Skip to content

Commit ec97899

Browse files
sebthomsebthom
authored
ci: update CodeQL workflow (#956)
1 parent 25c41e2 commit ec97899

4 files changed

Lines changed: 141 additions & 15 deletions

File tree

‎.github/codeql/codeql-config.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#using-a-custom-configuration-file
2+
name: "CodeQL config"
3+
queries:
4+
- uses: security-and-quality
5+
- uses: ./.github/codeql/queries/java # load our custom CodeQL rules
6+
7+
query-filters:
8+
- exclude:
9+
# Exclude the built-in shadowing rule.
10+
# We intentionally use final locals that copy instance fields
11+
# (e.g. `final var name = this.name`) to support Eclipse null analysis
12+
# without introducing noisy renaming. This pattern is deliberate and safe,
13+
# so the built-in rule is disabled in favor of our custom rule
14+
# (local-shadows-instance-field.ql).
15+
id: java/local-shadows-field

‎.github/codeql/queries/java/local-shadows-instance-field.ql‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
/**
2+
* @name Local variable shadows instance field (except final this-copy)
3+
* @description Flags local variables that shadow an instance field, unless they are final
4+
* and initialized directly from that same field (for example `final var name = this.name;`).
5+
* @id custom-java/local-shadows-instance-field-strict
6+
* @kind problem
7+
* @problem.severity warning
8+
* @precision medium
9+
* @tags correctness readability maintainability
10+
*/
11+
import java
12+
import semmle.code.java.Member
13+
import semmle.code.java.Variable
14+
15+
/**
16+
* True if this local variable is an allowed shadowing of the given instance field:
17+
*
18+
* final var name = this.name;
19+
* final var name = name; // implicit this
20+
*/
21+
predicate allowedShadowing(LocalVariableDecl local, Field field) {
22+
local.isFinal() and
23+
exists(FieldAccess fa |
24+
fa = local.getInitializer().getUnderlyingExpr().(FieldAccess) and
25+
fa.getField() = field and
26+
fa.isOwnFieldAccess()
27+
)
28+
}
29+
30+
from LocalVariableDecl local, Field field, Callable c
31+
where
32+
// same simple name
33+
local.getName() = field.getName() and
34+
35+
// only consider instance fields
36+
not field.isStatic() and
37+
38+
// local is inside a callable of a class related to the field's declaring type
39+
c = local.getCallable() and
40+
c.getDeclaringType().getASupertype*() = field.getDeclaringType() and
41+
42+
// shadowing is NOT in the allowed final-this-copy form
43+
not allowedShadowing(local, field)
44+
select local,
45+
"Local variable '" + local.getName() + "' shadows instance field '" +
46+
field.getQualifiedName() +
47+
"'. Shadowing is only allowed for 'final' locals directly initialized from this field."

‎.github/workflows/build.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ on: # https://docs.github.com/en/actions/reference/workflows-and-actions/events
1010
paths-ignore:
1111
- '**/*.md'
1212
- '.github/*.yml'
13+
- '.github/workflows/bump-version.yml'
1314
- '.github/workflows/codeql.yml'
1415
- '.github/workflows/licensecheck.yml'
1516
- '.github/workflows/validate_pr.yml'
@@ -23,6 +24,7 @@ on: # https://docs.github.com/en/actions/reference/workflows-and-actions/events
2324
- '**/*.md'
2425
- '.github/*.yml'
2526
- '.github/workflows/bump-version.yml'
27+
- '.github/workflows/codeql.yml'
2628
- '.github/workflows/licensecheck.yml'
2729
- '.github/workflows/validate_pr.yml'
2830
- '**/.project'

‎.github/workflows/codeql.yml‎

Lines changed: 77 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,13 @@
22
name: CodeQL
33

44
on: # https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
5+
schedule:
6+
# https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#schedule
7+
- cron: "30 18 * * 1" # Mondays 18:30 UTC
58
push:
69
branches: [ "main" ]
710
paths-ignore:
811
- '**/*.md'
9-
- '.github/*.yml'
10-
- '.github/workflows/build.yml'
11-
- '.github/workflows/bump-version.yml'
12-
- '.github/workflows/licensecheck.yml'
13-
- '.github/workflows/validate_pr.yml'
1412
- '**/.project'
1513
- '**/.settings/*.prefs'
1614
- '.gitignore'
@@ -20,11 +18,6 @@ on: # https://docs.github.com/en/actions/reference/workflows-and-actions/events
2018
branches: [ "main" ]
2119
paths-ignore:
2220
- '**/*.md'
23-
- '.github/*.yml'
24-
- '.github/workflows/build.yml'
25-
- '.github/workflows/bump-version.yml'
26-
- '.github/workflows/licensecheck.yml'
27-
- '.github/workflows/validate_pr.yml'
2821
- '**/.project'
2922
- '**/.settings/*.prefs'
3023
- '.gitignore'
@@ -34,20 +27,35 @@ on: # https://docs.github.com/en/actions/reference/workflows-and-actions/events
3427
# https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#workflow_dispatch
3528

