Skip to content

Commit 3020d9b

Browse files
xengine-qytxengine-qyt
committed
ci:added mint linux and codeql to commit support
ci:delete cppcheck.yml
1 parent 5f74f5a commit 3020d9b

5 files changed

Lines changed: 274 additions & 37 deletions

File tree

‎.github/workflows/Mintbuild.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: MintLinux build workflows
2+
3+
on:
4+
push:
5+
branches:
6+
- 'master'
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
build:
13+
runs-on: ${{ matrix.runner }}
14+
container:
15+
image: ${{ matrix.name }}
16+
options: --platform ${{ matrix.platform }}
17+
strategy:
18+
matrix:
19+
include:
20+
- arch: amd64
21+
runner: ubuntu-24.04
22+
platform: linux/amd64
23+
artifact: x86-64
24+
name: linuxmintd/mint22-amd64
25+
version: 22
26+
27+
steps:
28+
- name: Checkout main repository code
29+
uses: actions/checkout@v6
30+
31+
- name: Checkout dependency repository (xengine)
32+
uses: actions/checkout@v6
33+
with:
34+
repository: libxengine/libxengine
35+
path: libxengine
36+
37+
- name: Set TERM variable
38+
run: echo "TERM=xterm" >> $GITHUB_ENV
39+
40+
- name: sub module checkout (opensource)
41+
run: |
42+
git submodule init
43+
git submodule update
44+
45+
- name: Set up Dependency ubuntu24.04 Environment
46+
run: |
47+
cd libxengine
48+
chmod 777 *
49+
sudo ./XEngine_LINEnv.sh -i 3
50+
51+
- name: make
52+
run: |
53+
cd XEngine_Source
54+
make
55+
make FLAGS=InstallAll
56+
make FLAGS=CleanAll
57+
58+
make RELEASE=1
59+
make FLAGS=InstallAll
60+
make FLAGS=CleanAll
61+
cd ..
62+
63+
- name: test
64+
run: |
65+
cd XEngine_Release
66+
./XEngine_CenterApp -t
67+
./XEngine_Http2App -t
68+
./XEngine_HttpApp -t
69+
./XEngine_SimpleApp -t
70+
./XEngine_WebSocketApp -t

