From c2f63de9a396b091006b0942fb8e486196d579b6 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Fri, 28 Aug 2026 05:27:19 -0700
Subject: [PATCH 01/13] fix:codeql scan
---
.github/codeql/codeql-full-config.yml | 3 +
.github/scripts/codeql-matrix.sh | 32 ++++++
.github/workflows/codeql-full.yml | 69 +++++++++++++
.github/workflows/codeql.yml | 136 ++++++++++----------------
4 files changed, 154 insertions(+), 86 deletions(-)
create mode 100644 .github/codeql/codeql-full-config.yml
create mode 100644 .github/scripts/codeql-matrix.sh
create mode 100644 .github/workflows/codeql-full.yml
diff --git a/.github/codeql/codeql-full-config.yml b/.github/codeql/codeql-full-config.yml
new file mode 100644
index 00000000..3c863a3a
--- /dev/null
+++ b/.github/codeql/codeql-full-config.yml
@@ -0,0 +1,3 @@
+# Full CodeQL scan config.
+paths-ignore:
+ - '**/target/'
diff --git a/.github/scripts/codeql-matrix.sh b/.github/scripts/codeql-matrix.sh
new file mode 100644
index 00000000..8ed26028
--- /dev/null
+++ b/.github/scripts/codeql-matrix.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+set -euo pipefail
+
+matrix_entries=""
+
+has_files() {
+ git ls-files "$@" | grep -q .
+}
+
+add_entry() {
+ local entry="$1"
+ if [ -n "$matrix_entries" ]; then
+ matrix_entries="$matrix_entries,$entry"
+ else
+ matrix_entries="$entry"
+ fi
+}
+
+if has_files '.github/workflows/*.yml' '.github/workflows/*.yaml'; then
+ add_entry '{"language":"actions","build-mode":"none"}'
+fi
+
+if has_files '*.java'; then
+ add_entry '{"language":"java-kotlin","build-mode":"autobuild"}'
+fi
+
+if has_files '*.js' '*.jsx' '*.ts' '*.tsx' '*.mjs' '*.cjs' '*.vue' '*.html'; then
+ add_entry '{"language":"javascript-typescript","build-mode":"none"}'
+fi
+
+printf '{"include":[%s]}\n' "$matrix_entries"
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
new file mode 100644
index 00000000..6bc7626d
--- /dev/null
+++ b/.github/workflows/codeql-full.yml
@@ -0,0 +1,69 @@
+name: CodeQL Full Scan
+
+on:
+ schedule:
+ - cron: '24 15 * * 1'
+ workflow_dispatch:
+
+permissions:
+ contents: read
+ security-events: write
+ packages: read
+ actions: read
+
+jobs:
+ detect:
+ name: Detect CodeQL languages
+ runs-on: ubuntu-latest
+ outputs:
+ matrix: ${{ steps.matrix.outputs.matrix }}
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+
+ - name: Build matrix
+ id: matrix
+ shell: bash
+ run: |
+ matrix=$(bash .github/scripts/codeql-matrix.sh)
+ printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
+
+ analyze:
+ needs: detect
+ name: Full scan (${{ matrix.language }})
+ runs-on: ubuntu-latest
+ strategy:
+ fail-fast: false
+ matrix: ${{ fromJSON(needs.detect.outputs.matrix) }}
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+
+ - name: Set up JDK 17
+ if: matrix.language == 'java-kotlin'
+ uses: actions/setup-java@v5
+ with:
+ java-version: '17'
+ distribution: 'temurin'
+ cache: maven
+
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@v4
+ with:
+ languages: ${{ matrix.language }}
+ build-mode: ${{ matrix.build-mode }}
+ config-file: ./.github/codeql/codeql-full-config.yml
+
+ - name: Build project
+ if: matrix.language == 'java-kotlin'
+ run: mvn -B clean test-compile -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true -Dspotbugs.skip=true -Dcpd.skip=true
+
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@v4
+ with:
+ category: "/codeql-full:${{ matrix.language }}"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1a5d4ced..dd413432 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,102 +1,66 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL Advanced"
+name: CodeQL Incremental
on:
push:
branches: [ "develop" ]
pull_request:
branches: [ "develop" ]
- schedule:
- - cron: '24 15 * * 1'
-jobs:
- analyze:
- name: Analyze (${{ matrix.language }})
- # Runner size impacts CodeQL analysis time. To learn more, please see:
- # - https://gh.io/recommended-hardware-resources-for-running-codeql
- # - https://gh.io/supported-runners-and-hardware-resources
- # - https://gh.io/using-larger-runners (GitHub.com only)
- # Consider using larger runners or machines with greater resources for possible analysis time improvements.
- runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
- permissions:
- # required for all workflows
- security-events: write
+permissions:
+ contents: read
+ security-events: write
+ packages: read
+ actions: read
- # required to fetch internal or private CodeQL packs
- packages: read
+jobs:
+ detect:
+ name: Detect CodeQL languages
+ runs-on: ubuntu-latest
+ outputs:
+ matrix: ${{ steps.matrix.outputs.matrix }}
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
- # only required for workflows in private repositories
- actions: read
- contents: read
+ - name: Build matrix
+ id: matrix
+ shell: bash
+ run: |
+ matrix=$(bash .github/scripts/codeql-matrix.sh)
+ printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
+ analyze:
+ needs: detect
+ name: Analyze (${{ matrix.language }})
+ runs-on: ubuntu-latest
strategy:
fail-fast: false
- matrix:
- include:
- - language: actions
- build-mode: none
- - language: java-kotlin
- build-mode: autobuild # This mode only analyzes Java. Set this to 'autobuild' or 'manual' to analyze Kotlin too.
- # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
- # Use `c-cpp` to analyze code written in C, C++ or both
- # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
- # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
- # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
- # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
- # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
- # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
- steps:
- - name: Checkout repository
- uses: actions/checkout@v4
+ matrix: ${{ fromJSON(needs.detect.outputs.matrix) }}
- # Add any setup steps before running the `github/codeql-action/init` action.
- # This includes steps like installing compilers or runtimes (`actions/setup-node`
- # or others). This is typically only required for manual builds.
- # - name: Setup runtime (example)
- # uses: actions/setup-example@v1
-
- # Initializes the CodeQL tools for scanning.
- - name: Initialize CodeQL
- uses: github/codeql-action/init@v4
- with:
- languages: ${{ matrix.language }}
- build-mode: ${{ matrix.build-mode }}
- config-file: ./.github/codeql/codeql-config.yml
- # If you wish to specify custom queries, you can do so here or in a config file.
- # By default, queries listed here will override any specified in a config file.
- # Prefix the list here with "+" to use these queries and those in the config file.
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
- # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
- # queries: security-extended,security-and-quality
+ - name: Set up JDK 17
+ if: matrix.language == 'java-kotlin'
+ uses: actions/setup-java@v5
+ with:
+ java-version: '17'
+ distribution: 'temurin'
+ cache: maven
- # If the analyze step fails for one of the languages you are analyzing with
- # "We were unable to automatically build your code", modify the matrix above
- # to set the build mode to "manual" for that language. Then modify this step
- # to build your code.
- # âšī¸ Command-line programs to run using the OS shell.
