Skip to content

CI: Resolve CodeQL concerns #160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
derobins merged 3 commits into from
Jan 20, 2026
Merged

CI: Resolve CodeQL concerns #160

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0727b13
CI: Move job envvar to workflow level.
riley-dixon Jan 19, 2026
dff9289
CI: Redirect Input & Matrix variables into Environment
riley-dixon Jan 19, 2026
cd83220
CI: Security harden strings using AIS variables
riley-dixon Jan 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 9 additions & 10 deletions .github/workflows/build-ais-ci-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
name: new_CI_image
run-name: Build the Docker image for AIS CI.
env:
AIS_CI_IMAGE_NAME: ais_ci_${{ inputs.platform }}
AIS_DOCKER_REGISTRY: ghcr.io/rocm/hipfile
AIS_PR_BASE_URL: https://github.com/ROCm/hipFile/pull
on:
Expand Down Expand Up @@ -51,8 +52,6 @@ permissions:
jobs:
build_AIS_image:
if: ${{ inputs.dockerfile_changed }}
env:
AIS_CI_IMAGE_NAME: ais_ci_${{ inputs.platform }}
runs-on: [ubuntu-24.04]
container: docker:28.5
outputs:
Expand All @@ -65,9 +64,9 @@ jobs:
- name: Set target AIS CI Image
id: ci-image
run: |
echo "AIS_CI_IMAGE=${{ env.AIS_DOCKER_REGISTRY }}/${{ env.AIS_CI_IMAGE_NAME}}:${AIS_CI_IMAGE_TAG}" \
echo "AIS_CI_IMAGE=${AIS_DOCKER_REGISTRY}/${AIS_CI_IMAGE_NAME}:${AIS_CI_IMAGE_TAG}" \
>> "${GITHUB_OUTPUT}"
echo "AIS_CI_LATEST_CACHE=${{ env.AIS_DOCKER_REGISTRY }}/${{ env.AIS_CI_IMAGE_NAME}}:latest-cache" \
echo "AIS_CI_LATEST_CACHE=${AIS_DOCKER_REGISTRY}/${AIS_CI_IMAGE_NAME}:latest-cache" \
>> "${GITHUB_OUTPUT}"
- name: Fetching code repository...
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
Expand All @@ -86,14 +85,14 @@ jobs:
- name: Build base image for AIS CI
run: |
docker buildx build \
-f ${GITHUB_WORKSPACE}/util/docker/DOCKERFILE.${{ env.AIS_CI_IMAGE_NAME }} \
-f "${GITHUB_WORKSPACE}/util/docker/DOCKERFILE.${AIS_CI_IMAGE_NAME}" \
--label "org.opencontainers.image.description= \
${{ env.AIS_CI_IMAGE_NAME }} Development Image for AIS CI using branch \
${AIS_CI_IMAGE_NAME} Development Image for AIS CI using branch \
${{ github.head_ref }} for PR #${AIS_PR_NUMBER}. \
PR URL: ${{ env.AIS_PR_BASE_URL }}/${AIS_PR_NUMBER}" \
PR URL: ${AIS_PR_BASE_URL}/${AIS_PR_NUMBER}" \
--build-arg BUILDKIT_INLINE_CACHE=1 \
--cache-from=type=registry,ref=${{ steps.ci-image.outputs.AIS_CI_IMAGE }} \
--cache-from=type=registry,ref=${{ steps.ci-image.outputs.AIS_CI_LATEST_CACHE }} \
--cache-from=type=registry,ref="${{ steps.ci-image.outputs.AIS_CI_IMAGE }}" \
--cache-from=type=registry,ref="${{ steps.ci-image.outputs.AIS_CI_LATEST_CACHE }}" \
--push \
-t ${{ steps.ci-image.outputs.AIS_CI_IMAGE }} \
-t "${{ steps.ci-image.outputs.AIS_CI_IMAGE }}" \
${GITHUB_WORKSPACE}
29 changes: 17 additions & 12 deletions .github/workflows/build-ais-nvidia.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
name: build_ais_nvidia
run-name: Build AIS for Nvidia platforms
env:
AIS_INPUT_CI_IMAGE: ${{ inputs.ci_image }}
AIS_INPUT_PLATFORM: ${{ inputs.platform }}
AIS_MOUNT_PATH: /mnt/ais/ext4
on:
workflow_call:
Expand All @@ -16,6 +18,8 @@ permissions:
packages: read
jobs:
compile_on_NVIDIA:
env:
AIS_INPUT_CXX_COMPILER: ${{ matrix.supported_compilers }}
runs-on: [ubuntu-24.04]
strategy:
fail-fast: false
