CodeQL Security Analysis #431
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL Security Analysis | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| schedule: | |
| # Run weekly on Sunday at midnight UTC | |
| - cron: '0 0 * * 0' | |
| # Cancel in-progress runs for the same branch | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ========================================================================== | |
| # CodeQL Analysis for C/C++ (Primary focus - PHP extension code) | |
| # ========================================================================== | |
| analyze-cpp: | |
| name: CodeQL C/C++ | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 60 | |
| container: | |
| image: php:8.3-cli-bookworm | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Install build dependencies | |
| run: | | |
| set -eu | |
| export DEBIAN_FRONTEND=noninteractive | |
| apt-get update | |
| apt-get install -y --no-install-recommends \ | |
| autoconf \ | |
| build-essential \ | |
| ca-certificates \ | |
| g++ \ | |
| git \ | |
| libicu-dev \ | |
| libreadline-dev \ | |
| libssl-dev \ | |
| libtool \ | |
| pkg-config \ | |
| wget \ | |
| curl \ | |
| unzip \ | |
| zlib1g-dev | |
| rm -rf /var/lib/apt/lists/* | |
| - name: Install Firebird client libraries | |
| run: | | |
| set -eu | |
| # Download and install Firebird 5.0 for client libraries | |
| # Pinned to specific commit SHA for supply-chain safety (issue #223). | |
| # Update by changing the SHA after reviewing the script at: | |
| # https://github.com/IBSurgeon/firebirdlinuxinstall/commit/<NEW_SHA> | |
| FB_SCRIPT_URL="https://raw.githubusercontent.com/IBSurgeon/firebirdlinuxinstall/4a0b76a957c9ba75da1307c8ee5f9ccfc6f823c9/fb_vanilla-50.sh" | |
| curl -fsSL "${FB_SCRIPT_URL}" -o /tmp/fb_install.sh | |
| chmod +x /tmp/fb_install.sh | |
| printf '\n' | /tmp/fb_install.sh | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 | |
| with: | |
| languages: cpp | |
| # Use security-extended for comprehensive security analysis | |
| queries: security-extended | |
| # Configure CodeQL to focus on our extension code | |
| config: | | |
| paths: | |
| - '*.c' | |
| - '*.cpp' | |
| - '*.h' | |
| paths-ignore: | |
| - 'tests/**' | |
| - 'docs/**' | |
| - 'build/**' | |
| - name: Build extension for CodeQL analysis | |
| env: | |
| FB_CONFIG: "no" | |
| run: | | |
| set -eu | |
| export PATH="/opt/firebird/bin:${PATH}" | |
| export LD_LIBRARY_PATH="/opt/firebird/lib:${LD_LIBRARY_PATH:-}" | |
| export CFLAGS="-I/opt/firebird/include ${CFLAGS:-}" | |
| export LDFLAGS="-L/opt/firebird/lib ${LDFLAGS:-}" | |
| phpize | |
| ./configure --with-firebird=/opt/firebird | |
| make -j"$(nproc)" | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 | |
| with: | |
| category: "/language:cpp" | |
| # NOTE: CodeQL does not support PHP as an analysis language. | |
| # PHP wrapper classes in src/Firebird/ are covered by PHPStan | |
| # (see code-quality.yml) instead. |