From d2d44c8bb277cc2211ad581270f4f8972a42762a Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Thu, 28 Dec 2023 18:39:02 +0100 Subject: [PATCH 1/9] Added version checking for GH actions Signed-off-by: Peter Lemenkov --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..fd83b118a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,10 @@ +# See: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#about-the-dependabotyml-file +version: 2 + +updates: + # Configure check for outdated GitHub Actions actions in workflows. + # See: https://docs.github.com/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot + - package-ecosystem: github-actions + directory: / # Check the repository's workflows under /.github/workflows/ + schedule: + interval: daily From 60cd7e1267aba20c3d4266aa0b7ba21d30dc1e23 Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Thu, 28 Dec 2023 22:25:17 +0100 Subject: [PATCH 2/9] Enable CodeQL checks Signed-off-by: Peter Lemenkov --- .github/workflows/codeql.yml | 50 ++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 000000000..c637ca04e --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,50 @@ +name: "CodeQL" + +on: + push: + branches: [ "master" ] + pull_request: + branches: [ "master" ] + schedule: + - cron: "15 23 * * 6" + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: [ cpp ] + + steps: + - name: Checkout + uses: actions/checkout@v4 + run: git submodule update --init + + - name: Install Packages + run: | + sudo apt-get update + sudo apt-get install --yes build-essential cmake libpcap-dev openssl libssl-dev libgsl-dev libsctp-dev libncurses5-dev libncurses5 + + - name: Build + run: cmake . -DUSE_GSL=1 -DUSE_PCAP=1 -DUSE_SSL=1 -DUSE_SCTP=1 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + queries: +security-and-quality + + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{ matrix.language }}" From 32efd1ea92e06fc1e4c1290275ba406d99c10281 Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Thu, 28 Dec 2023 22:27:15 +0100 Subject: [PATCH 3/9] Add Codespell Signed-off-by: Peter Lemenkov --- .github/workflows/codespell.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 .github/workflows/codespell.yml diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml new file mode 100644 index 000000000..316e63e9b --- /dev/null +++ b/.github/workflows/codespell.yml @@ -0,0 +1,19 @@ +# GitHub Action to automate the identification of common misspellings in text files. +# https://github.com/codespell-project/actions-codespell +# https://github.com/codespell-project/codespell +name: codespell +on: [push, pull_request] +permissions: {} +jobs: + codespell: + name: Check for spelling errors + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - uses: codespell-project/actions-codespell@master + with: + check_filenames: true + # When using this Action in other repos, the --skip option below can be removed + skip: "./.git, ./gtest, ./pcap" From 4c3f36ca7fea2387bb90f34beeb6d2c574cc2057 Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Thu, 28 Dec 2023 22:28:28 +0100 Subject: [PATCH 4/9] Enable Coverity Signed-off-by: Peter Lemenkov --- .github/workflows/coverity.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .github/workflows/coverity.yml diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml new file mode 100644 index 000000000..5cb7087a3 --- /dev/null +++ b/.github/workflows/coverity.yml @@ -0,0 +1,20 @@ +# Your .github/workflows/coverity.yml file. +name: Coverity scan + +# We only want to test official release code, not every pull request. +on: + push: + branches: [master] + +jobs: + coverity: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - run: sudo apt update + - run: sudo apt-get install --yes build-essential cmake libpcap-dev openssl libssl-dev libgsl-dev libsctp-dev libncurses5-dev libncurses5 + - run: cmake . -DUSE_GSL=1 -DUSE_PCAP=1 -DUSE_SSL=1 -DUSE_SCTP=1 + - uses: vapier/coverity-scan-action@v1 + with: + email: ${{ secrets.COVERITY_SCAN_EMAIL }} + token: ${{ secrets.COVERITY_SCAN_TOKEN }} From 8535e713bc5f0cad6af3c4081ca4dcecd7f1442f Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Thu, 28 Dec 2023 22:34:43 +0100 Subject: [PATCH 5/9] No more Travis-CI Signed-off-by: Peter Lemenkov --- README.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/README.md b/README.md index daf5209af..f2d7b9a12 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,3 @@ - - Travis Build Status - Coverity Scan Build Status From c364bb52c2adc50ad2c27bc499803dd31606f54d Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Thu, 28 Dec 2023 22:38:19 +0100 Subject: [PATCH 6/9] A step cannot have both the uses and run keys --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c637ca04e..d4ab9a6a3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -25,10 +25,10 @@ jobs: steps: - name: Checkout uses: actions/checkout@v4 - run: git submodule update --init - name: Install Packages run: | + git submodule update --init sudo apt-get update sudo apt-get install --yes build-essential cmake libpcap-dev openssl libssl-dev libgsl-dev libsctp-dev libncurses5-dev libncurses5 From 37985fa4e0faa67172b048b11964c5bc81ce7034 Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Thu, 28 Dec 2023 22:49:19 +0100 Subject: [PATCH 7/9] Tell CodeQL how to build SIPp Signed-off-by: Peter Lemenkov --- .github/workflows/codeql.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d4ab9a6a3..4b8d13328 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -43,6 +43,7 @@ jobs: - name: Autobuild uses: github/codeql-action/autobuild@v3 + run: make - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v3 From 8e8a1856bcd930a302a711af994e1bff42f79eb3 Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Thu, 28 Dec 2023 22:50:47 +0100 Subject: [PATCH 8/9] Simplify Signed-off-by: Peter Lemenkov --- .github/workflows/codeql.yml | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4b8d13328..9338d094a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,17 +32,14 @@ jobs: sudo apt-get update sudo apt-get install --yes build-essential cmake libpcap-dev openssl libssl-dev libgsl-dev libsctp-dev libncurses5-dev libncurses5 - - name: Build - run: cmake . -DUSE_GSL=1 -DUSE_PCAP=1 -DUSE_SSL=1 -DUSE_SCTP=1 - - name: Initialize CodeQL uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} queries: +security-and-quality - - name: Autobuild - uses: github/codeql-action/autobuild@v3 + - name: Build + run: cmake . -DUSE_GSL=1 -DUSE_PCAP=1 -DUSE_SSL=1 -DUSE_SCTP=1 run: make - name: Perform CodeQL Analysis From b98a2dc3e19b92a832a458a06d4aba5294ff4511 Mon Sep 17 00:00:00 2001 From: Peter Lemenkov Date: Thu, 28 Dec 2023 22:54:16 +0100 Subject: [PATCH 9/9] Rearrange steps --- .github/workflows/codeql.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9338d094a..91a1889b4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,6 +32,9 @@ jobs: sudo apt-get update sudo apt-get install --yes build-essential cmake libpcap-dev openssl libssl-dev libgsl-dev libsctp-dev libncurses5-dev libncurses5 + - name: Configure + run: cmake . -DUSE_GSL=1 -DUSE_PCAP=1 -DUSE_SSL=1 -DUSE_SCTP=1 + - name: Initialize CodeQL uses: github/codeql-action/init@v3 with: @@ -39,7 +42,6 @@ jobs: queries: +security-and-quality - name: Build - run: cmake . -DUSE_GSL=1 -DUSE_PCAP=1 -DUSE_SSL=1 -DUSE_SCTP=1 run: make - name: Perform CodeQL Analysis