Expand All @@ -27,10 +31,10 @@ jobs:
- name: Set early AIS CI environment variables
run: |
echo "AIS_PR_NUMBER=$(echo ${{ github.ref }} | sed 's|[^0-9]||g')" >> "${GITHUB_ENV}"
echo "AIS_SAFE_COMPILER_NAME=$(echo ${{ matrix.supported_compilers }} | sed 's|[\+]|plus|g')" >> "${GITHUB_ENV}"
echo "AIS_SAFE_COMPILER_NAME=$(echo ${AIS_INPUT_CXX_COMPILER} | sed 's|[\+]|plus|g')" >> "${GITHUB_ENV}"
- name: Set AIS CI container name
run: |
echo "AIS_CONTAINER_NAME=${AIS_PR_NUMBER}_${{ github.job }}_${{ inputs.platform }}_${AIS_SAFE_COMPILER_NAME}" >> "${GITHUB_ENV}"
echo "AIS_CONTAINER_NAME=${AIS_PR_NUMBER}_${{ github.job }}_${AIS_INPUT_PLATFORM}_${AIS_SAFE_COMPILER_NAME}" >> "${GITHUB_ENV}"
- name: Fetching code repository...
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
with:
Expand All @@ -51,27 +55,28 @@ jobs:
--rm \
--pull always \
-v ${GITHUB_WORKSPACE}:/mnt/ais:ro \
-v ${{ env.AIS_MOUNT_PATH }}:/mnt/ais-fs \
--name ${AIS_CONTAINER_NAME} \
${{ inputs.ci_image }}
-v "${AIS_MOUNT_PATH}:/mnt/ais-fs" \
--name "${AIS_CONTAINER_NAME}" \
"${AIS_INPUT_CI_IMAGE}"
- name: Make copy of the code repository and create build directories
run: |
docker exec \
-t \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
cp -R /mnt/ais /ais
mkdir /ais/hipFile/build
'
- name: Generate build files for hipFile targeting the NVIDIA platform (${{ matrix.supported_compilers }})
run: |
docker exec \
-e "_AIS_INPUT_CXX_COMPILER=${AIS_INPUT_CXX_COMPILER}" \
-t \
-w /ais/hipFile/build \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
cmake \
-DCMAKE_CXX_COMPILER=${{ matrix.supported_compilers }} \
-DCMAKE_CXX_COMPILER="${_AIS_INPUT_CXX_COMPILER}" \
-DCMAKE_CXX_FLAGS="-Werror" \
-DCMAKE_HIP_PLATFORM=nvidia \
-DAIS_BUILD_DOCS=ON \
Expand All @@ -82,7 +87,7 @@ jobs:
docker exec \
-t \
-w /ais/hipFile/build \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
cmake --build . --parallel
'
Expand All @@ -91,17 +96,17 @@ jobs:
docker exec \
-t \
-w /ais/hipFile \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
rm -rf build/*
'
- name: Cleanup & Stop the Docker container
if: ${{ always() }}
run: |
docker stop ${AIS_CONTAINER_NAME}
docker stop "${AIS_CONTAINER_NAME}"
### Disable until NVIDIA runners come back
# Run_hipFile_NVIDIA:
# uses: ./.github/workflows/hipfile-nvidia.yml
# needs: build_AIS_image
# with:
# platform: ${{inputs.platform}}
# platform: ${AIS_INPUT_PLATFORM}
62 changes: 34 additions & 28 deletions .github/workflows/build-ais.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,10 @@ name: build_and_test
run-name: Build, Test, and Analyze AIS
env:
AIS_GHA_CMD_FILES_DOCKER_DIR: /root/github
AIS_INPUT_CI_IMAGE: ${{ inputs.ci_image }}
AIS_INPUT_CXX_COMPILER: ${{ inputs.cxx_compiler }}
AIS_INPUT_PLATFORM: ${{ inputs.platform }}
AIS_INPUT_UPLOAD_ARTIFACTS: ${{ inputs.upload_artifacts }}
AIS_MOUNT_PATH: /mnt/ais/ext4
AIS_PKG_MGR: >-
${{
Expand Down Expand Up @@ -57,11 +61,11 @@ jobs:
run: |
echo "AIS_PR_NUMBER=$(echo ${{ github.ref }} | sed 's|[^0-9]||g')" >> "${GITHUB_ENV}"
echo "AIS_GHA_CMD_FILES_DIR=${GITHUB_ENV%/*}" >> "${GITHUB_ENV}"
echo "AIS_SAFE_COMPILER_NAME=$(echo ${{ inputs.cxx_compiler}} | sed 's|[\+]|plus|g')" >> "${GITHUB_ENV}"
echo "AIS_SAFE_COMPILER_NAME=$(echo ${AIS_INPUT_CXX_COMPILER} | sed 's|[\+]|plus|g')" >> "${GITHUB_ENV}"
