[email protected]>
Signed-off-by: Michael Kubacki <[email protected]>
Reviewed-by: Yuwei Chen <[email protected]>
Reviewed-by: Sean Brogan <[email protected]>
Acked-by: Laszlo Ersek <[email protected]>
Acked-by: Michael D Kinney <[email protected]>
Commit: b531ca4bb37b59c3fef6b7dd927b62b21a688075
https://github.com/tianocore/edk2/commit/b531ca4bb37b59c3fef6b7dd927b62b21a688075
Author: Michael Kubacki <[email protected]>
Date: 2023-11-07 (Tue, 07 Nov 2023)
Changed paths:
A BaseTools/Plugin/CodeQL/integration/__init__.py
A BaseTools/Plugin/CodeQL/integration/stuart_codeql.py
Log Message:
-----------
BaseTools/Plugin/CodeQL: Add integration helpers
Adds a Python module to the CodeQL plugin directory that exports
functions commonly needed for Stuart-based platforms to easily
enable CodeQL in their platform build.
This functionality has already moved to edk2-pytool-extensions
https://github.com/tianocore/edk2-pytool-extensions in the
`edk2toolext/codeql.py` file but edk2 is too far behind to use that.
Additional integration changes are needed in edk2 and the series
to add those has not made it past review. In the meantime, the
functions are available locally in this commit and this commit can
be reverted after edk2-pytool-extensions 0.24.1 or greater is used
in edk2.
Cc: Bob Feng <[email protected]>
Cc: Liming Gao <[email protected]>
Cc: Michael D Kinney <[email protected]>
Cc: Rebecca Cran <[email protected]>
Cc: Sean Brogan <[email protected]>
Cc: Yuwei Chen <[email protected]>
Signed-off-by: Michael Kubacki <[email protected]>
Reviewed-by: Sean Brogan <[email protected]>
Acked-by: Laszlo Ersek <[email protected]>
Acked-by: Michael D Kinney <[email protected]>
Commit: 29763016e01f1d085227063a6b8979229538127d
https://github.com/tianocore/edk2/commit/29763016e01f1d085227063a6b8979229538127d
Author: Michael Kubacki <[email protected]>
Date: 2023-11-07 (Tue, 07 Nov 2023)
Changed paths:
M .pytool/CISettings.py
Log Message:
-----------
.pytool/CISettings.py: Integrate CodeQL
Adds the `--codeql` parameter to `stuart_update` and
`stuart_ci_build`.
- `stuart_update --codeql` - Downloads the CodeQL CLI locally. The
command will pull the appropriate binary for the host OS.
- `stuart_ci_build --codeql` - Runs CodeQL during the build resulting
in a CodeQL database and SARIF result file in the `Build`
directory.
Cc: Sean Brogan <[email protected]>
Cc: Michael D Kinney <[email protected]>
Cc: Liming Gao <[email protected]>
Signed-off-by: Michael Kubacki <[email protected]>
Reviewed-by: Sean Brogan <[email protected]>
Acked-by: Laszlo Ersek <[email protected]>
Acked-by: Michael D Kinney <[email protected]>
Commit: 1384ce443ded4e75fce9c100a98ed0897619f098
https://github.com/tianocore/edk2/commit/1384ce443ded4e75fce9c100a98ed0897619f098
Author: Michael Kubacki <[email protected]>
Date: 2023-11-07 (Tue, 07 Nov 2023)
Changed paths:
A .github/workflows/codeql.yml
Log Message:
-----------
.github/workflows/codeql.yml: Add CodeQL workflow
Adds a workflow to run CodeQL against all packages built in
.pytool/CISettings.py. The following is done:
1. Determine which packages to build against. Those that support
are managed by .pytool/CISettings.py will be selected.
For each package:
2. Determine how to interact with the package. Such as whether
`stuart_ci_setup` or `stuart_setup` should be used.
3. Perform supported Stuart steps for setup and update.
4. Discover the CodeQL plugin directory in the repo.
5. Attempt to load the CodeQL CLI specific to the host OS from a
GitHub cache.
6. Perform the build.
7. Clean up some files after build to improve robustness.
8. Upload the CodeQL results (generated SARIF file) to GitHub Code
Scanning. The results will be associated with the trigger of the
workflow.
After each step that can upload logs such as the setup, update, and
build steps the logs are uploaded as an artifact to the workflow run.
