From 434476c7b5816fd7420c9b50f9c160cfa5c37be7 Mon Sep 17 00:00:00 2001 From: Roshan Kumar Date: Wed, 30 Sep 2026 10:21:26 +0530 Subject: [PATCH] Ci/simplify workflows (#4) * ci: remove on-demand scan and redundant clean step - Delete scan_on_demand workflow; Coverity (weekly + manual) and CodeQL SARIF uploads already provide scan coverage. - Remove initial 'Clean up previous run' step from ci, coverity, daily_build, and pull_request workflows; GitHub runners start clean. * ci: use self-repository syntax for local actions Replace workspace-relative 'uses: ./...' with GitHub's self-repository 'uses: $/...' form for all local composite actions. This enables fully-pinned policy enforcement and avoids loading actions from runtime filesystem state. * ci: add CodeQL advanced workflow and Gitleaks CLI scan - Add CodeQL Advanced workflow (c-cpp, manual build reusing build-dvledtx) triggered on PR + push to main/dev, weekly, and manual. Consolidates the approach from the standalone CodeQL PR. - Replace gitleaks-action with a pinned Gitleaks CLI install (checksum verified) running git-history and directory scans; wire Gitleaks Scan into the CI and daily build workflows. Folds in the Gitleaks PR. * ci(gitleaks): use GITHUB_OUTPUT instead of GITHUB_ENV for scan exit codes Resolves zizmor github-env high-severity findings by passing scan exit codes via step outputs and consuming them through an env: block. * ci: restore './' prefix for local composite action references Local action references had been written as '$/.github/actions/...', which is not valid GitHub Actions syntax; a local action path must start with './'. GitHub cannot resolve '$/...', and OpenSSF Scorecard classified all 26 internal references as unpinned third-party actions, dropping Pinned-Dependencies to 1/10 ("1 out of 34 third-party GitHubAction dependencies pinned") and the overall score to 8.3. All remaining external actions are already pinned by SHA, so this restores Pinned-Dependencies to a passing state. --------- Co-authored-by: sunilnom --- .github/actions/analysis/codeql/action.yml | 2 +- .github/workflows/ci.yml | 18 ++++++++-------- .github/workflows/codeql.yml | 4 ++-- .github/workflows/coverity.yml | 4 ++-- .github/workflows/daily_build.yml | 24 +++++++++++----------- .github/workflows/pull_request.yml | 16 +++++++-------- 6 files changed, 34 insertions(+), 34 deletions(-) diff --git a/.github/actions/analysis/codeql/action.yml b/.github/actions/analysis/codeql/action.yml index 6888a9b..448ebbd 100644 --- a/.github/actions/analysis/codeql/action.yml +++ b/.github/actions/analysis/codeql/action.yml @@ -17,7 +17,7 @@ runs: # c-cpp requires a manual build so CodeQL can trace the meson/ninja compiler invocations. - name: Build dvledtx - uses: $/.github/actions/build-dvledtx + uses: ./.github/actions/build-dvledtx - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b0e0300..757b4a2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,31 +37,31 @@ jobs: persist-credentials: false - name: Environment check - uses: $/.github/actions/environment-check + uses: ./.github/actions/environment-check - name: Build - uses: $/.github/actions/build-dvledtx + uses: ./.github/actions/build-dvledtx - name: Smoke test - uses: $/.github/actions/smoke-tests + uses: ./.github/actions/smoke-tests - name: Unit tests - uses: $/.github/actions/unit-tests + uses: ./.github/actions/unit-tests - name: ShellCheck - uses: $/.github/actions/analysis/shellcheck + uses: ./.github/actions/analysis/shellcheck - name: zizmor Scan - uses: $/.github/actions/analysis/zizmor + uses: ./.github/actions/analysis/zizmor - name: cppcheck - uses: $/.github/actions/analysis/cppcheck + uses: ./.github/actions/analysis/cppcheck - name: Trivy Scan - uses: $/.github/actions/analysis/trivy + uses: ./.github/actions/analysis/trivy - name: checksec Analysis - uses: $/.github/actions/analysis/checksec + uses: ./.github/actions/analysis/checksec - name: Upload all reports uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index a12505d..1c1e656 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -49,7 +49,7 @@ jobs: persist-credentials: false - name: Environment check - uses: $/.github/actions/environment-check + uses: ./.github/actions/environment-check - name: CodeQL Scan - uses: $/.github/actions/analysis/codeql + uses: ./.github/actions/analysis/codeql diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index ddef925..ea92f51 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -39,10 +39,10 @@ jobs: run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" - name: Environment check - uses: $/.github/actions/environment-check + uses: ./.github/actions/environment-check - name: Coverity Scan - uses: $/.github/actions/analysis/coverity + uses: ./.github/actions/analysis/coverity env: COVERITY_TOKEN: ${{ secrets.COVERITY_TOKEN }} COVERITY_EMAIL: ${{ secrets.COVERITY_EMAIL }} diff --git a/.github/workflows/daily_build.yml b/.github/workflows/daily_build.yml index 96927ad..806df1d 100644 --- a/.github/workflows/daily_build.yml +++ b/.github/workflows/daily_build.yml @@ -35,34 +35,34 @@ jobs: persist-credentials: false - name: Environment check - uses: $/.github/actions/environment-check + uses: ./.github/actions/environment-check - name: Build - uses: $/.github/actions/build-dvledtx + uses: ./.github/actions/build-dvledtx - name: Smoke test - uses: $/.github/actions/smoke-tests + uses: ./.github/actions/smoke-tests - name: Unit tests - uses: $/.github/actions/unit-tests + uses: ./.github/actions/unit-tests - name: ShellCheck - uses: $/.github/actions/analysis/shellcheck + uses: ./.github/actions/analysis/shellcheck - name: zizmor Scan - uses: $/.github/actions/analysis/zizmor + uses: ./.github/actions/analysis/zizmor - name: cppcheck - uses: $/.github/actions/analysis/cppcheck + uses: ./.github/actions/analysis/cppcheck - name: Trivy Scan - uses: $/.github/actions/analysis/trivy + uses: ./.github/actions/analysis/trivy - name: checksec Analysis - uses: $/.github/actions/analysis/checksec + uses: ./.github/actions/analysis/checksec - name: Gitleaks Scan - uses: $/.github/actions/analysis/gitleaks + uses: ./.github/actions/analysis/gitleaks - name: Upload daily build reports uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 @@ -89,7 +89,7 @@ jobs: persist-credentials: false - name: AFL Fuzz - uses: $/.github/actions/analysis/afl-fuzz + uses: ./.github/actions/analysis/afl-fuzz with: max-seconds: '7200' @@ -119,7 +119,7 @@ jobs: persist-credentials: false - name: libFuzzer - uses: $/.github/actions/analysis/libfuzzer + uses: ./.github/actions/analysis/libfuzzer with: max-seconds: '3600' diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml index 2d5abad..f7be419 100644 --- a/.github/workflows/pull_request.yml +++ b/.github/workflows/pull_request.yml @@ -38,28 +38,28 @@ jobs: persist-credentials: false - name: Environment check - uses: $/.github/actions/environment-check + uses: ./.github/actions/environment-check - name: Build - uses: $/.github/actions/build-dvledtx + uses: ./.github/actions/build-dvledtx - name: Smoke test - uses: $/.github/actions/smoke-tests + uses: ./.github/actions/smoke-tests - name: Unit tests - uses: $/.github/actions/unit-tests + uses: ./.github/actions/unit-tests - name: ShellCheck - uses: $/.github/actions/analysis/shellcheck + uses: ./.github/actions/analysis/shellcheck - name: zizmor Scan - uses: $/.github/actions/analysis/zizmor + uses: ./.github/actions/analysis/zizmor - name: cppcheck - uses: $/.github/actions/analysis/cppcheck + uses: ./.github/actions/analysis/cppcheck - name: Gitleaks Scan - uses: $/.github/actions/analysis/gitleaks + uses: ./.github/actions/analysis/gitleaks - name: Upload PR reports uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1