- # đ See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
- - name: Run manual build steps
- if: matrix.build-mode == 'manual'
- shell: bash
- run: |
- echo 'If you are using a "manual" build mode for one or more of the' \
- 'languages you are analyzing, replace this with the commands to build' \
- 'your code, for example:'
- echo ' make bootstrap'
- echo ' make release'
- exit 1
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@v4
+ with:
+ languages: ${{ matrix.language }}
+ build-mode: ${{ matrix.build-mode }}
+ config-file: ./.github/codeql/codeql-config.yml
- - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v4
- with:
- category: "/language:${{matrix.language}}"
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@v4
+ with:
+ category: "/codeql-incremental:${{ matrix.language }}"
From 2a05919698f44e715866196c77dd7b2c8bbb5d2e Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Fri, 28 Aug 2026 05:36:02 -0700
Subject: [PATCH 02/13] fix:codeql scan
---
.github/workflows/codeql-full.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index 6bc7626d..c4fb1a42 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -2,7 +2,7 @@ name: CodeQL Full Scan
on:
schedule:
- - cron: '24 15 * * 1'
+ - cron: '35 3 * * 6'
workflow_dispatch:
permissions:
From 17460573d00cab2b8454f1fdf3bb079c36335ed9 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Fri, 28 Aug 2026 05:41:07 -0700
Subject: [PATCH 03/13] fix:codeql scan
---
.github/workflows/codeql-full.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index c4fb1a42..09ce4487 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -2,7 +2,7 @@ name: CodeQL Full Scan
on:
schedule:
- - cron: '35 3 * * 6'
+ - cron: '42 12 * * 5'
workflow_dispatch:
permissions:
From 03e143fbeadc4eb4771f680ff0cfa4263c38b2a8 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Sun, 30 Aug 2026 23:41:54 -0700
Subject: [PATCH 04/13] fix:codeql scan
---
.github/workflows/codeql-full.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index 09ce4487..0e26c3da 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -2,7 +2,7 @@ name: CodeQL Full Scan
on:
schedule:
- - cron: '42 12 * * 5'
+ - cron: '42 6 * * 1'
workflow_dispatch:
permissions:
From b324c375dffc0358a29e0599b6dc93bdc95a77c6 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Sun, 30 Aug 2026 23:55:07 -0700
Subject: [PATCH 05/13] fix:codeql scan
---
.github/workflows/codeql-full.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index 0e26c3da..3c9e2931 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -2,7 +2,7 @@ name: CodeQL Full Scan
on:
schedule:
- - cron: '42 6 * * 1'
+ - cron: '3 7 * * 1'
workflow_dispatch:
permissions:
From ceb371746d92d08cc2ab67f25e1d9e05cdc70a64 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Mon, 31 Aug 2026 00:26:45 -0700
Subject: [PATCH 06/13] fix:codeql scan
---
.github/workflows/codeql-full.yml | 2 +-
.github/workflows/codeql.yml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index 3c9e2931..fc1e5c34 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -2,7 +2,7 @@ name: CodeQL Full Scan
on:
schedule:
- - cron: '3 7 * * 1'
+ - cron: '34 7 * * 1'
workflow_dispatch:
permissions:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index dd413432..50486ab2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -63,4 +63,4 @@ jobs:
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
