From 7d24bb351faeefbb00b5e4a587a75242e8699ef7 Mon Sep 17 00:00:00 2001 From: konard Date: Fri, 12 Sep 2025 20:29:34 +0300 Subject: [PATCH 1/5] Initial commit with task details for issue #139 Adding CLAUDE.md with task information for AI processing. This file will be removed when the task is complete. Issue: https://github.com/linksplatform/Interfaces/issues/139 --- CLAUDE.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 CLAUDE.md diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 00000000..6ce7f85d --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,5 @@ +Issue to solve: https://github.com/linksplatform/Interfaces/issues/139 +Your prepared branch: issue-139-6bab94f7 +Your prepared working directory: /tmp/gh-issue-solver-1757698169243 + +Proceed. \ No newline at end of file From c488101ab89e0986ee7b91d7877a3f2e02bc725a Mon Sep 17 00:00:00 2001 From: konard Date: Fri, 12 Sep 2025 20:32:25 +0300 Subject: [PATCH 2/5] Add CodeQL badge and workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This commit adds: - CodeQL security analysis workflow for C# and C++ languages - CodeQL badge to README.md displaying security analysis status - Scheduled weekly scans and analysis on pull requests 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude --- .github/workflows/codeql.yml | 69 ++++++++++++++++++++++++++++++++++++ README.md | 1 + 2 files changed, 70 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..d100c2d7 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,69 @@ +name: "CodeQL" + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '43 3 * * 0' + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + timeout-minutes: 360 + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: [ 'cpp', 'csharp' ] + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + submodules: true + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + queries: security-extended,security-and-quality + + - name: Setup .NET (for C# analysis) + if: matrix.language == 'csharp' + uses: actions/setup-dotnet@v4 + with: + dotnet-version: '8.0.x' + + - name: Build C# + if: matrix.language == 'csharp' + run: | + cd csharp + dotnet restore + dotnet build -c Release + + - name: Install dependencies (for C++ analysis) + if: matrix.language == 'cpp' + run: | + sudo apt-get update + sudo apt-get install -y cmake build-essential + + - name: Build C++ + if: matrix.language == 'cpp' + run: | + cd cpp + mkdir -p build + cd build + cmake .. + make + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" \ No newline at end of file diff --git a/README.md b/README.md index f24c3db9..67ecbb58 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,7 @@ [![Codacy Badge](https://api.codacy.com/project/badge/Grade/93857535a2214ba9b512e1a88787d461)](https://app.codacy.com/gh/linksplatform/Interfaces?utm_source=github.com&utm_medium=referral&utm_content=linksplatform/Interfaces&utm_campaign=Badge_Grade_Settings) [![CodeFactor](https://www.codefactor.io/repository/github/linksplatform/interfaces/badge)](https://www.codefactor.io/repository/github/linksplatform/interfaces) +[![CodeQL](https://github.com/linksplatform/Interfaces/actions/workflows/codeql.yml/badge.svg)](https://github.com/linksplatform/Interfaces/actions/workflows/codeql.yml) | [![Actions Status](https://github.com/linksplatform/Interfaces/workflows/deploy-cpp/badge.svg)](https://github.com/linksplatform/Interfaces/actions?workflow=deploy-cpp) | [![NuGet Version and Downloads count](https://img.shields.io/nuget/v/Platform.Interfaces.TemplateLibrary?label=nuget&style=flat)](https://www.nuget.org/packages/Platform.Interfaces.TemplateLibrary) [![ConanCenter package](https://repology.org/badge/version-for-repo/conancenter/platform.interfaces.svg)](https://conan.io/center/platform.interfaces) | __C++__ | |-|-|-| From 081e1a7bc151912e36cbd983466ce4355c0a0d9d Mon Sep 17 00:00:00 2001 From: konard Date: Fri, 12 Sep 2025 20:33:16 +0300 Subject: [PATCH 3/5] Remove CLAUDE.md - Claude command completed --- CLAUDE.md | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 CLAUDE.md diff --git a/CLAUDE.md b/CLAUDE.md deleted file mode 100644 index 6ce7f85d..00000000 --- a/CLAUDE.md +++ /dev/null @@ -1,5 +0,0 @@ -Issue to solve: https://github.com/linksplatform/Interfaces/issues/139 -Your prepared branch: issue-139-6bab94f7 -Your prepared working directory: /tmp/gh-issue-solver-1757698169243 - -Proceed. \ No newline at end of file From 1c7fb7563b972622dde4aedd393d82b024079479 Mon Sep 17 00:00:00 2001 From: konard Date: Sun, 20 Sep 2026 07:56:58 +0000 Subject: [PATCH 4/5] Fix and validate CodeQL analysis workflow --- .../scripts/codeql-workflow-policy.test.mjs | 39 +++++++++++++++++++ .github/workflows/codeql.yml | 38 ++++++++++-------- 2 files changed, 60 insertions(+), 17 deletions(-) create mode 100644 .github/scripts/codeql-workflow-policy.test.mjs diff --git a/.github/scripts/codeql-workflow-policy.test.mjs b/.github/scripts/codeql-workflow-policy.test.mjs new file mode 100644 index 00000000..74d4f7cc --- /dev/null +++ b/.github/scripts/codeql-workflow-policy.test.mjs @@ -0,0 +1,39 @@ +#!