From 1886d38618b04f65920c15a4f261f643223539b7 Mon Sep 17 00:00:00 2001 From: Marten Rebane Date: Fri, 11 Sep 2026 16:34:14 +0300 Subject: [PATCH] Fix initializing CodeQL --- .github/actions/setup-build-env/action.yml | 111 ++++++++++++++++ .github/workflows/build.yml | 145 +-------------------- .github/workflows/codeql.yml | 109 ++++++++++++++++ RIADigiDoc.xcodeproj/project.pbxproj | 23 +--- 4 files changed, 227 insertions(+), 161 deletions(-) create mode 100644 .github/actions/setup-build-env/action.yml create mode 100644 .github/workflows/codeql.yml diff --git a/.github/actions/setup-build-env/action.yml b/.github/actions/setup-build-env/action.yml new file mode 100644 index 00000000..f4254762 --- /dev/null +++ b/.github/actions/setup-build-env/action.yml @@ -0,0 +1,111 @@ +name: Set up RIA DigiDoc build environment +description: Prepares a macOS runner to build RIA DigiDoc iOS. + +inputs: + xcode: + description: Xcode version + required: true + google-services-plist: + description: Base64-encoded GoogleService-Info.plist + required: true + +outputs: + app-version: + description: MARKETING_VERSION from the project, also exported as APP_VERSION + value: ${{ steps.app-version.outputs.version }} + +runs: + using: composite + steps: + - name: Download Libdigidocpp iOS artifact + uses: dawidd6/action-download-artifact@v21 + with: + workflow: build.yml + branch: master + name: iphoneos + path: libdigidocpp-ios + repo: open-eid/libdigidocpp + - name: Download Libdigidocpp iOS Simulator artifact + uses: dawidd6/action-download-artifact@v21 + with: + workflow: build.yml + branch: master + name: iphonesimulator + path: libdigidocpp-ios-simulator + repo: open-eid/libdigidocpp + - name: Extract libdigidocpp artifacts + shell: bash + run: | + unzip -o libdigidocpp-ios/libdigidocpp.iphoneos.zip -d libdigidocpp.iphoneos + unzip -o libdigidocpp-ios-simulator/libdigidocpp.iphonesimulator.zip -d libdigidocpp.iphonesimulator + - name: Update libdigidocpp in project + shell: bash + run: | + export LIBDIGIDOCPP_PATH=${{ github.workspace }}/Modules/LibdigidocLib/Sources/LibdigidocObjC/Libs/digidocpp.xcframework + rm -rf $LIBDIGIDOCPP_PATH/ios-arm64 && mkdir $LIBDIGIDOCPP_PATH/ios-arm64 && cp -r ${{ github.workspace }}/libdigidocpp.iphoneos/libdigidocpp.iphoneos/lib/digidocpp.framework $LIBDIGIDOCPP_PATH/ios-arm64/ + rm -rf $LIBDIGIDOCPP_PATH/ios-arm64_x86_64-simulator && mkdir $LIBDIGIDOCPP_PATH/ios-arm64_x86_64-simulator && cp -r ${{ github.workspace }}/libdigidocpp.iphonesimulator/libdigidocpp.iphonesimulator/lib/digidocpp.framework $LIBDIGIDOCPP_PATH/ios-arm64_x86_64-simulator/ + - name: Install dependencies + shell: bash + run: brew install mockolo + - name: Setup config and TSL files + shell: bash + run: | + export RESOURCES_DIRECTORY="Modules/ConfigLib/Sources/ConfigLib/Resources" + export CONFIG_DIRECTORY="$RESOURCES_DIRECTORY/config" + export TSL_FILES_DIRECTORY="$RESOURCES_DIRECTORY/tslFiles" + + # Create TSL folder and mock folders for each module + mkdir -p $TSL_FILES_DIRECTORY + + # SPM packages must exist and need at least 1 file. Mock files are generated in 'Run tests' step + for module in CommonsLib ConfigLib WebEidLib CryptoLib IdCardLib LibdigidocLib MobileIdLib SmartIdLib UtilsLib; do + mock_dir="Modules/${module}/Tests/Mocks/Generated" + mkdir -p "$mock_dir" + echo "// Placeholder for generated mocks" > "${mock_dir}/__placeholder.swift" + done + + # Remove current files in tslFiles.bundle + echo "Removing current TSL files" + find $TSL_FILES_DIRECTORY -mindepth 1 ! -name ".keep" -delete + + # Download latest 'eu-lotl.xml' file" + echo "Downloading latest 'eu-lotl.xml' file" + wget "https://ec.europa.eu/tools/lotl/eu-lotl.xml" -P $TSL_FILES_DIRECTORY + + if [ -f "$TSL_FILES_DIRECTORY/eu-lotl.xml" ]; then + echo "Getting TSL (local LOTL)" + python3 scripts/tsl_xml_downloader.py --tslFile="$TSL_FILES_DIRECTORY/eu-lotl.xml" --tslTestFile="$TSL_FILES_DIRECTORY/$(basename 'https://ec.europa.eu/tools/lotl/eu-lotl.xml')" --countries="EE" --isDevBuild="False" + + echo "Finished downloading TSL" + else + echo "Getting TSL (remote LOTL)" + python3 scripts/tsl_xml_downloader.py --tslTestFile="$TSL_FILES_DIRECTORY/$(basename 'https://ec.europa.eu/tools/lotl/eu-lotl.xml')" --countries="EE" --isDevBuild="False" + echo "Finished downloading TSL" + fi + + echo "Moving TSLs to app's TSL files directory" + mv -v scripts/TSL/* $TSL_FILES_DIRECTORY + echo "Done moving TSLs" + - name: Setup environment + shell: bash + env: + GOOGLE_SERVICES_PLIST: ${{ inputs.google-services-plist }} + run: | + export LANG=en_US.UTF-8 + + sudo xcode-select -s /Applications/Xcode_${{ inputs.xcode }}.app + + # Setup Google Services + echo $GOOGLE_SERVICES_PLIST | base64 --decode > "${{ github.workspace }}/RIADigiDoc/Supporting files/GoogleService-Info.plist" + - name: Read app version + id: app-version + shell: bash + run: | + VERSION=$(xcodebuild -project ${{ github.workspace }}/RIADigiDoc.xcodeproj -showBuildSettings | grep MARKETING_VERSION | tr -d 'MARKETING_VERSION =') + echo "APP_VERSION=$VERSION" >> $GITHUB_ENV + echo "version=$VERSION" >> $GITHUB_OUTPUT + - name: Fetch default configuration + shell: bash + run: | + echo "Fetching default configuration" + python3 scripts/setup_configuration.py diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6f231449..2092d33c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,26 +1,11 @@ name: RIA DigiDoc iOS -on: - push: - pull_request: - branches: - - main - schedule: - - cron: "0 3 * * 1" # Weekly +on: [push] env: BUILD_NUMBER: ${{ github.run_number }} jobs: build: name: Build RIA DigiDoc on macOS - if: contains(github.repository, 'open-eid/RIA-DigiDoc-iOS') runs-on: macos-26 - timeout-minutes: 120 - permissions: - contents: read - actions: read - security-events: write - concurrency: - group: build-${{ github.ref }} - cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} strategy: matrix: xcode: @@ -32,94 +17,11 @@ jobs: uses: actions/checkout@v7 with: submodules: recursive - - name: Download Libdigidocpp iOS artifact - uses: dawidd6/action-download-artifact@v21 + - name: Set up build environment + uses: ./.github/actions/setup-build-env with: - workflow: build.yml - branch: master - name: iphoneos - path: libdigidocpp-ios - repo: open-eid/libdigidocpp - - name: Download Libdigidocpp iOS Simulator artifact - uses: dawidd6/action-download-artifact@v21 - with: - workflow: build.yml - branch: master - name: iphonesimulator - path: libdigidocpp-ios-simulator - repo: open-eid/libdigidocpp - - name: Extract libdigidocpp artifacts - run: | - unzip -o libdigidocpp-ios/libdigidocpp.iphoneos.zip -d