‎.github/workflows/codeql-to-commit.yml‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
name: Auto Copilot Autofix (High & Medium Only)
2+
3+
on:
4+
workflow_dispatch:
5+
workflow_run:
6+
workflows: ["CodeQL Advanced"]
7+
types: [completed]
8+
9+
jobs:
10+
auto-fix:
11+
runs-on: ubuntu-latest
12+
if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
13+
permissions:
14+
security-events: read
15+
contents: write
16+
pull-requests: write
17+
18+
steps:
19+
- name: Trigger Autofix for High & Medium alerts
20+
env:
21+
GH_TOKEN: ${{ secrets.AUTOFIX_TOKEN }}
22+
OWNER: ${{ github.repository_owner }}
23+
REPO: ${{ github.event.repository.name }}
24+
run: |
25+
set +e
26+
DEFAULT_BRANCH=$(gh api /repos/$OWNER/$REPO --jq '.default_branch')
27+
echo "Default branch: $DEFAULT_BRANCH"
28+
29+
ALERTS=$(gh api "/repos/$OWNER/$REPO/code-scanning/alerts?state=open&per_page=100" \
30+
--jq '[.[] | select(.rule.security_severity_level == "high" or .rule.security_severity_level == "medium" or .rule.severity == "warning") | {number: .number, level: (.rule.security_severity_level // .rule.severity)}]')
31+
32+
COUNT=$(echo $ALERTS | jq 'length')
33+
echo "Found $COUNT alerts with high / medium / warning"
34+
echo "$ALERTS" | jq -r '.[] | " Alert #\(.number) [\(.level)]"'
35+
36+
if [ "$COUNT" -eq 0 ]; then
37+
echo "No alerts to process, exiting."
38+
exit 0
39+
fi
40+
41+
for ROW in $(echo $ALERTS | jq -r '.[] | @base64'); do
42+
_jq() { echo "$ROW" | base64 -d | jq -r "$1"; }
43+
44+
NUMBER=$(_jq '.number')
45+
SEC_LEVEL=$(_jq '.level')
46+
BRANCH="autofix/${SEC_LEVEL}/alert-${NUMBER}"
47+
48+
echo "--- Alert #$NUMBER [$SEC_LEVEL] ---"
49+
50+
# 检查是否已有 autofix
51+
EXISTING=$(gh api \
52+
/repos/$OWNER/$REPO/code-scanning/alerts/$NUMBER/autofix \
53+
--jq '.status' 2>/dev/null || echo "none")
54+
55+
if [ "$EXISTING" = "success" ]; then
56+
echo "✅ Fix already exists"
57+
else
58+
echo "⏳ Generating fix..."
59+
gh api -X POST \
60+
/repos/$OWNER/$REPO/code-scanning/alerts/$NUMBER/autofix || {
61+
echo "⚠️ Failed to trigger autofix for #$NUMBER, skipping"
62+
continue
63+
}
64+
65+
for i in 1 2 3; do
66+
sleep 30
67+
EXISTING=$(gh api \
68+
/repos/$OWNER/$REPO/code-scanning/alerts/$NUMBER/autofix \
69+
--jq '.status' 2>/dev/null || echo "none")
70+
echo " Attempt $i: status = $EXISTING"
71+
[ "$EXISTING" = "success" ] && break
72+
done
73+
fi
74+
75+
if [ "$EXISTING" != "success" ]; then
76+
echo "⚠️ Autofix not available for alert #$NUMBER (status: $EXISTING), skipping"
77+
continue
78+
fi
79+
80+
# 检查分支是否已存在
81+
BRANCH_STATUS=$(gh api \
82+
/repos/$OWNER/$REPO/git/refs/heads/$BRANCH \
83+
--silent 2>/dev/null && echo "exists" || echo "not_found")
84+
echo "DEBUG branch status: $BRANCH_STATUS"
85+
86+
if [ "$BRANCH_STATUS" = "not_found" ]; then
87+
# 创建分支
88+
SHA=$(gh api /repos/$OWNER/$REPO/git/refs/heads/$DEFAULT_BRANCH \
89+
--jq '.object.sha')
90+
91+
gh api -X POST /repos/$OWNER/$REPO/git/refs \
92+
-f ref="refs/heads/$BRANCH" \
93+
-f sha="$SHA" 2>/dev/null || true
94+
echo "🌿 Created branch: $BRANCH"
95+
96+
# 提交 fix
97+
COMMIT_RESULT=$(gh api -X POST \
98+
/repos/$OWNER/$REPO/code-scanning/alerts/$NUMBER/autofix/commits \
99+
-f target_ref="$BRANCH" 2>&1)
100+
echo "DEBUG commit result: $COMMIT_RESULT"
101+
102+
if echo "$COMMIT_RESULT" | grep -q "target_ref"; then
103+
echo "✅ Committed fix to branch: $BRANCH"
104+
else
105+
echo "⚠️ No code changes generated, deleting branch and skipping"