3629

30+
defaults:
31+
run:
32+
shell: bash
33+
34+
35+
env:
36+
JAVA_VERSION: 21
37+
38+
3739
jobs:
3840

3941
###########################################################
4042
analyze:
4143
###########################################################
4244

45+
concurrency:
46+
group: codeql-${{ github.workflow }}-${{ github.ref }}-${{ matrix.language }}
47+
cancel-in-progress: true
48+
4349
strategy:
4450
fail-fast: false
4551
matrix:
4652
include:
4753
# build-mode: https://github.com/github/codeql-action#build-modes
48-
- language: java-kotlin
54+
- language: actions
4955
build-mode: none
50-
- language: javascript-typescript
56+
- language: java
57+
build-mode: manual
58+
- language: javascript
5159
build-mode: none
5260
- language: python
5361
build-mode: none
@@ -82,15 +90,47 @@ jobs:
8290
uses: actions/checkout@v5 # https://github.com/actions/checkout
8391

8492

85-
# CodeQL executes https://github.com/ferstl/depgraph-maven-plugin
93+
- name: "Install: JDK 21 for Compilation ☕"
94+
uses: actions/setup-java@v5 # https://github.com/actions/setup-java
95+
if: matrix.language == 'java'
96+
with:
97+
distribution: temurin
98+
java-version: 21
99+
100+
86101
- name: "Install: JDK 25 for Maven/Tycho ☕"
87102
uses: actions/setup-java@v5 # https://github.com/actions/setup-java
88-
if: ${{ matrix.language }} == 'java'
103+
if: matrix.language == 'java'
89104
with:
90105
distribution: temurin
91106
java-version: 25
92107

93108

109+
- name: "Cache: Local Maven Repository"
110+
uses: actions/cache/restore@v4
111+
if: matrix.language == 'java'
112+
with:
113+
# Excluded sub directory not working https://github.com/actions/toolkit/issues/713
114+
path: |
115+
~/.m2/repository/*
116+
!~/.m2/repository/.cache/tycho
117+
!~/.m2/repository/.meta/p2-artifacts.properties
118+
!~/.m2/repository/p2
119+
!~/.m2/repository/*SNAPSHOT*
120+
key: ${{ runner.os }}-${{ runner.arch }}-repo-mvn-${{ hashFiles('**/pom.xml') }}
121+
122+
123+
- name: "Cache: Local Tycho Repository"
124+
uses: actions/cache/restore@v4
125+
if: matrix.language == 'java'
126+
with:
127+
path: |
128+
~/.m2/repository/.cache/tycho
129+
~/.m2/repository/.meta/p2-artifacts.properties
130+
~/.m2/repository/p2
131+
key: ${{ runner.os }}-${{ runner.arch }}-repo-tycho-${{ hashFiles('target-platforms/target-platform-latest/target-platform-latest.target') }}
132+
133+
94134
# https://docs.github.com/en/code-security/code-scanning
95135
- name: Initialize CodeQL
96136
uses: github/codeql-action/init@v4 # https://github.com/github/codeql-action
@@ -99,7 +139,29 @@ jobs:
99139
# https://github.com/github/codeql-action#build-modes
100140
build-mode: ${{ matrix.build-mode }}
101141
# https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#using-queries-in-ql-packs
102-
queries: +security-and-quality
142+
config-file: ./.github/codeql/codeql-config.yml
143+
144+
145+
- name: "Build with Maven 🔨"
146+
if: matrix.language == 'java'
147+
run: |
148+
set -euo pipefail
149+
150+
MAVEN_OPTS="${MAVEN_OPTS:-}"
151+
MAVEN_OPTS+=" -Djava.security.egd=file:/dev/./urandom" # https://stackoverflow.com/questions/58991966/what-java-security-egd-option-is-for/59097932#59097932
152+
MAVEN_OPTS+=" -Dorg.slf4j.simpleLogger.showDateTime=true -Dorg.slf4j.simpleLogger.dateTimeFormat=HH:mm:ss,SSS" # https://stackoverflow.com/questions/5120470/how-to-time-the-different-stages-of-maven-execution/49494561#49494561
153+
MAVEN_OPTS+=" -Xmx1024m -Djava.awt.headless=true -Djava.net.preferIPv4Stack=true -Dhttps.protocols=TLSv1.3,TLSv1.2"
154+
export MAVEN_OPTS
155+
echo "MAVEN_OPTS: $MAVEN_OPTS"
156+
157+
./mvnw \
158+
--errors \
159+
--no-transfer-progress \
160+
--batch-mode \
161+
--show-version \
162+
-Declipse.p2.mirrors=false \
163+
-Dmaven.test.skip=true \
164+
clean verify
103165

104166

105167
- name: Perform CodeQL Analysis

0 commit comments

Comments
 (0)