libdigidocpp.iphoneos - unzip -o libdigidocpp-ios-simulator/libdigidocpp.iphonesimulator.zip -d libdigidocpp.iphonesimulator - - name: Update libdigidocpp in project - run: | - export LIBDIGIDOCPP_PATH=${{ github.workspace }}/Modules/LibdigidocLib/Sources/LibdigidocObjC/Libs/digidocpp.xcframework - rm -rf $LIBDIGIDOCPP_PATH/ios-arm64 && mkdir $LIBDIGIDOCPP_PATH/ios-arm64 && cp -r ${{ github.workspace }}/libdigidocpp.iphoneos/libdigidocpp.iphoneos/lib/digidocpp.framework $LIBDIGIDOCPP_PATH/ios-arm64/ - rm -rf $LIBDIGIDOCPP_PATH/ios-arm64_x86_64-simulator && mkdir $LIBDIGIDOCPP_PATH/ios-arm64_x86_64-simulator && cp -r ${{ github.workspace }}/libdigidocpp.iphonesimulator/libdigidocpp.iphonesimulator/lib/digidocpp.framework $LIBDIGIDOCPP_PATH/ios-arm64_x86_64-simulator/ - - name: Install dependencies - run: brew install mockolo - - name: Setup config and TSL files - run: | - export RESOURCES_DIRECTORY="Modules/ConfigLib/Sources/ConfigLib/Resources" - export CONFIG_DIRECTORY="$RESOURCES_DIRECTORY/config" - export TSL_FILES_DIRECTORY="$RESOURCES_DIRECTORY/tslFiles" - - # Create TSL folder and mock folders for each module - mkdir -p $TSL_FILES_DIRECTORY - - # SPM packages must exist and need at least 1 file. Mock files are generated in 'Run tests' step - for module in CommonsLib ConfigLib WebEidLib CryptoLib IdCardLib LibdigidocLib MobileIdLib SmartIdLib UtilsLib; do - mock_dir="Modules/${module}/Tests/Mocks/Generated" - mkdir -p "$mock_dir" - echo "// Placeholder for generated mocks" > "${mock_dir}/__placeholder.swift" - done - - # Remove current files in tslFiles.bundle - echo "Removing current TSL files" - find $TSL_FILES_DIRECTORY -mindepth 1 ! -name ".keep" -delete - - # Download latest 'eu-lotl.xml' file" - echo "Downloading latest 'eu-lotl.xml' file" - wget "https://ec.europa.eu/tools/lotl/eu-lotl.xml" -P $TSL_FILES_DIRECTORY - - if [ -f "$TSL_FILES_DIRECTORY/eu-lotl.xml" ]; then - echo "Getting TSL (local LOTL)" - python3 scripts/tsl_xml_downloader.py --tslFile="$TSL_FILES_DIRECTORY/eu-lotl.xml" --tslTestFile="$TSL_FILES_DIRECTORY/$(basename 'https://ec.europa.eu/tools/lotl/eu-lotl.xml')" --countries="EE" --isDevBuild="False" - - echo "Finished downloading TSL" - else - echo "Getting TSL (remote LOTL)" - python3 scripts/tsl_xml_downloader.py --tslTestFile="$TSL_FILES_DIRECTORY/$(basename 'https://ec.europa.eu/tools/lotl/eu-lotl.xml')" --countries="EE" --isDevBuild="False" - echo "Finished downloading TSL" - fi - - echo "Moving TSLs to app's TSL files directory" - mv -v scripts/TSL/* $TSL_FILES_DIRECTORY - echo "Done moving TSLs" - - name: Setup environment - env: - GOOGLE_SERVICES_PLIST: ${{ secrets.GOOGLE_SERVICES_PLIST }} - run: | - export LANG=en_US.UTF-8 - - sudo xcode-select -s /Applications/Xcode_${{ matrix.xcode }}.app - - # Setup Google Services - echo $GOOGLE_SERVICES_PLIST | base64 --decode > "${{ github.workspace }}/RIADigiDoc/Supporting files/GoogleService-Info.plist" - - # Setup app version - echo APP_VERSION=$(xcodebuild -project ${{ github.workspace }}/RIADigiDoc.xcodeproj -showBuildSettings | grep MARKETING_VERSION | tr -d 'MARKETING_VERSION =') >> $GITHUB_ENV - - name: Fetch default configuration - run: | - echo "Fetching default configuration" - python3 scripts/setup_configuration.py - - name: Initialize CodeQL - if: github.event_name != 