with:
- category: "/codeql-incremental:${{ matrix.language }}"
+ category: "/language:${{ matrix.language }}"
From fe1a54c23f818be022eb25715a53abe389521400 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Mon, 31 Aug 2026 01:27:36 -0700
Subject: [PATCH 07/13] fix:codeql scan
---
.github/scripts/codeql-matrix.sh | 4 +++-
.github/workflows/codeql-full.yml | 16 +++++++++++++++-
.github/workflows/codeql.yml | 2 +-
3 files changed, 19 insertions(+), 3 deletions(-)
diff --git a/.github/scripts/codeql-matrix.sh b/.github/scripts/codeql-matrix.sh
index 8ed26028..cfbe3b8a 100644
--- a/.github/scripts/codeql-matrix.sh
+++ b/.github/scripts/codeql-matrix.sh
@@ -2,6 +2,8 @@
set -euo pipefail
+java_build_mode="${1:-autobuild}"
+
matrix_entries=""
has_files() {
@@ -22,7 +24,7 @@ if has_files '.github/workflows/*.yml' '.github/workflows/*.yaml'; then
fi
if has_files '*.java'; then
- add_entry '{"language":"java-kotlin","build-mode":"autobuild"}'
+ add_entry "{\"language\":\"java-kotlin\",\"build-mode\":\"$java_build_mode\"}"
fi
if has_files '*.js' '*.jsx' '*.ts' '*.tsx' '*.mjs' '*.cjs' '*.vue' '*.html'; then
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index fc1e5c34..cee04a6d 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -27,7 +27,7 @@ jobs:
id: matrix
shell: bash
run: |
- matrix=$(bash .github/scripts/codeql-matrix.sh)
+ matrix=$(bash .github/scripts/codeql-matrix.sh manual)
printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
analyze:
@@ -66,4 +66,18 @@ jobs:
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
with:
+ output: ${{ runner.temp }}/codeql-results
+ post-processed-sarif-path: ${{ runner.temp }}/codeql-results-processed
+ upload: always
category: "/codeql-full:${{ matrix.language }}"
+
+ - name: Upload CodeQL SARIF report
+ if: always()
+ uses: actions/upload-artifact@v4
+ with:
+ name: codeql-full-sarif-${{ matrix.language }}
+ path: |
+ ${{ runner.temp }}/codeql-results
+ ${{ runner.temp }}/codeql-results-processed
+ if-no-files-found: warn
+ retention-days: 30
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 50486ab2..d022f03d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,7 +28,7 @@ jobs:
id: matrix
shell: bash
run: |
- matrix=$(bash .github/scripts/codeql-matrix.sh)
+ matrix=$(bash .github/scripts/codeql-matrix.sh autobuild)
printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
analyze:
From 82fdc15b91916a8f900bf7faa3da9a8ee3ef2569 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Mon, 31 Aug 2026 02:26:55 -0700
Subject: [PATCH 08/13] fix:codeql scan
---
.github/workflows/codeql-full.yml | 47 +++++++++++++++++++++++++++----
1 file changed, 42 insertions(+), 5 deletions(-)
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index cee04a6d..eda9267c 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -64,6 +64,7 @@ jobs:
run: mvn -B clean test-compile -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true -Dspotbugs.skip=true -Dcpd.skip=true
- name: Perform CodeQL Analysis
+ id: codeql-analysis
uses: github/codeql-action/analyze@v4
with:
output: ${{ runner.temp }}/codeql-results
@@ -71,13 +72,49 @@ jobs:
upload: always
category: "/codeql-full:${{ matrix.language }}"
+ - name: Collect CodeQL SARIF reports
+ if: always()
+ shell: bash
+ env:
+ CODEQL_OUTPUT: ${{ runner.temp }}/codeql-results
+ CODEQL_PROCESSED_OUTPUT: ${{ runner.temp }}/codeql-results-processed
