From 4ad8f1584de135184662241304ef92a8e1c1405e Mon Sep 17 00:00:00 2001 From: thefourCraft Date: Sun, 28 Jun 2026 19:15:46 +0300 Subject: [PATCH 1/2] ci(codeql): add portable enterprise CodeQL security baseline --- .github/workflows/codeql.yml | 166 +++++++++++++++++++++++++++++++++++ 1 file changed, 166 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..e386d85 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,166 @@ +name: CodeQL + +# ============================================================================ +# ENTERPRISE SECURITY BASELINE — CodeQL (advanced setup) +# ---------------------------------------------------------------------------- +# This is the portable CodeQL baseline meant to run on EVERY repo across the +# arcusis enterprise (arcusis, freightfte, jomalabs, scai-logistics, tgibots, +# tgilabs). It is self-detecting: it scans only the languages a given repo +# actually contains, and it builds native mobile apps automatically. +# +# WHY THIS EXISTS (and not the enterprise "default setup"): +# Default setup runs CodeQL autobuild, which cannot build a generated Xcode +# project (XcodeGen) or a gradle-wrapper-less Android project — so Swift and +# Kotlin scans always failed. A build command can only live in an advanced +# workflow (this file). Default setup and advanced setup are mutually +# exclusive per repo, so repos adopting this baseline must have default setup +# turned off (the enterprise config allows this via allow_advanced=true). +# +# DETECTION: +# - javascript-typescript / python / java-kotlin : included only if matching +# source files exist; scanned with build-mode:none (no compile needed). +# - actions : always included (every repo has workflow files). +# - swift : if an Xcode/SPM/XcodeGen project is detected, built on macOS +# (build-mode:manual) with code signing disabled, then analyzed. +# +# Actions are github-owned + SHA-pinned per enterprise policy +# (sha_pinning_required=true, github_owned_allowed=true). +# Default branch is `Production` (capital P) — branch filters are case-sensitive. +# ============================================================================ + +on: + push: + branches: [Production, main, master] + pull_request: + branches: [Production, main, master] + schedule: + - cron: "0 7 * * 1" # Weekly full scan, Mondays 07:00 UTC + +concurrency: + group: codeql-${{ github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + +jobs: + # --------------------------------------------------------------------------- + # Detect which languages this repo contains → drives the analysis matrix. + # --------------------------------------------------------------------------- + detect: + name: Detect languages + runs-on: ubuntu-latest + outputs: + source_langs: ${{ steps.detect.outputs.source_langs }} + has_swift: ${{ steps.detect.outputs.has_swift }} + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + + - name: Detect languages + id: detect + run: | + set -euo pipefail + ex='-not -path */node_modules/* -not -path */.git/* -not -path */vendor/* -not -path */Pods/*' + present() { [ -n "$(eval find . $ex -type f \\( $1 \\) -print -quit)" ]; } + + langs=('"actions"') # every repo has workflow files + present '-name *.ts -o -name *.tsx -o -name *.js -o -name *.jsx -o -name *.mjs' && langs+=('"javascript-typescript"') + present '-name *.py' && langs+=('"python"') + present '-name *.kt -o -name *.kts -o -name *.java' && langs+=('"java-kotlin"') + + IFS=,; echo "source_langs=[${langs[*]}]" >> "$GITHUB_OUTPUT"; unset IFS + + if [ -n "$(eval find . $ex -type f \( -name *.xcodeproj -o -name *.xcworkspace -o -name project.yml -o -name Package.swift -o -name *.swift \) -print -quit)" ]; then + echo "has_swift=true" >> "$GITHUB_OUTPUT" + else + echo "has_swift=false" >> "$GITHUB_OUTPUT" + fi + + # --------------------------------------------------------------------------- + # Source-only languages (build-mode:none) — one ubuntu runner. + # --------------------------------------------------------------------------- + analyze: + name: Analyze (${{ matrix.language }}) + needs: detect + if: needs.detect.outputs.source_langs != '[]' + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + strategy: + fail-fast: false + matrix: + language: ${{ fromJSON(needs.detect.outputs.source_langs) }} + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - name: Initialize CodeQL + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + languages: ${{ matrix.language }} + build-mode: none + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + category: "/language:${{ matrix.language }}" + + # --------------------------------------------------------------------------- + # Swift — requires a real compile. Self-detects the project & scheme so the + # same workflow builds any iOS app in the enterprise without per-repo edits. + # --------------------------------------------------------------------------- + analyze-swift: + name: Analyze (swift) + needs: detect + if: needs.detect.outputs.has_swift == 'true' + runs-on: macos-26 + permissions: + actions: read + contents: read + security-events: write + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + + - name: Resolve Xcode project & scheme + id: xc + run: | + set -euo pipefail + # Generate the project from an XcodeGen spec if one exists. + SPEC=$(find . -name project.yml -not -path '*/.git/*' | head -1 || true) + if [ -n "$SPEC" ]; then + which xcodegen || brew install xcodegen + ( cd "$(dirname "$SPEC")" && xcodegen generate ) + fi + # Prefer a workspace, else a project. + WS=$(find . -name '*.xcworkspace' -not -path '*/.*' -not -path '*xcodeproj*' | head -1 || true) + PROJ=$(find . -name '*.xcodeproj' -not -path '*/.*' | head -1 || true) + if [ -n "$WS" ]; then + CONTAINER=( -workspace "$WS" ); LIST=$(xcodebuild -list -json -workspace "$WS") + elif [ -n "$PROJ" ]; then + CONTAINER=( -project "$PROJ" ); LIST=$(xcodebuild -list -json -project "$PROJ") + else + echo "::error::Swift detected but no .xcworkspace/.xcodeproj/Package.swift found to build." ; exit 1 + fi + SCHEME=$(echo "$LIST" | python3 -c "import sys,json;d=json.load(sys.stdin);s=(d.get('workspace') or d.get('project') or {}).get('schemes') or [];print(s[0] if s else '')") + [ -n "$SCHEME" ] || { echo "::error::No Xcode scheme found." ; exit 1; } + echo "scheme=$SCHEME" >> "$GITHUB_OUTPUT" + printf 'container=%s\n' "${CONTAINER[*]}" >> "$GITHUB_OUTPUT" + + - name: Initialize CodeQL + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + languages: swift + build-mode: manual + + - name: Build (CodeQL traces this compile) + run: | + set -euo pipefail + xcodebuild build ${{ steps.xc.outputs.container }} \ + -scheme "${{ steps.xc.outputs.scheme }}" \ + -configuration Debug \ + -destination "generic/platform=iOS" \ + CODE_SIGNING_ALLOWED=NO + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + with: + category: "/language:swift" From 2ce17c951ef3ed2ab1f71dd16b467fd9db3eaf41 Mon Sep 17 00:00:00 2001 From: thefourCraft Date: Sun, 28 Jun 2026 19:18:50 +0300 Subject: [PATCH 2/2] ci(codeql): fix language detection (git ls-files, no eval/glob) --- .github/workflows/codeql.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e386d85..853423e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -58,17 +58,17 @@ jobs: id: detect run: | set -euo pipefail - ex='-not -path */node_modules/* -not -path */.git/* -not -path */vendor/* -not -path */Pods/*' - present() { [ -n "$(eval find . $ex -type f \\( $1 \\) -print -quit)" ]; } + # List tracked paths once; classify by extension/marker. No eval/globbing. + files="$(git ls-files)" + has() { printf '%s\n' "$files" | grep -qiE "$1"; } - langs=('"actions"') # every repo has workflow files - present '-name *.ts -o -name *.tsx -o -name *.js -o -name *.jsx -o -name *.mjs' && langs+=('"javascript-typescript"') - present '-name *.py' && langs+=('"python"') - present '-name *.kt -o -name *.kts -o -name *.java' && langs+=('"java-kotlin"') + langs='"actions"' # every repo has workflow files + has '\.(ts|tsx|js|jsx|mjs|cjs)$' && langs="$langs,\"javascript-typescript\"" + has '\.py$' && langs="$langs,\"python\"" + has '\.(kt|kts|java)$' && langs="$langs,\"java-kotlin\"" + echo "source_langs=[$langs]" >> "$GITHUB_OUTPUT" - IFS=,; echo "source_langs=[${langs[*]}]" >> "$GITHUB_OUTPUT"; unset IFS - - if [ -n "$(eval find . $ex -type f \( -name *.xcodeproj -o -name *.xcworkspace -o -name project.yml -o -name Package.swift -o -name *.swift \) -print -quit)" ]; then + if has '\.swift$|\.xcodeproj(/|$)|\.xcworkspace(/|$)|(^|/)project\.yml$|(^|/)Package\.swift$'; then echo "has_swift=true" >> "$GITHUB_OUTPUT" else echo "has_swift=false" >> "$GITHUB_OUTPUT"