Merge branch 'ershi/codeql' into 'main'

Add a CodeQL workflow, minor revisions to existing GH workflows See merge request omniverse/warp!518
NVIDIA · May 26, 2024 · 37285d7 · 37285d7
2 parents e97ceea + ba35562
commit 37285d7
Show file tree

Hide file tree

Showing 5 changed files with 77 additions and 37 deletions.
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
@@ -10,6 +10,14 @@ name: Build and Test Warp
 on:
   workflow_call:
   workflow_dispatch:
+  push:
+    tags:
+      - v*
+    branches:
+      - main
+      - release-*
+  schedule: # Schedule workflow only runs on the default branch
+    - cron: "45 9 * * *"
 
 env:
   PYTHON_VERSION: 3.11
@@ -29,7 +37,7 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install --upgrade numpy
+          pip install --no-cache-dir --upgrade numpy
           tools/packman/packman install -l _build/target-deps/cuda cuda 11.8.0_522.06-abe3d9d7-windows-x86_64
           tools/packman/packman install -l _build/host-deps/msvc msvc 2019-16.11.24
           tools/packman/packman install -l _build/host-deps/winsdk winsdk 10.17763
@@ -56,7 +64,7 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install --upgrade numpy
+          pip install --no-cache-dir --upgrade numpy
       - name: Build Warp
         run: |
           tools/packman/packman install -l _build/target-deps/cuda cuda 11.8.0_520.61-d8963068-linux-x86_64
@@ -81,7 +89,7 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install --upgrade numpy
+          pip install --no-cache-dir --upgrade numpy
       - name: Build
         run: |
           python build_lib.py
@@ -113,8 +121,8 @@ jobs:
       - name: Install Dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install --upgrade numpy coverage[toml] usd-core
-          pip install .
+          pip install --no-cache-dir --upgrade numpy coverage[toml] usd-core
+          pip install --no-cache-dir .
       - name: Run Tests
         run: python -m warp.tests --junit-report-xml rspec.xml --coverage --coverage-xml coverage.xml -s autodetect
       - name: Test Summary
@@ -153,8 +161,8 @@ jobs:
       - name: Install Dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install --upgrade numpy coverage[toml] usd-core
-          pip install .
+          pip install --no-cache-dir --upgrade numpy coverage[toml] usd-core
+          pip install --no-cache-dir .
       - name: Run Tests
         run: python -m warp.tests --junit-report-xml rspec.xml --coverage --coverage-xml coverage.xml -s autodetect
       - name: Test Summary
@@ -193,8 +201,8 @@ jobs:
       - name: Install Dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install --upgrade numpy coverage[toml] usd-core
-          pip install .
+          pip install --no-cache-dir --upgrade numpy coverage[toml] usd-core
+          pip install --no-cache-dir .
       - name: Run Tests
         run: python -m warp.tests --junit-report-xml rspec.xml --coverage --coverage-xml coverage.xml -s autodetect
       - name: Test Summary

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -0,0 +1,50 @@
+# Copyright (c) 2024 NVIDIA CORPORATION.  All rights reserved.
+# NVIDIA CORPORATION and its licensors retain all intellectual property
+# and proprietary rights in and to this software, related documentation
+# and any modifications thereto.  Any use, reproduction, disclosure or
+# distribution of this software and related documentation without an express
+# license agreement from NVIDIA CORPORATION is strictly prohibited.
+
+name: "CodeQL"
+
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - main
+      - release-*
+  pull_request:
+    branches:
+      - main
+      - release-*
+  schedule:
+    - cron: "45 9 * * *"
+
+env:
+  PYTHON_VERSION: 3.11
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    permissions:
+      security-events: write
+      packages: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python]
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        queries: security-extended
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
diff --git a/.github/workflows/sphinx.yml b/.github/workflows/sphinx.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
+          python-version: "3.10"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -11,12 +11,12 @@ ci:
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
 repos:
-- repo: https://github.com/astral-sh/ruff-pre-commit
-  # Ruff version.
-  rev: v0.3.7
-  hooks:
-    # Run the linter.
-    - id: ruff
-      args: [ --fix ] # Apply fixes to resolve lint violations.
-    # Run the formatter.
-    - id: ruff-format
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    # Ruff version.
+    rev: v0.3.7
+    hooks:
+      # Run the linter.
+      - id: ruff
+        args: [--fix] # Apply fixes to resolve lint violations.
+      # Run the formatter.
+      - id: ruff-format