CodeQL: Add more build combinations and disable run on PR (#3246)

Enhance CodeQL Code Security Analysis: - Add more compilation combinations to build iwasm with different kinds of features - Disable run on PR created and keep nightly run, since the whole time is very long, and will check how to restore run on PR created in the future
2025-02-06 06:55:07 +00:00 · 2024-03-21 14:18:27 +08:00 · 2024-03-21 14:18:27 +08:00 · e003ee1e29
commit e003ee1e29
parent a86eeb273c
3 changed files with 256 additions and 39 deletions
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@ -4,20 +4,20 @@
 # You may wish to alter this file to override the set of languages analyzed,
 # or to provide custom queries or build logic.
 #
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
 name: "CodeQL"

 on:
-  # push:
-  #   branches: [ "main", "master" ]
+  #pull_request:
+  #  types:
+  #    - opened
+  #  branches: '*'
+  #push:
+  #   branches: [ "main" ]
+  # midnight UTC
  schedule:
    - cron: '0 0 * * *'
-  pull_request:
-    branches: '*'
+  # allow to be triggered manually
+  workflow_dispatch:

 jobs:
  analyze:
@ -39,9 +39,6 @@ jobs:
      matrix:
        language: [ 'cpp' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
-        # Use only 'java' to analyze code written in Java, Kotlin or both
-        # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
-        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

    steps:
    - name: Checkout repository
@ -54,29 +51,19 @@ jobs:
      uses: github/codeql-action/init@v2
      with:
        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.

        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
        # queries: security-extended,security-and-quality
        queries: security-and-quality

-
-    # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    #- name: Autobuild
-    #  uses: github/codeql-action/autobuild@v2
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+    # Command-line programs to run using the OS shell.
+    # See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun

    #   If the Autobuild fails above, remove it and uncomment the following three lines.
    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.

    - run: |
        ./.github/workflows/codeql_buildscript.sh
-
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v2
      with:
@ -118,9 +105,9 @@ jobs:
      with:
        name: codeql-results
        path: ${{ steps.step1.outputs.sarif-output }}
-        retention-days: 5
+        retention-days: 10

    - name: Fail if an error is found
      run: |
-        ./.github/workflows/fail_on_error.py \
+        ./.github/workflows/codeql_fail_on_error.py \
          ${{ steps.step1.outputs.sarif-output }}/cpp.sarif
--- a/.github/workflows/codeql_buildscript.sh
+++ b/.github/workflows/codeql_buildscript.sh
@ -1,18 +1,248 @@
 #!/usr/bin/env bash

-sudo apt install -y build-essential cmake g++-multilib libgcc-9-dev lib32gcc-9-dev ccache ninja-build
+sudo apt install -y build-essential cmake g++-multilib libgcc-12-dev lib32gcc-12-dev ccache ninja-build ccache

-cd wamr-compiler
-./build_llvm.sh 
-mkdir build && cd build
-cmake .. 
-make
-# wamrc is generated under current directory
+WAMR_DIR=${PWD}

