gha: add CodeQL Analysis workflow by thaJeztah · Pull Request #47034 · moby/moby

thaJeztah · 2024-01-07T11:52:35Z

copied from https://github.com/docker/cli/blob/88e6474350e644495a8009e9e1437332aa828a17/.github/workflows/codeql.yml

- What I did

- How I did it

- How to verify it

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

github-advanced-security · 2024-01-07T12:01:13Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

thaJeztah · 2024-01-07T12:01:37Z

Ah, this probably requires some additional trickery to make it work;

2024/01/07 12:00:22 Warning: encountered errors extracting package `github.com/moby/moby/api/server/backend/build`:
2024/01/07 12:00:22   -: code in directory /home/runner/work/moby/moby/root/src/github.com/moby/moby/api/server/backend/build expects import "github.com/docker/docker/api/server/backend/build"
Error: 2024/01/07 12:00:22   /home/runner/work/moby/moby/root/src/github.com/moby/moby/api/server/backend/build/backend.go:48:27: cannot use s (variable of type *"github.com/moby/moby/vendor/google.golang.org/grpc".Server) as *"github.com/docker/docker/vendor/google.golang.org/grpc".Server value in argument to b.buildkit.RegisterGRPC

crazy-max · 2024-01-07T16:23:07Z

+    - cron: '0 9 * * 4'
+
+jobs:
+  codeql:


I think we should have a matrix to analyze both dockerd and docker-proxy. Mainly because "Autobuild" will not build any of them so would need to set https://github.com/github/codeql-action/blob/8516954d603e47049b34f3da4dfac83009fcd450/autobuild/action.yml#L9 to ./cmd/dockerd and ./cmd/docker-proxy using a matrix. Can be done in follow-up.

Edit: Actually it will run make so should be fine: https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#autobuild-for-go

thaJeztah · 2024-09-17T20:16:38Z

@crazy-max I added the symlink go.mod -> vendor.mod trick that I had in docker/cli, and I THINK it's working correctly now; PTAL; https://github.com/moby/moby/actions/runs/10910306702/job/30280453719?pr=47034

thaJeztah · 2024-09-17T20:17:27Z

LOL.. well, almost;

Error: /workflows/codeql.yml:14:14: [error] trailing spaces (trailing-spaces)
Error: /workflows/codeql.yml:15:17: [error] trailing spaces (trailing-spaces)
Error: /workflows/codeql.yml:16:24: [error] trailing spaces (trailing-spaces)
Error: /workflows/codeql.yml:17:10: [error] trailing spaces (trailing-spaces)
Error: /workflows/codeql.yml:18:13: [error] trailing spaces (trailing-spaces)
Error: /workflows/codeql.yml:21:16: [error] too many spaces inside brackets (brackets)
Error: /workflows/codeql.yml:21:25: [error] too many spaces inside brackets (brackets)
Error: /workflows/codeql.yml:42:1: [error] trailing spaces (trailing-spaces)
make: *** [Makefile:256: validate-yamllint] Error 1
Error: Process completed with exit code 2.

thaJeztah · 2024-09-19T08:34:03Z

OK, I think it worked; at least it indicates it scanned;

CodeQL scanned 1118 out of 2032 Go files in this invocation. Check the status page for overall coverage information: https://github.com/moby/moby/security/code-scanning/tools/CodeQL/status/
Analysis produced the following diagnostic information:
Go files were found but not processed (1 result)
    * [Specify a custom build command](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages) that includes one or more `go build` commands to build the `.go` files to be analyzed.

The "files were found but not processed" are very likely the same reason as we have this on docker/cli; CodeQL ignores _test.go files, and as such will skip ~50% of files we have;

crazy-max

Overall LGTM, see https://github.com/docker/buildx/blob/master/.github/workflows/codeql.yml about my review

crazy-max · 2024-09-19T08:36:28Z

+      - name: Update Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.22.7


Maybe put go version as global env similar to other workflows

moby/.github/workflows/buildkit.yml

Line 25 in d8b7ae7

GO_VERSION: "1.22.7"

?

