Hippy/.github/workflows/security_codeql_analyses.yml

name: "[security] codeql analyses"

on:
  push:
    branches:
      - main
      - master
  pull_request:
    branches:
      - main
      - master
  schedule:
    - cron: '0 20 * * *'
  workflow_dispatch:

jobs:
  analyze:
    runs-on: ${{ github.repository == 'Tencent/Hippy' && fromJson('[''self-hosted'', ''linux'']') || 'ubuntu-latest' }}
    container:
      image: ghcr.io/tencent/android-release:latest # repository name must be lowercase(${{ github.repository_owner }})
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language: [ 'cpp', 'java', 'javascript', 'typescript' ]
    steps:
    - name: Detect Languages
      id: detect_languages
      uses: actions/github-script@v6.3.3
      with:
        script: |
          const { owner, repo } = context.repo;
          const { pull_request } = context.payload;
          const { pulls } = github.rest;
          const path = require('path');
          const fs = require('fs');
          const os = require('os');

          if (pull_request === undefined) { // Push
            fs.appendFileSync(process.env.GITHUB_OUTPUT, `language=${{ matrix.language }}${os.EOL}`, { encoding: 'utf8' });
            return;
          }

          // Ref: https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/#languages-and-compilers
          const languages  = {
            "cpp": [".cpp", ".c++", ".cxx", ".hpp", ".hh", ".h++", ".hxx", ".c", ".cc", ".h"],
            "java": [".java"],
            "javascript": [".js", ".jsx", ".mjs", ".es", ".es6", ".htm", ".html", ".xhtm", ".xhtml", ".vue", ".hbs", ".ejs", ".njk", ".json", ".yaml", ".yml", ".raml", ".xml"],
            "typescript": [".ts", ".tsx"]
          };
          const all_exts = Object.values(languages).flat();
          const cur_exts = languages["${{ matrix.language }}"];

          let match_all = false;
          let has_hit = false;

          try {
            const count = (await github.paginate(pulls.listFiles, {
              owner,
              repo,
              per_page: 100,
              pull_number: pull_request.number,
            }, ({ data: files }, done) => {
              for (const { filename } of files) {
                const ext = path.extname(filename);
                if (cur_exts.includes(ext)) {
                  has_hit = true;
                  done();
                  break;
                } else {
                  match_all |= all_exts.includes(ext);
                }
              }
              return [files.length];
            })).reduce((a, b) => a + b, 0);

            if (count === 3_000) { // The paginated response include a maximum of 3000 files
              has_hit = true;
            }
          } catch (e) {
            console.error(e);
            has_hit = true;
          }

          if (has_hit) {
            fs.appendFileSync(process.env.GITHUB_OUTPUT, `language=${{ matrix.language }}${os.EOL}`, { encoding: 'utf8' });
          } else if (!match_all && "${{ matrix.language }}" === "typescript") { // Default Run
            fs.appendFileSync(process.env.GITHUB_OUTPUT, `default-run=1${os.EOL}`, { encoding: 'utf8' });
          }
    - name: Checkout
      if: steps.detect_languages.outputs.language
      uses: actions/checkout@v3
      with:
        lfs: true
    - name: Initialize CodeQL
      if: steps.detect_languages.outputs.language
      uses: github/codeql-action/init@v2
      with:
        languages: ${{ steps.detect_languages.outputs.language }}
    - name: Setup Node.js
      if: steps.detect_languages.outputs.language == 'javascript' || steps.detect_languages.outputs.language == 'typescript'
      uses: actions/setup-node@v3
      with:
        node-version: latest
    - name: Build Java
      if: steps.detect_languages.outputs.language == 'java'
      env:
        skipCmakeAndNinja: 1
      run: |
        ./gradlew assembleDebug
    - name: Build C++
      if: steps.detect_languages.outputs.language == 'cpp'
      run: |
        ./gradlew buildCMakeDebug -PINCLUDE_ABI_X86=true -PINCLUDE_ABI_X86_64=true
    - name: Perform CodeQL Analysis
      if: steps.detect_languages.outputs.language
      uses: github/codeql-action/analyze@v2
    - name: Generate Fake SARIF
      if: steps.detect_languages.outputs.default-run
      run:
        echo '{"version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL"}},"results":[]}]}' > ./fake.sarif
      # The following step will output a lot of errors(like `The process '/usr/bin/git' failed with exit code 128`),
      # don't worry it's NORMAL because we don't checkout repository.
    - name: Upload Fake SARIF
      if: steps.detect_languages.outputs.default-run
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: ./fake.sarif
        category: fake_results_do_not_care