-cd ../..
-
-cd product-mini/platforms/linux/
-mkdir build && cd build
+# build wamrc
+cd ${WAMR_DIR}/wamr-compiler
+./build_llvm.sh
+rm -fr build && mkdir build && cd build
 cmake ..
-make
-# iwasm is generated under current directory
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build wamrc!"
+    exit 1;
+fi
+
+# build iwasm with default features enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -fr build && mkdir build && cd build
+cmake ..
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with default features enabled!"
+    exit 1;
+fi
+
+# build iwasm with default features enabled on x86_32
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -fr build && mkdir build && cd build
+cmake .. -DWAMR_BUILD_TARGET=X86_32
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with default features enabled on x86_32!"
+    exit 1;
+fi
+
+# build iwasm with classic interpreter enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_FAST_INTERP=0
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with classic interpreter enabled!"
+    exit 1;
+fi
+
+# build iwasm with extra features enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -fr build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug \
+    -DWAMR_BUILD_LIB_PTHREAD=1 -DWAMR_BUILD_LIB_PTHREAD_SEMAPHORE=1 \
+    -DWAMR_BUILD_MULTI_MODULE=1 -DWAMR_BUILD_SIMD=1 \
+    -DWAMR_BUILD_TAIL_CALL=1 -DWAMR_BUILD_REF_TYPES=1 \
+    -DWAMR_BUILD_CUSTOM_NAME_SECTION=1 -DWAMR_BUILD_MEMORY_PROFILING=1 \
+    -DWAMR_BUILD_PERF_PROFILING=1 -DWAMR_BUILD_DUMP_CALL_STACK=1 \
+    -DWAMR_BUILD_LOAD_CUSTOM_SECTION=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build wamrc iwasm with extra features enabled!"
+    exit 1;
+fi
+
+# build iwasm with global heap pool enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -fr build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug \
+    -DWAMR_BUILD_ALLOC_WITH_USER_DATA=1 \
+    -DWAMR_DISABLE_STACK_HW_BOUND_CHECK=1 \
+    -DWAMR_BUILD_GLOBAL_HEAP_POOL=1 \
+    -DWAMR_BUILD_GLOBAL_HEAP_SIZE=131072
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with global heap pool enabled!"
+    exit 1;
+fi
+
+# build iwasm with wasi-threads enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -fr build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_LIB_WASI_THREADS=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with wasi-threads enabled!"
+    exit 1;
+fi
+
+# build iwasm with GC enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_GC=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with GC enabled!"
+    exit 1;
+fi
+
+# build iwasm with hardware boundary check disabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_DISABLE_HW_BOUND_CHECK=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with hardware boundary check disabled!"
+    exit 1;
+fi
+
+# build iwasm with quick AOT entry disabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_QUICK_AOT_ENTRY=0
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with quick AOT entry disabled!"
+    exit 1;
+fi
+
+# build iwasm with wakeup of blocking operations disabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_DISABLE_WAKEUP_BLOCKING_OP=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with wakeup of blocking operations disabled!"
+    exit 1;
+fi
+
+# build iwasm with module instance context disabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_MODULE_INST_CONTEXT=0 \
+         -DWAMR_BUILD_LIBC_BUILTIN=0 -DWAMR_BUILD_LIBC_WASI=0
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with module instance context disabled!"
+    exit 1;
+fi
+
+# build iwasm with libc-uvwasi enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -fr build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_LIBC_UVWASI=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with libc-uvwasi enabled!"
+    exit 1;
+fi
+
+# build iwasm with llvm jit lazy mode enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_JIT=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build llvm jit lazy mode enabled!"
+    exit 1;
+fi
+
+# build iwasm with llvm jit eager mode enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_JIT=1 -DWAMR_BUILD_LAZY_JIT=0
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build llvm jit eager mode enabled!"
+    exit 1;
+fi
+
+# build iwasm with fast jit lazy mode enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_FAST_JIT=1 -DWAMR_BUILD_FAST_JIT_DUMP=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with fast jit lazy mode enabled!"
+    exit 1;
+fi
+
+# build iwasm with fast jit eager mode enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_FAST_JIT=1 -DWAMR_BUILD_FAST_JIT_DUMP=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with fast jit eager mode enabled!"
+    exit 1;
+fi
+
+# build iwasm with multi-tier jit enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_FAST_JIT=1 -DWAMR_BUILD_JIT=1 \
+                                    -DWAMR_BUILD_FAST_JIT_DUMP=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with multi-tier jit enabled!"
+    exit 1;
+fi
+
+# build iwasm with wasm mini-loader enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_MINI_LOADER=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build with wasm mini-loader enabled!"
+    exit 1;
+fi
+
+# build iwasm with source debugging enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_DEBUG_INTERP=1 -DWAMR_BUILD_DEBUG_AOT=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with source debugging enabled!"
+    exit 1;
+fi
+
+# build iwasm with AOT static PGO enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_STATIC_PGO=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with AOT static PGO enabled!"
+    exit 1;
+fi
+
+# build iwasm with configurable bounds checks enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_CONFIGUABLE_BOUNDS_CHECKS=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with configurable bounds checks enabled!"
+    exit 1;
+fi
+
+# build iwasm with linux perf support enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux/
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_LINUX_PERF=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with linux perf support enabled!"
+    exit 1;
+fi
--- a/.github/workflows/codeql_fail_on_error.py
+++ b/.github/workflows/codeql_fail_on_error.py