Yeah, we should consider doing so; I'll look at that in a follow-up!

crazy-max · 2024-09-19T08:37:05Z

+jobs:
+  codeql:
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 360


Not needed for this repo

Ah, yes; for public repos we wouldn't be charged; mostly considering that;

I've seen some runaway actions running for hours

We may at times have a private fork to work on security releases; those are charged

I can make this a lot shorter though!

put it to 10 minutes, which (based on the above) should be enough currently (we can update if that turns out to be too short)

crazy-max · 2024-09-19T08:38:25Z

+    permissions:
+      actions: read
+      contents: read
+      security-events: write


This can just be put as global perms

As discussed on slack; my thinking here was that we set a default at the top (contents: read), and to override only in places where it’s needed.

Slightly on the defensive side in cased (e.g.) someone decides “let’s merge these two workflows in a single YAML, and now not copying the permissions. Or vice-versa; “let’s add some other jobs to this file” which now would have more permissions than needed.

Sure fine by me!

Signed-off-by: Sebastiaan van Stijn <[email protected]>

crazy-max

LGTM

thaJeztah added status/2-code-review area/testing labels Jan 7, 2024

thaJeztah self-assigned this Jan 7, 2024

thaJeztah requested a review from crazy-max January 7, 2024 11:52

thaJeztah commented Jan 7, 2024

View reviewed changes

Comment thread .github/workflows/codeql.yml Outdated

thaJeztah force-pushed the add_codeql branch from 3fd7df5 to fd70fa2 Compare January 7, 2024 11:56

crazy-max reviewed Jan 7, 2024

View reviewed changes

thaJeztah force-pushed the add_codeql branch from fd70fa2 to 0b9a464 Compare September 17, 2024 20:08

thaJeztah force-pushed the add_codeql branch from 0b9a464 to 448ca57 Compare September 17, 2024 20:21

thaJeztah requested a review from crazy-max September 17, 2024 20:21

thaJeztah added this to the 28.0.0 milestone Sep 17, 2024

thaJeztah force-pushed the add_codeql branch from 448ca57 to e779760 Compare September 18, 2024 19:34

crazy-max reviewed Sep 19, 2024

View reviewed changes

Comment thread .github/workflows/codeql.yml Outdated

thaJeztah commented Sep 19, 2024

View reviewed changes

Comment thread .github/workflows/codeql.yml Outdated

gha: add CodeQL Analysis workflow

450200b

Signed-off-by: Sebastiaan van Stijn <[email protected]>

thaJeztah force-pushed the add_codeql branch from e779760 to 450200b Compare September 19, 2024 09:02

crazy-max approved these changes Sep 19, 2024

View reviewed changes

thaJeztah mentioned this pull request Sep 19, 2024

gha: codeql: minor touch-ups and fixes docker/cli#5454

Merged

thaJeztah merged commit dfbc3a8 into moby:master Sep 19, 2024

thaJeztah deleted the add_codeql branch September 19, 2024 11:04

thaJeztah added process/cherry-pick/23.0 process/cherry-pick/25.0 process/cherry-pick/26.1 labels Oct 3, 2024

thaJeztah mentioned this pull request Oct 3, 2024

[27.x backport] gha: add CodeQL Analysis workflow #48574

Merged

thaJeztah added process/cherry-picked and removed process/cherry-pick/27.x labels Oct 3, 2024

thaJeztah removed the process/cherry-pick/26.1 label Sep 9, 2025

Conversation

thaJeztah commented Jan 7, 2024

Uh oh!

Uh oh!

github-advanced-security AI commented Jan 7, 2024

Uh oh!

thaJeztah commented Jan 7, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented Sep 17, 2024

Uh oh!

thaJeztah commented Sep 17, 2024

Uh oh!

thaJeztah commented Sep 19, 2024

Uh oh!

crazy-max left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thaJeztah Sep 19, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

crazy-max left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

thaJeztah Sep 19, 2024 •

edited

Loading