+ CODEQL_SARIF_OUTPUT: ${{ steps.codeql-analysis.outputs.sarif-output }}
+ run: |
+ rm -rf codeql-sarif
+ mkdir -p codeql-sarif
+
+ {
+ printf 'language=%s\n' '${{ matrix.language }}'
+ printf 'codeql_output=%s\n' "$CODEQL_OUTPUT"
+ printf 'post_processed_output=%s\n' "$CODEQL_PROCESSED_OUTPUT"
+ printf 'action_sarif_output=%s\n' "$CODEQL_SARIF_OUTPUT"
+ printf '\nGenerated SARIF files:\n'
+ } > codeql-sarif/scan-files.txt
+
+ for directory in "$CODEQL_OUTPUT" "$CODEQL_PROCESSED_OUTPUT" "$CODEQL_SARIF_OUTPUT"; do
+ if [[ -n "$directory" && -d "$directory" ]]; then
+ find "$directory" -type f -name '*.sarif' -print0 |
+ while IFS= read -r -d '' file; do
+ cp "$file" "codeql-sarif/$(basename "$file")"
+ printf '%s\n' "$file" >> codeql-sarif/scan-files.txt
+ done
+ fi
+ done
+
+ find "$RUNNER_TEMP" -type f -name '*.sarif' -print0 |
+ while IFS= read -r -d '' file; do
+ target="codeql-sarif/$(basename "$file")"
+ if [[ ! -e "$target" ]]; then
+ cp "$file" "$target"
+ printf '%s\n' "$file" >> codeql-sarif/scan-files.txt
+ fi
+ done
+
- name: Upload CodeQL SARIF report
if: always()
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7
with:
name: codeql-full-sarif-${{ matrix.language }}
- path: |
- ${{ runner.temp }}/codeql-results
- ${{ runner.temp }}/codeql-results-processed
- if-no-files-found: warn
+ path: codeql-sarif
+ if-no-files-found: error
retention-days: 30
From a09a635796cef40888e6b4b32110b8e025ae5c47 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Mon, 31 Aug 2026 19:08:28 -0700
Subject: [PATCH 09/13] fix:codeql scan
---
.github/workflows/codeql-full.yml | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index eda9267c..9b2f9210 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -15,11 +15,13 @@ jobs:
detect:
name: Detect CodeQL languages
runs-on: ubuntu-latest
+ env:
+ FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
outputs:
matrix: ${{ steps.matrix.outputs.matrix }}
steps:
- name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
fetch-depth: 0
From b1087fcffe041508aa745893a7c189d9cbcdc8b6 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Mon, 31 Aug 2026 19:21:42 -0700
Subject: [PATCH 10/13] fix:codeql scan
---
.github/workflows/codeql-full.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index 9b2f9210..f5d77d4a 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -42,7 +42,7 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
fetch-depth: 0
From c919e360c1da827578459949d864e0752a50deec Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Mon, 31 Aug 2026 20:29:45 -0700
Subject: [PATCH 11/13] fix:codeql scan
---
.github/workflows/codeql-full.yml | 97 ++++++++++++++++++++++---------
1 file changed, 68 insertions(+), 29 deletions(-)
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index f5d77d4a..db8b6a77 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -65,52 +65,62 @@ jobs:
if: matrix.language == 'java-kotlin'
run: mvn -B clean test-compile -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true -Dspotbugs.skip=true -Dcpd.skip=true
+ - name: Prepare CodeQL SARIF directory
+ shell: bash
+ run: |
+ rm -rf codeql-sarif
+ mkdir -p codeql-sarif
+
- name: Perform CodeQL Analysis
id: codeql-analysis
uses: github/codeql-action/analyze@v4
with:
- output: ${{ runner.temp }}/codeql-results
- post-processed-sarif-path: ${{ runner.temp }}/codeql-results-processed
