Repository navigation
add Bazel based CodeQL static analysis tooling - #69
ANegm-ETAS wants to merge 1 commit into
Conversation
Add the //codeql package: a hermetic CodeQL C/C++ analysis tool with a pinned CLI and pinned query packs, driven by the codeql_sca() macro. - Pins live in codeql/versions.bzl and codeql/config/packs.toml, the archives including their checksums in MODULE.bazel; pins.json records what actually ran. - codeql_sca() resolves the compile commands of the analyzed Bazel targets, replays them with the production compiler, extracts the database, runs the selected reports and publishes SARIF/CSV plus summary.md, compilers.json and pins.json. - Presets: codeql-report (code scanning), codeql-report-safety (adds MISRA C++:2023) and code-complexity with a QM and an ASIL profile; the thresholds are code in lib/Thresholds.qll. - All complexity checks are warnings, except "public interfaces per component", which is an advisory recommendation (SARIF level note). - Findings never fail the run by default (--fail-on is opt-in) and // codeql[<rule-id>] comments are honoured. Add the package to the uv workspace and build plus smoke-test //codeql/... in the tests workflow. Signed-off-by: Negm Adham (ETAS-ECM/ESY3) <Adham.Negm@etas.com>
| # reports.toml and README.md (a unit test enforces this). | ||
|
|
||
| [codeql_cli] | ||
| version = "2.27.4" |
There was a problem hiding this comment.
The https://github.com/github/codeql-coding-standards/releases/tag/v2.62.0 states that it's allowed to be used with GitHub CLI version 2.21.4 only.
| MAX_RAM_MB = 12288 | ||
| MAX_REPORT_WORKERS = 4 | ||
| _SARIF_FLAGS = ( | ||
| "--format=sarif-latest", |
There was a problem hiding this comment.
The CodeQL coding standards manual requires SARIF 2.1.0 for functional-safety use. sarif-latest does not pin the output to that required version. Please emit sarifv2.1.0 explicitly.
| flush() | ||
| # Parse errors of an extraction that exited successfully are spurious | ||
| # (the extractor recovered). | ||
| if succeeded and not failed: |
There was a problem hiding this comment.
This drops all parser errors whenever the extractor exits successfully. The standards manual says recoverable errors belong in the Analysis Integrity Report because they can still affect analysis. As written, the default zero-parse-error gate can pass while these errors are hidden; please retain and report them.
| "SARIF result locations are not workspace-relative; GitHub Code Scanning " | ||
| "would drop or misplace these alerts (see sarif-summary.txt)" | ||
| ) | ||
| if sarif_report.quality_failed: |
There was a problem hiding this comment.
A failed SARIF quality check is only logged as a warning, and the run can still return 0 below. That allows failed metrics (for example, less than 100% of compilations without errors or no rules) to appear successful in CI. Please make quality failures affect the command exit status, or provide an explicit opt-out.
Add the //codeql package: a hermetic CodeQL C/C++ analysis tool with a pinned CLI and pinned query packs, driven by the codeql_sca() macro.