[Superseded] Engineering foundation work archive

.github/workflows/codeql-analysis.yml

@@ -1,74 +1,116 @@
 name: CodeQL
-
 on:
-  push:
-    branches: [main]
+  workflow_call:
   schedule:
-    # Run weekly on Mondays at 06:00 UTC to catch new CVE patterns
     - cron: '0 6 * * 1'
   workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 permissions:
   actions: read
   contents: read
   security-events: write
 
 jobs:
   analyze:
-    name: CodeQL Analysis
+    name: CodeQL (${{ matrix.language }})
     runs-on: ubuntu-latest
     container: debian:sid-slim
-    timeout-minutes: 45
-
+    timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:
-        language: ['c-cpp']
-
+        include:
+          - language: c-cpp
+            scanner: codeql-cpp
+            build-mode: manual
+            suite: codeql/cpp-queries:codeql-suites/cpp-security-extended.qls
+          - language: javascript-typescript
+            scanner: codeql-javascript-typescript
+            build-mode: none
+            suite: codeql/javascript-queries:codeql-suites/javascript-security-extended.qls
+    defaults:
+      run:
+        shell: bash
+    env:
+      REPORT_DIR: build/analysis/${{ matrix.scanner }}
+      SCANNER_ID: ${{ matrix.scanner }}
+      LANGUAGE: ${{ matrix.language }}
+      QUERY_SUITE: ${{ matrix.suite }}
+      SPEC_FILE: build/codeql-spec.json
     steps:
       - name: Install build dependencies
         run: |
           apt-get update
-          apt-get install -y \
-            git build-essential cmake pkg-config \
+          apt-get install -y git python3 build-essential cmake pkg-config \
             libavcodec-dev libavformat-dev libavutil-dev libswscale-dev libavfilter-dev \
             libsqlite3-dev libuv1-dev libllhttp-dev libcurl4-openssl-dev \
             libcjson-dev libmbedtls-dev libmosquitto-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
+      - uses: actions/checkout@v6
         with:
           submodules: false
-
-      - name: Checkout FAAC submodule
-        run: |
-          # Keep optional go2rtc/LiteRT sources out of these builds.
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git submodule update --init --depth 1 third_party/faac
-
       - name: Initialize CodeQL
+        id: init
         uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
-          # Use extended queries for more thorough security analysis
+          build-mode: ${{ matrix.build-mode }}
+          db-location: ${{ github.workspace }}/build/eng-codeql
           queries: security-extended
-
-      - name: Build for CodeQL
+      - name: Build explicit native analysis profile
+        if: matrix.language == 'c-cpp'
         run: |
-          mkdir -p build && cd build
-          cmake .. \
-            -DCMAKE_BUILD_TYPE=Release \
-            -DENABLE_SOD=OFF \
-            -DENABLE_GO2RTC=OFF \
-            -DBUILD_TESTS=OFF
-          make -j$(nproc)
-
-      - name: Perform CodeQL Analysis
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git submodule update --init --depth 1 third_party/faac
+          cmake -S . -B build/codeql-native -DCMAKE_BUILD_TYPE=Release \
+            -DENABLE_SOD=OFF -DENABLE_GO2RTC=OFF -DENABLE_LITERT=OFF \
+            -DENABLE_SENTRY=OFF -DENABLE_SSL=OFF -DENABLE_MQTT=ON -DBUILD_TESTS=OFF
+          cmake --build build/codeql-native --parallel 2
+      - name: Finalize extracted databases without running queries
+        id: finalize
         uses: github/codeql-action/analyze@v4
         with:
-          category: "/language:${{ matrix.language }}"
-
+          skip-queries: true
+          upload: never
+      - name: Generate CodeQL scanner specification
+        env:
+          CODEQL_BIN: ${{ steps.init.outputs.codeql-path }}
+          CODEQL_DATABASES: ${{ steps.finalize.outputs.db-locations }}
+        run: |
+          python3 - <<'PY'
+          import json, os
+          from pathlib import Path
+          databases = json.loads(os.environ['CODEQL_DATABASES'])
+          if len(databases) != 1: raise ValueError('Expected exactly one extracted language database')
+          database = Path(next(iter(databases.values()))).resolve()
+          archive = (database / 'src.zip').relative_to(Path.cwd()).as_posix()
+          report = os.environ['SCANNER_ID'] + '.sarif'
+          spec = {'scanner_id':os.environ['SCANNER_ID'], 'version_command':[os.environ['CODEQL_BIN'],'version'],
+            'commands':[{'argv':[os.environ['CODEQL_BIN'],'database','analyze',str(database),os.environ['QUERY_SUITE'],
+              '--download','--format=sarif-latest','--output=' + str(Path.cwd() / os.environ['REPORT_DIR'] / report),
+              '--sarif-category=/language:' + os.environ['LANGUAGE'],'--sarif-add-baseline-file-info'],
+              'reports':[report], 'timeout_seconds':2700}],
+            'scope':{'kind':'codeql-source-archive','archive':archive}}
+          if os.environ['LANGUAGE'] == 'c-cpp':
+            spec['faac'] = {
+              'provenance':'build/codeql-native/_deps/lightnvr-faac/provenance.json',
+              'compile_commands':'build/codeql-native/compile_commands.json'}
+          Path(os.environ['SPEC_FILE']).parent.mkdir(parents=True,exist_ok=True)
+          Path(os.environ['SPEC_FILE']).write_text(json.dumps(spec))
+          PY
+      - name: Run CodeQL queries with actual exit and archive provenance
+        run: python3 scripts/quality/scanner_run.py --spec "$SPEC_FILE" --reports "$REPORT_DIR" --expected-revision "$GITHUB_SHA"
+      - name: Check scoped CodeQL findings
+        if: always()
+        run: python3 scripts/quality/findings_lane.py --scanner "$SCANNER_ID" --reports "$REPORT_DIR" --expected-revision "$GITHUB_SHA" --json-out "$REPORT_DIR/lane-result.json"
+      - name: Upload available SARIF to code scanning
+        if: always() && hashFiles(format('{0}/*.sarif', env.REPORT_DIR)) != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: ${{ env.REPORT_DIR }}/${{ matrix.scanner }}.sarif
+          category: /language:${{ matrix.language }}
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: analysis-${{ matrix.scanner }}
+          path: ${{ env.REPORT_DIR }}
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/container-scan.yml