+ output: ${{ github.workspace }}/codeql-sarif
upload: always
category: "/codeql-full:${{ matrix.language }}"
- - name: Collect CodeQL SARIF reports
+ - name: Summarize CodeQL SARIF report
+ id: sarif-summary
if: always()
shell: bash
- env:
- CODEQL_OUTPUT: ${{ runner.temp }}/codeql-results
- CODEQL_PROCESSED_OUTPUT: ${{ runner.temp }}/codeql-results-processed
- CODEQL_SARIF_OUTPUT: ${{ steps.codeql-analysis.outputs.sarif-output }}
run: |
- rm -rf codeql-sarif
+ set -euo pipefail
+
mkdir -p codeql-sarif
+ report_index="codeql-sarif/scan-files.txt"
+ sarif_count=0
+ invalid_sarif=0
+ violations=0
{
printf 'language=%s\n' '${{ matrix.language }}'
- printf 'codeql_output=%s\n' "$CODEQL_OUTPUT"
- printf 'post_processed_output=%s\n' "$CODEQL_PROCESSED_OUTPUT"
- printf 'action_sarif_output=%s\n' "$CODEQL_SARIF_OUTPUT"
+ printf 'codeql_output=%s\n' '${{ github.workspace }}/codeql-sarif'
printf '\nGenerated SARIF files:\n'
- } > codeql-sarif/scan-files.txt
-
- for directory in "$CODEQL_OUTPUT" "$CODEQL_PROCESSED_OUTPUT" "$CODEQL_SARIF_OUTPUT"; do
- if [[ -n "$directory" && -d "$directory" ]]; then
- find "$directory" -type f -name '*.sarif' -print0 |
- while IFS= read -r -d '' file; do
- cp "$file" "codeql-sarif/$(basename "$file")"
- printf '%s\n' "$file" >> codeql-sarif/scan-files.txt
- done
+ } > "$report_index"
+
+ while IFS= read -r -d '' file; do
+ sarif_count=$((sarif_count + 1))
+ result_count=$(jq '[.runs[]?.results[]?] | length' "$file" 2>/dev/null || true)
+
+ if [[ "$result_count" =~ ^[0-9]+$ ]]; then
+ violations=$((violations + result_count))
+ printf '%s results=%s\n' "$file" "$result_count" >> "$report_index"
+ else
+ invalid_sarif=$((invalid_sarif + 1))
+ printf '%s results=invalid-sarif\n' "$file" >> "$report_index"
fi
- done
+ done < <(find codeql-sarif -type f -name '*.sarif' -print0)
- find "$RUNNER_TEMP" -type f -name '*.sarif' -print0 |
- while IFS= read -r -d '' file; do
- target="codeql-sarif/$(basename "$file")"
- if [[ ! -e "$target" ]]; then
- cp "$file" "$target"
- printf '%s\n' "$file" >> codeql-sarif/scan-files.txt
- fi
- done
+ {
+ printf '\nSummary:\n'
+ printf 'sarif_count=%s\n' "$sarif_count"
+ printf 'invalid_sarif=%s\n' "$invalid_sarif"
+ printf 'violations=%s\n' "$violations"
+ } >> "$report_index"
+
+ printf 'sarif_count=%s\n' "$sarif_count" >> "$GITHUB_OUTPUT"
+ printf 'invalid_sarif=%s\n' "$invalid_sarif" >> "$GITHUB_OUTPUT"
+ printf 'violations=%s\n' "$violations" >> "$GITHUB_OUTPUT"
- name: Upload CodeQL SARIF report
if: always()
@@ -120,3 +130,32 @@ jobs:
path: codeql-sarif
if-no-files-found: error
retention-days: 30
+
+ - name: Check CodeQL findings
+ if: always()
+ shell: bash
+ env:
+ SARIF_COUNT: ${{ steps.sarif-summary.outputs.sarif_count }}
+ INVALID_SARIF: ${{ steps.sarif-summary.outputs.invalid_sarif }}
+ VIOLATIONS: ${{ steps.sarif-summary.outputs.violations }}
+ run: |
+ sarif_count="${SARIF_COUNT:-0}"
+ invalid_sarif="${INVALID_SARIF:-0}"
+ violations="${VIOLATIONS:-0}"
+
+ if [[ "$sarif_count" -eq 0 ]]; then
+ echo "::error::CodeQL did not produce a SARIF report."
+ exit 1
+ fi
+
+ if [[ "$invalid_sarif" -ne 0 ]]; then
+ echo "::error::CodeQL produced $invalid_sarif invalid SARIF report(s)."
+ exit 1
+ fi
+
+ if [[ "$violations" -ne 0 ]]; then
+ echo "::error::CodeQL found $violations result(s)."
+ exit 1
+ fi
+
+ echo "CodeQL found no results."