'push' || github.ref == 'refs/heads/main' - uses: github/codeql-action/init@v4 - with: - languages: swift,c-cpp - build-mode: manual + xcode: ${{ matrix.xcode }} + google-services-plist: ${{ secrets.GOOGLE_SERVICES_PLIST }} - name: Run tests run: | cd ${{ github.workspace }} @@ -164,9 +66,6 @@ jobs: -destination 'platform=iOS Simulator,name=iPhone 17' \ -derivedDataPath "${{ github.workspace }}/build" \ -quiet - - name: Perform CodeQL analysis - if: github.event_name != 'push' || github.ref == 'refs/heads/main' - uses: github/codeql-action/analyze@v4 - name: Rename app file run: | mv \ @@ -190,37 +89,3 @@ jobs: rm -rf ~/Library/Developer/Xcode/DerivedData/* rm -rf ${{ github.workspace }}/build rm -rf ${{ github.workspace }}/.build - - codeql: - name: CodeQL (${{ matrix.language }}) - if: >- - contains(github.repository, 'open-eid/RIA-DigiDoc-iOS') && - (github.event_name == 'pull_request' || - github.event_name == 'schedule' || - github.ref == 'refs/heads/main') - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - actions: read - security-events: write - concurrency: - group: codeql-${{ matrix.language }}-${{ github.ref }} - cancel-in-progress: true - strategy: - fail-fast: false - matrix: - language: - - actions - - python - steps: - - name: Checkout - uses: actions/checkout@v6 - - name: Initialize CodeQL - uses: github/codeql-action/init@v4 - with: - languages: ${{ matrix.language }} - - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@v4 - with: - category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..06cc15e7 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,109 @@ +name: CodeQL +on: + push: + branches: + - main + pull_request: + branches: + - main + schedule: + - cron: "0 3 * * 1" # Weekly + +jobs: + swift: + name: CodeQL (swift) + if: contains(github.repository, 'open-eid/RIA-DigiDoc-iOS') + runs-on: macos-26 + timeout-minutes: 120 + permissions: + contents: read + actions: read + security-events: write + concurrency: + group: codeql-swift-${{ github.ref }} + cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} + strategy: + matrix: + xcode: + - 26.6 + platform: + - iOS + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + submodules: recursive + - name: Set up build environment + uses: ./.github/actions/setup-build-env + with: + xcode: ${{ matrix.xcode }} + google-services-plist: ${{ secrets.GOOGLE_SERVICES_PLIST }} + - name: Resolve package dependencies + run: | + cd ${{ github.workspace }} + + rm -rf ~/Library/Developer/Xcode/DerivedData/* + rm -rf "${{ runner.temp }}/codeql-build" + rm -rf ${{ github.workspace }}/.build + + xcodebuild -resolvePackageDependencies \ + -project RIADigiDoc.xcodeproj \ + -scheme RIADigiDoc \ + -derivedDataPath "${{ runner.temp }}/codeql-build" + - name: Initialize CodeQL + uses: github/codeql-action/init@v4 + with: + languages: swift + build-mode: manual + - name: Build + run: | + cd ${{ github.workspace }} + + xcodebuild build \ + -project RIADigiDoc.xcodeproj \ + -skipPackagePluginValidation \ + -scheme RIADigiDoc \ + -destination 'platform=iOS Simulator,name=iPhone 17' \ + -derivedDataPath "${{ runner.temp }}/codeql-build" \ + COMPILATION_CACHE_ENABLE_CACHING=NO \ + SWIFT_ENABLE_COMPILE_CACHE=NO \ + SWIFT_USE_INTEGRATED_DRIVER=NO \ + -quiet + - name: Perform CodeQL analysis + uses: github/codeql-action/analyze@v4 + - name: Clean up + if: ${{ always() }} + run: | + rm -rf ~/Library/Developer/Xcode/DerivedData/* + rm -rf "${{ runner.temp }}/codeql-build" + rm -rf ${{ github.workspace }}/.build + + scripts: + name: CodeQL (${{ matrix.language }}) + if: contains(github.repository, 'open-eid/RIA-DigiDoc-iOS') + runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + actions: read + security-events: write + concurrency: + group: codeql-${{ matrix.language }}-${{ github.ref }} + cancel-in-progress: true + strategy: + fail-fast: false + matrix: + language: + - actions + - python + steps: + - name: Checkout + uses: actions/checkout@v7 + - name: Initialize CodeQL + uses: github/codeql-action/init@v4 + with: + languages: ${{ matrix.language }} + - name: Perform CodeQL analysis + uses: github/codeql-action/analyze@v4 + with: + category: "/language:${{ matrix.language }}" diff --git a/RIADigiDoc.xcodeproj/project.pbxproj b/RIADigiDoc.xcodeproj/project.pbxproj index 4d199ba8..a3ec82cd 100644 --- a/RIADigiDoc.xcodeproj/project.pbxproj +++ b/RIADigiDoc.xcodeproj/project.pbxproj @@ -777,7 +777,6 @@ buildRules = ( ); dependencies = ( - DF56ACDE2FF5E0CA007A834D /* PBXTargetDependency */, DF4E43CA2D0BA38600967997 /* PBXTargetDependency */, DFB663AE2F16918100804545 /* PBXTargetDependency */, ); @@ -917,7 +916,6 @@ mainGroup = DFDB14722CC97B0E00153876; minimizedProjectReferenceProxies = 1; packageReferences = ( - DFED7A5F2CC9A3B200D8BCA9 /* XCRemoteSwiftPackageReference "SwiftLintPlugins" */, DFA3EE592D14C4C2001D951B /* XCRemoteSwiftPackageReference "Alamofire" */, DF9AFE902E00D30A0062C64D /* XCRemoteSwiftPackageReference "Factory" */, 1A7CC1C52E71CAAB0002CEA3 /* XCRemoteSwiftPackageReference "ASN1Decoder" */, @@ -1069,11 +1067,7 @@ target = DF4E43C02D0BA38600967997 /* FileImportShareExtension */; targetProxy = DF4E43C92D0BA38600967997 /* PBXContainerItemProxy */; }; - DF56ACDE2FF5E0CA007A834D /* PBXTargetDependency */ = { - isa = PBXTargetDependency; - productRef = DF56ACDD2FF5E0CA007A834D /* SwiftLintBuildToolPlugin */; - }; - DFB663AE2F16918100804545 /* PBXTargetDependency */ = { + DFB663AE2F16918100804545 /* PBXTargetDependency */ = { isa = PBXTargetDependency; target = DFB6639D2F16917D00804545 /* WidgetExtensionExtension */; targetProxy = DFB663AD2F16918100804545 /* PBXContainerItemProxy */; @@ -1742,14 +1736,6 @@ version = 5.12.0; }; }; - DFED7A5F2CC9A3B200D8BCA9 /* XCRemoteSwiftPackageReference "SwiftLintPlugins" */ = { - isa = XCRemoteSwiftPackageReference; - repositoryURL = "https://github.com/SimplyDanny/SwiftLintPlugins"; - requirement = { - kind = exactVersion; - version = 0.65.0; - }; - }; /* End XCRemoteSwiftPackageReference section */ /* Begin XCSwiftPackageProductDependency section */ @@ -1857,12 +1843,7 @@ package = DF54F82D2D431BD50021D05A /* XCRemoteSwiftPackageReference "swift-certificates" */; productName = X509; }; - DF56ACDD2FF5E0CA007A834D /* SwiftLintBuildToolPlugin */ = { - isa = XCSwiftPackageProductDependency; - package = DFED7A5F2CC9A3B200D8BCA9 /* XCRemoteSwiftPackageReference "SwiftLintPlugins" */; - productName = "plugin:SwiftLintBuildToolPlugin"; - }; - DF5903752ECCC41F00D1A278 /* MobileIdLibMocks */ = { + DF5903752ECCC41F00D1A278 /* MobileIdLibMocks */ = { isa = XCSwiftPackageProductDependency; productName = MobileIdLibMocks; };