- name: Set AIS CI container name
# We should expect that there are multiple instances of this job with different cxx_compilers.
run: |
echo "AIS_CONTAINER_NAME=${AIS_PR_NUMBER}_${{ github.job }}_${{ inputs.platform }}_${AIS_SAFE_COMPILER_NAME}" >> "${GITHUB_ENV}"
echo "AIS_CONTAINER_NAME=${AIS_PR_NUMBER}_${{ github.job }}_${AIS_INPUT_PLATFORM}_${AIS_SAFE_COMPILER_NAME}" >> "${GITHUB_ENV}"
- name: Fetching code repository...
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
with:
Expand All @@ -82,30 +86,31 @@ jobs:
--rm \
--pull always \
-v ${GITHUB_WORKSPACE}:/mnt/ais:ro \
-v "${AIS_GHA_CMD_FILES_DIR}:${{ env.AIS_GHA_CMD_FILES_DOCKER_DIR }}" \
-v ${{ env.AIS_MOUNT_PATH }}:/mnt/ais-fs \
--name ${AIS_CONTAINER_NAME} \
${{ inputs.ci_image }}
-v "${AIS_GHA_CMD_FILES_DIR}:${AIS_GHA_CMD_FILES_DOCKER_DIR}" \
-v "${AIS_MOUNT_PATH}:/mnt/ais-fs" \
--name "${AIS_CONTAINER_NAME}" \
"${AIS_INPUT_CI_IMAGE}"
- name: Make copy of the code repository and create build directories
# Single quotes necessary to ensure string/command substitutions happen
# in the container and not on the host.
run: |
docker exec \
-t \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
cp -R /mnt/ais /ais
mkdir /ais/hipFile/build
'
- name: Generate build files for hipFile targeting the AMD platform (${{ inputs.cxx_compiler }})
run: |
docker exec \
-e "_AIS_INPUT_CXX_COMPILER=${AIS_INPUT_CXX_COMPILER}" \
-t \
-w /ais/hipFile/build \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
cmake \
-DCMAKE_CXX_COMPILER=${{ inputs.cxx_compiler }} \
-DCMAKE_CXX_COMPILER="${_AIS_INPUT_CXX_COMPILER}" \
-DCMAKE_CXX_FLAGS="-Werror" \
-DCMAKE_HIP_PLATFORM=amd \
-DAIS_BUILD_DOCS=ON \
Expand All @@ -117,7 +122,7 @@ jobs:
docker exec \
-t \
-w /ais/hipFile/build \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
cmake --build . --parallel
'
Expand All @@ -126,7 +131,7 @@ jobs:
docker exec \
-t \
-w /ais/hipFile/build \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
ctest -V -L "unit" --parallel
'
Expand All @@ -136,7 +141,7 @@ jobs:
docker exec \
-t \
-w /ais/hipFile/build \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
export PATH="/opt/rocm/llvm/bin:${PATH}"
../util/llvm-coverage.sh
Expand All @@ -148,11 +153,12 @@ jobs:
- name: Create hipFile package
run: |
docker exec \
-e "_AIS_PKG_TYPE=${AIS_PKG_TYPE}" \
-t \
-w /ais/hipFile/build \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
cpack -G ${{ env.AIS_PKG_TYPE }}
cpack -G "${_AIS_PKG_TYPE}"
'