From 93ed667b07ccc187e55883cf9c176929985511cf Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Tue, 1 Sep 2026 02:24:06 -0700
Subject: [PATCH 12/13] fix:codeql scan
---
.github/workflows/codeql-full.yml | 65 +++++++++++++++++++++++++++++++
1 file changed, 65 insertions(+)
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index db8b6a77..8b55b4d5 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -122,6 +122,62 @@ jobs:
printf 'invalid_sarif=%s\n' "$invalid_sarif" >> "$GITHUB_OUTPUT"
printf 'violations=%s\n' "$violations" >> "$GITHUB_OUTPUT"
+ - name: Install SARIF tools
+ if: ${{ always() && hashFiles('codeql-sarif/**/*.sarif') != '' }}
+ run: python -m pip install sarif-tools
+
+ - name: Generate CodeQL HTML report
+ id: html-report
+ if: ${{ always() && hashFiles('codeql-sarif/**/*.sarif') != '' }}
+ shell: bash
+ run: |
+ set -euo pipefail
+
+ html_dir="codeql-html-report"
+ rm -rf "$html_dir"
+ mkdir -p "$html_dir"
+
+ html_count=0
+ while IFS= read -r -d '' sarif_file; do
+ relative_path="${sarif_file#codeql-sarif/}"
+ html_file="$html_dir/${relative_path%.sarif}.html"
+ mkdir -p "$(dirname "$html_file")"
+
+ sarif html "$sarif_file" --output "$html_file"
+ html_count=$((html_count + 1))
+ printf '%s -> %s\n' "$sarif_file" "$html_file"
+ done < <(find codeql-sarif -type f -name '*.sarif' -print0)
+
+ index_file="$html_dir/index.html"
+ {
+ printf '\n'
+ printf '\n'
+ printf 'CodeQL HTML Reports\n'
+ printf '\n'
+ printf 'CodeQL HTML Reports - %s
\n' '${{ matrix.language }}'
+ printf '\n'
+ while IFS= read -r -d '' html_file; do
+ link="${html_file#$html_dir/}"
+ printf '- %s
\n' "$link" "$link"
+ done < <(find "$html_dir" -type f -name '*.html' ! -name 'index.html' -print0 | sort -z)
+ printf '
\n'
+ printf '\n'
+ printf '\n'
+ } > "$index_file"
+
+ if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+ {
+ printf '## CodeQL HTML report\n\n'
+ printf '| Metric | Result |\n'
+ printf '|------|------|\n'
+ printf '| Language | %s |\n' '${{ matrix.language }}'
+ printf '| HTML files | %s |\n' "$html_count"
+ printf '| Artifact | codeql-full-html-%s |\n' '${{ matrix.language }}'
+ } >> "$GITHUB_STEP_SUMMARY"
+ fi
+
+ printf 'html_count=%s\n' "$html_count" >> "$GITHUB_OUTPUT"
+
- name: Upload CodeQL SARIF report
if: always()
uses: actions/upload-artifact@v7
@@ -131,6 +187,15 @@ jobs:
if-no-files-found: error
retention-days: 30
+ - name: Upload CodeQL HTML report
+ if: ${{ always() && hashFiles('codeql-html-report/**/*.html') != '' }}
+ uses: actions/upload-artifact@v7
+ with:
+ name: codeql-full-html-${{ matrix.language }}
+ path: codeql-html-report
+ if-no-files-found: error
+ retention-days: 30
+
- name: Check CodeQL findings
if: always()
shell: bash
From 5673da39d193b94ac551b1ff33038630ccae295d Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Tue, 1 Sep 2026 04:47:37 -0700
Subject: [PATCH 13/13] fix:codeql scan
---
.github/workflows/codeql-full.yml | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index 8b55b4d5..5b80ac28 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -139,16 +139,12 @@ jobs:
html_count=0
while IFS= read -r -d '' sarif_file; do
- relative_path="${sarif_file#codeql-sarif/}"
- html_file="$html_dir/${relative_path%.sarif}.html"
- mkdir -p "$(dirname "$html_file")"
-
- sarif html "$sarif_file" --output "$html_file"
+ sarif html "$sarif_file" --output "$html_dir"
html_count=$((html_count + 1))
- printf '%s -> %s\n' "$sarif_file" "$html_file"
+ printf '%s -> %s/\n' "$sarif_file" "$html_dir"
done < <(find codeql-sarif -type f -name '*.sarif' -print0)
- index_file="$html_dir/index.html"
+ index_file="$html_dir/reports.html"
{
printf '\n'
printf '\n'
@@ -159,7 +155,7 @@ jobs:
while IFS= read -r -d '' html_file; do
link="${html_file#$html_dir/}"
printf '%s\n' "$link" "$link"
- done < <(find "$html_dir" -type f -name '*.html' ! -name 'index.html' -print0 | sort -z)
+ done < <(find "$html_dir" -maxdepth 1 -type f -name '*.html' ! -name 'reports.html' -print0 | sort -z)
printf '\n'
printf '\n'
printf '