This allows easy debugging in case there's an error in the step.
The SARIF file is also uploaded to the workflow run so it can be
downloaded and analyzed.
Cc: Sean Brogan <[email protected]>
Cc: Michael D Kinney <[email protected]>
Signed-off-by: Michael Kubacki <[email protected]>
Reviewed-by: Sean Brogan <[email protected]>
Acked-by: Laszlo Ersek <[email protected]>
Acked-by: Michael D Kinney <[email protected]>
Commit: a3e8efcc8efa87b3cafb5648e956b3396493fce1
https://github.com/tianocore/edk2/commit/a3e8efcc8efa87b3cafb5648e956b3396493fce1
Author: Michael Kubacki <[email protected]>
Date: 2023-11-07 (Tue, 07 Nov 2023)
Changed paths:
M .pytool/CISettings.py
Log Message:
-----------
.pytool/CISettings: Enable CodeQL audit mode
Since a large number of CodeQL queries are being enabled to identify
issues that the community can collectively resolve, audit mode needs to
be enabled to prevent the build from failing.
In the future, this global audit mode can be disabled and individual
packages can enable/disable audit mode in their package CI YAML file
using the instructions in the CodeQL plugin readme.
Cc: Sean Brogan <[email protected]>
Cc: Michael D Kinney <[email protected]>
Cc: Liming Gao <[email protected]>
Signed-off-by: Michael Kubacki <[email protected]>
Reviewed-by: Sean Brogan <[email protected]>
Acked-by: Laszlo Ersek <[email protected]>
Acked-by: Michael D Kinney <[email protected]>
Commit: d461137e22ed46fdae725741decb44b91e59c110
https://github.com/tianocore/edk2/commit/d461137e22ed46fdae725741decb44b91e59c110
Author: Michael Kubacki <[email protected]>
Date: 2023-11-07 (Tue, 07 Nov 2023)
Changed paths:
M BaseTools/Plugin/CodeQL/CodeQlQueries.qls
Log Message:
-----------
BaseTools/Plugin/CodeQL: Enable 30 queries
Updates the CodeQL queries opted into by edk2 to a set of queries from
the standard CodeQL query package `codeql/cpp-queries`.
After testing a large number of queries the included set here were
found to be the most useful with the least number of false positives.
Some queries had a number of issues that led to them being placed on
the exclusion list so that they are not considered in the future
without the notes there being taken into account.
General details about queries available in the pack are available here:
https://codeql.github.com/codeql-query-help/cpp/
The issues found by these queries will need to be fixed over time. In
the meantime, the results will show to those that have permission in
the repo's GitHub Code Scanning area. The build will not fail due to
CodeQL issues (since they are not all fixed) but that can be enabled in
the future.
Cc: Bob Feng <[email protected]>
Cc: Liming Gao <[email protected]>
Cc: Michael D Kinney <[email protected]>
Cc: Rebecca Cran <[email protected]>
Cc: Sean Brogan <[email protected]>
Cc: Yuwei Chen <[email protected]>
Signed-off-by: Michael Kubacki <[email protected]>
Reviewed-by: Sean Brogan <[email protected]>
Acked-by: Laszlo Ersek <[email protected]>
Acked-by: Michael D Kinney <[email protected]>
Commit: c96b4da2a079eb837ab3af9aeb86a97078b3bde6
https://github.com/tianocore/edk2/commit/c96b4da2a079eb837ab3af9aeb86a97078b3bde6
Author: Michael Kubacki <[email protected]>
Date: 2023-11-07 (Tue, 07 Nov 2023)
Changed paths:
M ReadMe.rst
Log Message:
-----------
ReadMe.rst: Add CodeQL/analyze directory under other licenses
The code in this directory is licensed under Apache License, Version
2.0. Therefore, the directory is listed under paths with licenses
other than BSD-2-Clause Plus Patent. The directory link points to the
complete Apache License, Version 2.0 on apache.org.
Cc: Andrew Fish <[email protected]>
Cc: Laszlo Ersek <[email protected]>
Cc: Leif Lindholm <[email protected]>
Cc: Michael D Kinney <[email protected]>
Signed-off-by: Michael Kubacki <[email protected]>
Reviewed-by: Laszlo Ersek <[email protected]>
Reviewed-by: Sean Brogan <[email protected]>
Compare: https://github.com/tianocore/edk2/compare/da219919538b...c96b4da2a079
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