# CI is unable to peer into CMake to capture this data ahead of time.
# We should only produce a single package so we can use a glob pattern
Expand All @@ -166,7 +172,7 @@ jobs:
-e "AIS_GITHUB_OUTPUT=${{ env.AIS_GHA_CMD_FILES_DOCKER_DIR }}/${GITHUB_OUTPUT##*/}" \
-t \
-w /ais/hipFile/build \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
shopt -s nullglob
AIS_HIPFILE_PKG_DEV_FILENAME="$(echo hipfile-de{v,vel}{-,_}[0-9]*.{deb,rpm})"
Expand All @@ -176,8 +182,8 @@ jobs:
echo "AIS_HIPFILE_PKG_VERSION=$(
${{
env.AIS_PKG_TYPE == 'DEB' &&
'dpkg-deb -f ${AIS_HIPFILE_PKG_FILENAME} "Version"' ||
'rpm -qp --qf "%{VERSION}" ${AIS_HIPFILE_PKG_FILENAME}'
'dpkg-deb -f "${AIS_HIPFILE_PKG_FILENAME}" "Version"' ||
'rpm -qp --qf "%{VERSION}" "${AIS_HIPFILE_PKG_FILENAME}"'
}}
)" >> "${AIS_GITHUB_OUTPUT}"
'
Expand All @@ -187,23 +193,23 @@ jobs:
docker exec \
-t \
-w /ais/hipFile/build \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
echo "Runtime Package:"
${{
format(
env.AIS_PKG_TYPE == 'DEB' &&
'dpkg-deb -I {0} && dpkg-deb -c {0}' ||
'rpm -qpil --requires {0}',
'dpkg-deb -I "{0}" && dpkg-deb -c "{0}"' ||
'rpm -qpil --requires "{0}"',
steps.pkg-metadata.outputs.AIS_HIPFILE_PKG_FILENAME
)
}}
echo -e "\n\nDevelopment Package:"
${{
format(
env.AIS_PKG_TYPE == 'DEB' &&
'dpkg-deb -I {0} && dpkg-deb -c {0}' ||
'rpm -qpil --requires {0}',
'dpkg-deb -I "{0}" && dpkg-deb -c "{0}"' ||
'rpm -qpil --requires "{0}"',
steps.pkg-metadata.outputs.AIS_HIPFILE_PKG_DEV_FILENAME
)
}}
Expand All @@ -219,13 +225,13 @@ jobs:
docker exec \
-t \
-w /ais/hipFile/build \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
${{
format(
env.AIS_PKG_MGR == 'apt' && 'apt install -y ./{0} ./{1}' ||
env.AIS_PKG_MGR == 'dnf' && 'dnf install -y ./{0} ./{1}' ||
env.AIS_PKG_MGR == 'zypper' && 'zypper install -y --allow-unsigned-rpm ./{0} ./{1}' ||
env.AIS_PKG_MGR == 'apt' && 'apt install -y "./{0}" "./{1}"' ||
env.AIS_PKG_MGR == 'dnf' && 'dnf install -y "./{0}" "./{1}"' ||
env.AIS_PKG_MGR == 'zypper' && 'zypper install -y --allow-unsigned-rpm "./{0}" "./{1}"' ||
'echo "Unknown platform."; exit 1',
steps.pkg-metadata.outputs.AIS_HIPFILE_PKG_DEV_FILENAME,
steps.pkg-metadata.outputs.AIS_HIPFILE_PKG_FILENAME
Expand Down Expand Up @@ -282,11 +288,11 @@ jobs:
docker exec \
-t \
-w /ais/hipFile \
${AIS_CONTAINER_NAME} \
"${AIS_CONTAINER_NAME}" \
/bin/bash -c '
rm -rf build/*
'
- name: Cleanup & Stop the Docker container
if: ${{ always() }}
run: |
docker stop ${AIS_CONTAINER_NAME}
docker stop "${AIS_CONTAINER_NAME}"
Loading