From 12748837693fd209346ad2c104db5a223d5c9f59 Mon Sep 17 00:00:00 2001 From: thefourCraft Date: Sun, 28 Jun 2026 20:16:51 +0300 Subject: [PATCH] ci(codeql): remove parked baseline workflow Reverts the enterprise injection-host experiment. The enterprise uses default setup (re-enabled) for CodeQL results; mobile repos (jomalabs/platform) run the advanced baseline per-repo. This file conflicted with default setup here and only produced noisy failing runs. --- .github/workflows/codeql.yml | 166 ----------------------------------- 1 file changed, 166 deletions(-) delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 853423e..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,166 +0,0 @@ -name: CodeQL - -# ============================================================================ -# ENTERPRISE SECURITY BASELINE — CodeQL (advanced setup) -# ---------------------------------------------------------------------------- -# This is the portable CodeQL baseline meant to run on EVERY repo across the -# arcusis enterprise (arcusis, freightfte, jomalabs, scai-logistics, tgibots, -# tgilabs). It is self-detecting: it scans only the languages a given repo -# actually contains, and it builds native mobile apps automatically. -# -# WHY THIS EXISTS (and not the enterprise "default setup"): -# Default setup runs CodeQL autobuild, which cannot build a generated Xcode -# project (XcodeGen) or a gradle-wrapper-less Android project — so Swift and -# Kotlin scans always failed. A build command can only live in an advanced -# workflow (this file). Default setup and advanced setup are mutually -# exclusive per repo, so repos adopting this baseline must have default setup -# turned off (the enterprise config allows this via allow_advanced=true). -# -# DETECTION: -# - javascript-typescript / python / java-kotlin : included only if matching -# source files exist; scanned with build-mode:none (no compile needed). -# - actions : always included (every repo has workflow files). -# - swift : if an Xcode/SPM/XcodeGen project is detected, built on macOS -# (build-mode:manual) with code signing disabled, then analyzed. -# -# Actions are github-owned + SHA-pinned per enterprise policy -# (sha_pinning_required=true, github_owned_allowed=true). -# Default branch is `Production` (capital P) — branch filters are case-sensitive. -# ============================================================================ - -on: - push: - branches: [Production, main, master] - pull_request: - branches: [Production, main, master] - schedule: - - cron: "0 7 * * 1" # Weekly full scan, Mondays 07:00 UTC - -concurrency: - group: codeql-${{ github.ref }} - cancel-in-progress: ${{ github.event_name == 'pull_request' }} - -jobs: - # --------------------------------------------------------------------------- - # Detect which languages this repo contains → drives the analysis matrix. - # --------------------------------------------------------------------------- - detect: - name: Detect languages - runs-on: ubuntu-latest - outputs: - source_langs: ${{ steps.detect.outputs.source_langs }} - has_swift: ${{ steps.detect.outputs.has_swift }} - steps: - - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - - name: Detect languages - id: detect - run: | - set -euo pipefail - # List tracked paths once; classify by extension/marker. No eval/globbing. - files="$(git ls-files)" - has() { printf '%s\n' "$files" | grep -qiE "$1"; } - - langs='"actions"' # every repo has workflow files - has '\.(ts|tsx|js|jsx|mjs|cjs)$' && langs="$langs,\"javascript-typescript\"" - has '\.py$' && langs="$langs,\"python\"" - has '\.(kt|kts|java)$' && langs="$langs,\"java-kotlin\"" - echo "source_langs=[$langs]" >> "$GITHUB_OUTPUT" - - if has '\.swift$|\.xcodeproj(/|$)|\.xcworkspace(/|$)|(^|/)project\.yml$|(^|/)Package\.swift$'; then - echo "has_swift=true" >> "$GITHUB_OUTPUT" - else - echo "has_swift=false" >> "$GITHUB_OUTPUT" - fi - - # --------------------------------------------------------------------------- - # Source-only languages (build-mode:none) — one ubuntu runner. - # --------------------------------------------------------------------------- - analyze: - name: Analyze (${{ matrix.language }}) - needs: detect - if: needs.detect.outputs.source_langs != '[]' - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - strategy: - fail-fast: false - matrix: - language: ${{ fromJSON(needs.detect.outputs.source_langs) }} - steps: - - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - with: - languages: ${{ matrix.language }} - build-mode: none - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - with: - category: "/language:${{ matrix.language }}" - - # --------------------------------------------------------------------------- - # Swift — requires a real compile. Self-detects the project & scheme so the - # same workflow builds any iOS app in the enterprise without per-repo edits. - # --------------------------------------------------------------------------- - analyze-swift: - name: Analyze (swift) - needs: detect - if: needs.detect.outputs.has_swift == 'true' - runs-on: macos-26 - permissions: - actions: read - contents: read - security-events: write - steps: - - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - - name: Resolve Xcode project & scheme - id: xc - run: | - set -euo pipefail - # Generate the project from an XcodeGen spec if one exists. - SPEC=$(find . -name project.yml -not -path '*/.git/*' | head -1 || true) - if [ -n "$SPEC" ]; then - which xcodegen || brew install xcodegen - ( cd "$(dirname "$SPEC")" && xcodegen generate ) - fi - # Prefer a workspace, else a project. - WS=$(find . -name '*.xcworkspace' -not -path '*/.*' -not -path '*xcodeproj*' | head -1 || true) - PROJ=$(find . -name '*.xcodeproj' -not -path '*/.*' | head -1 || true) - if [ -n "$WS" ]; then - CONTAINER=( -workspace "$WS" ); LIST=$(xcodebuild -list -json -workspace "$WS") - elif [ -n "$PROJ" ]; then - CONTAINER=( -project "$PROJ" ); LIST=$(xcodebuild -list -json -project "$PROJ") - else - echo "::error::Swift detected but no .xcworkspace/.xcodeproj/Package.swift found to build." ; exit 1 - fi - SCHEME=$(echo "$LIST" | python3 -c "import sys,json;d=json.load(sys.stdin);s=(d.get('workspace') or d.get('project') or {}).get('schemes') or [];print(s[0] if s else '')") - [ -n "$SCHEME" ] || { echo "::error::No Xcode scheme found." ; exit 1; } - echo "scheme=$SCHEME" >> "$GITHUB_OUTPUT" - printf 'container=%s\n' "${CONTAINER[*]}" >> "$GITHUB_OUTPUT" - - - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - with: - languages: swift - build-mode: manual - - - name: Build (CodeQL traces this compile) - run: | - set -euo pipefail - xcodebuild build ${{ steps.xc.outputs.container }} \ - -scheme "${{ steps.xc.outputs.scheme }}" \ - -configuration Debug \ - -destination "generic/platform=iOS" \ - CODE_SIGNING_ALLOWED=NO - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - with: - category: "/language:swift"