@@ -1,32 +1,25 @@
 name: Container Security Scan
-
 on:
+  workflow_call:
   push:
-    branches: [main]
-    tags:
-      - '*.*.*'
+    tags: ['*.*.*']
   workflow_dispatch:
-
 permissions:
   contents: read
   security-events: write
-
 jobs:
   trivy:
     name: Trivy Container Scan
     runs-on: ubuntu-latest
-    timeout-minutes: 30
-
+    timeout-minutes: 45
+    env:
+      REPORT_DIR: build/analysis/trivy
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
+      - uses: actions/checkout@v6
         with:
           submodules: recursive
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Build Docker image for scanning
+      - uses: docker/setup-buildx-action@v4
+      - name: Build local image for analysis
         uses: docker/build-push-action@v7
         with:
           context: .
@@ -36,46 +29,43 @@ jobs:
           tags: lightnvr:scan
           build-args: |
             GIT_COMMIT=${{ github.sha }}
-
-      - name: Install Trivy
+      - name: Install Trivy and fetch vulnerability database
         run: |
           sudo apt-get update
           sudo apt-get install -y wget apt-transport-https gnupg
           wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
-          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee /etc/apt/sources.list.d/trivy.list
+          echo 'deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main' | sudo tee /etc/apt/sources.list.d/trivy.list
           sudo apt-get update
           sudo apt-get install -y trivy
-
-      - name: Run Trivy vulnerability scanner (SARIF)
-        id: trivy-sarif
+          trivy image --download-db-only
+      - name: Capture Trivy report, image identity and database metadata
         run: |
-          trivy image \
-            --format sarif \
-            --output trivy-results.sarif \
-            --severity CRITICAL,HIGH,MEDIUM \
-            --exit-code 0 \
-            lightnvr:scan
-
-      - name: Upload Trivy SARIF to GitHub Security tab
+          python3 - <<'PY'
+          import json, os
+          from pathlib import Path
+          spec = {'scanner_id':'trivy-container', 'version_command':['trivy','version','--format','json'], 'version_format':'trivy-json',
+            'commands':[{'argv':['trivy','image','--scanners','vuln','--format','sarif',
+              '--output',str(Path.cwd() / os.environ['REPORT_DIR'] / 'trivy-results.sarif'),
+              '--skip-db-update','--severity','CRITICAL,HIGH,MEDIUM','--exit-code','2','lightnvr:scan'],
+              'reports':['trivy-results.sarif'],'accepted_exit_codes':[0,2],'timeout_seconds':1800}],
+            'scope':{'kind':'image','report':'trivy-results.sarif'}}
+          Path('build').mkdir(exist_ok=True)
+          Path('build/trivy-spec.json').write_text(json.dumps(spec))
+          PY
+          python3 scripts/quality/scanner_run.py --spec build/trivy-spec.json --reports "$REPORT_DIR" --expected-revision "$GITHUB_SHA"
+      - name: Check scoped container findings
+        if: always()
+        run: python3 scripts/quality/findings_lane.py --scanner trivy-container --reports "$REPORT_DIR" --expected-revision "$GITHUB_SHA" --json-out "$REPORT_DIR/lane-result.json"
+      - name: Upload available SARIF to code scanning
         uses: github/codeql-action/upload-sarif@v4
-        if: always() && steps.trivy-sarif.outcome == 'success'
+        if: always() && hashFiles(format('{0}/trivy-results.sarif', env.REPORT_DIR)) != ''
         with:
-          sarif_file: 'trivy-results.sarif'
-          category: 'container-scanning'
-
-      - name: Run Trivy (table output for logs)
-        if: always() && steps.trivy-sarif.outcome == 'success'
-        run: |
-          trivy image \
-            --format table \
-            --severity CRITICAL,HIGH \
-            --exit-code 0 \
-            lightnvr:scan
-
-      - name: Upload Trivy report
-        uses: actions/upload-artifact@v7
-        if: always() && steps.trivy-sarif.outcome == 'success'
+          sarif_file: ${{ env.REPORT_DIR }}/trivy-results.sarif
+          category: container-scanning
+      - uses: actions/upload-artifact@v7
+        if: always()
         with:
-          name: trivy-scan-results
-          path: trivy-results.sarif
+          name: analysis-trivy
+          path: ${{ env.REPORT_DIR }}
+          if-no-files-found: error
           retention-days: 30