106+
gh api -X DELETE \
107+
/repos/$OWNER/$REPO/git/refs/heads/$BRANCH 2>/dev/null || true
108+
continue
109+
fi
110+
else
111+
# 分支已存在，检查是否已有 open PR
112+
EXISTING_PR=$(gh pr list \
113+
--repo "$OWNER/$REPO" \
114+
--head "$BRANCH" \
115+
--state open \
116+
--json number \
117+
--jq '.[0].number // empty')
118+
119+
if [ -n "$EXISTING_PR" ]; then
120+
echo "⏭️ PR #$EXISTING_PR already exists, skipping"
121+
continue
122+
fi
123+
124+
echo "🌿 Branch exists, creating PR with existing branch"
125+
fi
126+
127+
# 获取 alert 详情
128+
ALERT_INFO=$(gh api \
129+
/repos/$OWNER/$REPO/code-scanning/alerts/$NUMBER)
130+
131+
ALERT_TITLE=$(echo $ALERT_INFO | jq -r '.rule.description')
132+
ALERT_HELP=$(echo $ALERT_INFO | jq -r '.rule.help // "暂无详细说明"' | head -c 800)
133+
ALERT_TAGS=$(echo $ALERT_INFO | jq -r '.rule.tags // [] | join(", ")')
134+
ALERT_FILE=$(echo $ALERT_INFO | jq -r '.most_recent_instance.location.path // "未知文件"')
135+
ALERT_LINE=$(echo $ALERT_INFO | jq -r '.most_recent_instance.location.start_line // "未知行"')
136+
ALERT_URL=$(echo $ALERT_INFO | jq -r '.html_url')
137+
CWE_TAGS=$(echo $ALERT_INFO | jq -r '[.rule.tags[] | select(startswith("external/cwe/"))] | join(", ")')
138+
139+
AUTOFIX_DESC=$(gh api \
140+
/repos/$OWNER/$REPO/code-scanning/alerts/$NUMBER/autofix \
141+
--jq '.description // "暂无 AI 修复说明"')
142+
143+
# 创建 Draft PR
144+
gh pr create \
145+
--repo "$OWNER/$REPO" \
146+
--base "$DEFAULT_BRANCH" \
147+
--head "$BRANCH" \
148+
--draft \
149+
--title "[Autofix][$SEC_LEVEL] Alert #$NUMBER: $ALERT_TITLE" \
150+
--body "## 🤖 Copilot Autofix 自动修复报告
151+
152+
---
153+
154+
### 📋 基本信息
155+
156+
| 字段 | 内容 |
157+
|------|------|
158+
| **Alert ID** | [#$NUMBER]($ALERT_URL) |
159+
| **安全级别** | $SEC_LEVEL |
160+
| **规则名称** | $ALERT_TITLE |
161+
| **问题文件** | \`$ALERT_FILE\` 第 $ALERT_LINE 行 |
162+
| **CWE 分类** | $CWE_TAGS |
163+
| **规则标签** | $ALERT_TAGS |
164+
165+
---
166+
167+
### 🔍 问题说明
168+
169+
$ALERT_HELP
170+
171+
---
172+
173+
### 🤖 AI 修复思路
174+
175+
$AUTOFIX_DESC
176+
177+
---
178+
179+
### ✅ Review 检查清单
180+
181+
- [ ] 理解了漏洞的成因和影响范围
182+
- [ ] 确认 AI 修复逻辑正确，没有遗漏边界情况
183+
- [ ] 确认修复没有改变原有业务逻辑
184+
- [ ] 确认没有引入新的安全问题
185+
- [ ] CI / 单元测试全部通过
186+
- [ ] 如有必要，已补充对应的测试用例
187+
188+
---
189+
190+
> 此 PR 由 GitHub Copilot Autofix 自动生成，请仔细审核后再 merge。" && \
191+
echo "🎉 PR created for alert #$NUMBER" || \
192+
echo "❌ Failed to create PR for alert #$NUMBER"
193+
194+
done

‎.github/workflows/codeql.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,11 @@ jobs:
1919
matrix:
2020
include:
2121
- language: c-cpp
22+
build-mode: manual
2223
steps:
2324
- name: Checkout repository
2425
uses: actions/checkout@v6
25-
26+
2627
- name: Checkout dependency repository (xengine)
2728
uses: actions/checkout@v6
2829
with:
@@ -47,8 +48,11 @@ jobs:
4748
uses: github/codeql-action/init@v4
4849
with:
4950
languages: ${{ matrix.language }}
51+
build-mode: manual
52+
queries: security-and-quality
53+
config-file: .github/workflows/codeql/codeql-config.yml
5054

51-
- name: make
55+
- name: make build
5256
run: |
5357
cd XEngine_Source
5458
make

‎.github/workflows/codeql/codeql-config.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
name: "CodeQL Security Scan"
2+
3+
paths-ignore:
4+
- "XEngine_Source/XEngine_DependLibrary/**"

‎.github/workflows/cppcheck.yml‎

Lines changed: 0 additions & 35 deletions
This file was deleted.

0 commit comments

Comments
 (0)