From e63a4ea86b45abe657266159c10ae2be8140602a Mon Sep 17 00:00:00 2001 From: Gursimar Singh Date: Wed, 26 Nov 2025 22:01:53 +0530 Subject: [PATCH 1/5] adding CodeQL workflow --- .github/workflows/OCV-CodeQL.yaml | 85 +++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+) create mode 100644 .github/workflows/OCV-CodeQL.yaml diff --git a/.github/workflows/OCV-CodeQL.yaml b/.github/workflows/OCV-CodeQL.yaml new file mode 100644 index 00000000..63e24435 --- /dev/null +++ b/.github/workflows/OCV-CodeQL.yaml @@ -0,0 +1,85 @@ +name: OCV CodeQL + +on: + workflow_call: + inputs: + target_branch: + description: "Target branch (e.g. 4.x)" + required: true + type: string + workflow_branch: + description: "Branch for ci-gha-workflow repository" + default: "main" + required: false + type: string + +permissions: + contents: read + security-events: write + packages: read + actions: read + +jobs: + analyze: + name: Analyze + runs-on: opencv-cn-lin-x86-64 + container: + image: 'quay.io/opencv-ci/opencv-ubuntu-24.04:20241031' + volumes: + - /home/opencv-cn/git_cache:/opt/git_cache + - /home/opencv-cn/ci_cache/opencv:/opt/.ccache + - /home/opencv-cn/binaries_cache:/opt/binaries_cache + - /home/opencv-cn/dnn-models:/opt/dnn-models + + env: + ANT_HOME: '/usr/share/ant' + DNN_MODELS: '/opt/dnn-models' + CCACHE_DIR: '/opt/.ccache' + CCACHE_MAXSIZE: '3G' + OPENCV_DOWNLOAD_PATH: '/opt/binaries_cache' + CMAKE_OPT: >- + -DBUILD_DOCS=ON + -DBUILD_EXAMPLES=OFF + -DOPENCV_ENABLE_NONFREE=ON + HOME: '/home/ubuntu' + MAIN_BUILD_DIR: 'build' + + steps: + - name: Checkout workflow repository + uses: actions/checkout@v4 + with: + repository: opencv/ci-gha-workflow + ref: "${{ inputs.workflow_branch }}" + + - name: Checkout and merge OpenCV + uses: ./checkout-and-merge + with: + target_branch: "${{ inputs.target_branch }}" + author: "${{ github.event.pull_request.user.login }}" + source_branch: "${{ github.head_ref }}" + gitcache: '/opt/git_cache' + home: '${{ env.HOME }}' + workdir: '${{ env.HOME }}' + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: c-cpp + build-mode: manual + queries: security-extended,security-and-quality + + - name: Configure and build OpenCV + uses: ./configure-and-build + with: + workdir: '${{ env.HOME }}' + builddir: 'build' + generator: 'Ninja' + options: '${{ env.CMAKE_OPT }}' + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:c-cpp" + + + From 6a06578f9b99f816921bd5a495ee9726ed4f7665 Mon Sep 17 00:00:00 2001 From: Alexander Smorkalov Date: Thu, 27 Nov 2025 08:53:31 +0300 Subject: [PATCH 2/5] Trigger CodeQL pipeline in CI changes too. --- .github/workflows/OCV-CodeQL.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/OCV-CodeQL.yaml b/.github/workflows/OCV-CodeQL.yaml index 63e24435..f5db97ff 100644 --- a/.github/workflows/OCV-CodeQL.yaml +++ b/.github/workflows/OCV-CodeQL.yaml @@ -1,6 +1,11 @@ name: OCV CodeQL on: + pull_request: + branches: + - main + paths: + - '.github/workflows/OCV-CodeQL.yaml' workflow_call: inputs: target_branch: From 20c5fc51e3238824afbc5779c075a220874f3365 Mon Sep 17 00:00:00 2001 From: Alexander Smorkalov Date: Thu, 27 Nov 2025 16:14:58 +0300 Subject: [PATCH 3/5] Try to fix checkout. --- .github/workflows/OCV-CodeQL.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/OCV-CodeQL.yaml b/.github/workflows/OCV-CodeQL.yaml index f5db97ff..7a077745 100644 --- a/.github/workflows/OCV-CodeQL.yaml +++ b/.github/workflows/OCV-CodeQL.yaml @@ -61,7 +61,7 @@ jobs: with: target_branch: "${{ inputs.target_branch }}" author: "${{ github.event.pull_request.user.login }}" - source_branch: "${{ github.head_ref }}" + source_branch: "${{ github.event.repository.name == 'ci-gha- workflow' && '' || github.head_ref }}" gitcache: '/opt/git_cache' home: '${{ env.HOME }}' workdir: '${{ env.HOME }}' From ad45e1aa1572c6399fd8a28049dc21ff90e63122 Mon Sep 17 00:00:00 2001 From: Alexander Smorkalov Date: Thu, 27 Nov 2025 17:53:07 +0300 Subject: [PATCH 4/5] Another checkout fix. --- .github/workflows/OCV-CodeQL.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/OCV-CodeQL.yaml b/.github/workflows/OCV-CodeQL.yaml index 7a077745..206bb626 100644 --- a/.github/workflows/OCV-CodeQL.yaml +++ b/.github/workflows/OCV-CodeQL.yaml @@ -59,9 +59,10 @@ jobs: - name: Checkout and merge OpenCV uses: ./checkout-and-merge with: - target_branch: "${{ inputs.target_branch }}" + repos: main + target_branch: ${{ github.event.repository.name == 'ci-gha-workflow' && '4.x' || inputs.target_branch }}" author: "${{ github.event.pull_request.user.login }}" - source_branch: "${{ github.event.repository.name == 'ci-gha- workflow' && '' || github.head_ref }}" + source_branch: "${{ github.event.repository.name == 'ci-gha-workflow' && '' || github.head_ref }}" gitcache: '/opt/git_cache' home: '${{ env.HOME }}' workdir: '${{ env.HOME }}' From 7455d198f89bd4db6ced319a15d68da6bdd89ea4 Mon Sep 17 00:00:00 2001 From: Alexander Smorkalov Date: Thu, 27 Nov 2025 18:01:35 +0300 Subject: [PATCH 5/5] Syntax fix. --- .github/workflows/OCV-CodeQL.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/OCV-CodeQL.yaml b/.github/workflows/OCV-CodeQL.yaml index 206bb626..866659da 100644 --- a/.github/workflows/OCV-CodeQL.yaml +++ b/.github/workflows/OCV-CodeQL.yaml @@ -60,7 +60,7 @@ jobs: uses: ./checkout-and-merge with: repos: main - target_branch: ${{ github.event.repository.name == 'ci-gha-workflow' && '4.x' || inputs.target_branch }}" + target_branch: "${{ github.event.repository.name == 'ci-gha-workflow' && '4.x' || inputs.target_branch }}" author: "${{ github.event.pull_request.user.login }}" source_branch: "${{ github.event.repository.name == 'ci-gha-workflow' && '' || github.head_ref }}" gitcache: '/opt/git_cache'