/usr/bin/env node + +import assert from "node:assert/strict"; +import { readFileSync } from "node:fs"; +import test from "node:test"; + +const workflowPath = new URL("../workflows/codeql.yml", import.meta.url); +const workflow = readFileSync(workflowPath, "utf8"); + +test("uses current CodeQL language identifiers and an explicit manual build", () => { + assert.match(workflow, /language: \[ 'c-cpp', 'csharp' \]/); + assert.match(workflow, /build-mode: manual/); + assert.doesNotMatch(workflow, /language: \[ 'cpp'/); +}); + +test("installs every dependency required by the C++ CMake build", () => { + assert.match(workflow, /sudo apt-get install -y[^\n]*libgtest-dev/); + assert.match(workflow, /if: matrix\.language == 'c-cpp'/); + assert.match(workflow, /cmake --build cpp\/build --parallel/); +}); + +test("uses action versions backed by the current Node runtime", () => { + assert.match(workflow, /actions\/checkout@v7/); + assert.match(workflow, /actions\/setup-dotnet@v6/); + assert.match(workflow, /github\/codeql-action\/init@v4/); + assert.match(workflow, /github\/codeql-action\/analyze@v4/); +}); + +test("pins the runner and disables persisted checkout credentials", () => { + assert.match(workflow, /runs-on: ubuntu-24\.04/); + assert.doesNotMatch(workflow, /runs-on: ubuntu-latest/); + assert.match(workflow, /persist-credentials: false/); +}); + +test("prevents checkout's default-branch warning", () => { + assert.match(workflow, /GIT_CONFIG_COUNT: '1'/); + assert.match(workflow, /GIT_CONFIG_KEY_0: init\.defaultBranch/); + assert.match(workflow, /GIT_CONFIG_VALUE_0: main/); +}); diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d100c2d7..f8c7238a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,4 +1,4 @@ -name: "CodeQL" +name: CodeQL on: push: @@ -8,11 +8,16 @@ on: schedule: - cron: '43 3 * * 0' +env: + GIT_CONFIG_COUNT: '1' + GIT_CONFIG_KEY_0: init.defaultBranch + GIT_CONFIG_VALUE_0: main + jobs: analyze: name: Analyze (${{ matrix.language }}) - runs-on: ubuntu-latest - timeout-minutes: 360 + runs-on: ubuntu-24.04 + timeout-minutes: 30 permissions: actions: read contents: read @@ -21,23 +26,25 @@ jobs: strategy: fail-fast: false matrix: - language: [ 'cpp', 'csharp' ] + language: [ 'c-cpp', 'csharp' ] steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: + persist-credentials: false submodules: true - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} + build-mode: manual queries: security-extended,security-and-quality - name: Setup .NET (for C# analysis) if: matrix.language == 'csharp' - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@v6 with: dotnet-version: '8.0.x' @@ -49,21 +56,18 @@ jobs: dotnet build -c Release - name: Install dependencies (for C++ analysis) - if: matrix.language == 'cpp' + if: matrix.language == 'c-cpp' run: | sudo apt-get update - sudo apt-get install -y cmake build-essential + sudo apt-get install -y build-essential cmake libgtest-dev - name: Build C++ - if: matrix.language == 'cpp' + if: matrix.language == 'c-cpp' run: | - cd cpp - mkdir -p build - cd build - cmake .. - make + cmake -S cpp -B cpp/build -DCMAKE_BUILD_TYPE=Release + cmake --build cpp/build --parallel - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4 with: - category: "/language:${{matrix.language}}" \ No newline at end of file + category: "/language:${{ matrix.language }}" From 713beb3a36cdae4447d7034144dce1777aa3de8f Mon Sep 17 00:00:00 2001 From: konard Date: Sun, 20 Sep 2026 08:02:14 +0000 Subject: [PATCH 5/5] Use build-free CodeQL extraction --- .../scripts/codeql-workflow-policy.test.mjs | 15 +++++----- .github/workflows/codeql.yml | 28 +------------------ 2 files changed, 9 insertions(+), 34 deletions(-) diff --git a/.github/scripts/codeql-workflow-policy.test.mjs b/.github/scripts/codeql-workflow-policy.test.mjs index 74d4f7cc..2f55fa16 100644 --- a/.github/scripts/codeql-workflow-policy.test.mjs +++ b/.github/scripts/codeql-workflow-policy.test.mjs @@ -7,23 +7,24 @@ import test from "node:test"; const workflowPath = new URL("../workflows/codeql.yml", import.meta.url); const workflow = readFileSync(workflowPath, "utf8"); -test("uses current CodeQL language identifiers and an explicit manual build", () => { +test("uses current CodeQL language identifiers and build-free extraction", () => { assert.match(workflow, /language: \[ 'c-cpp', 'csharp' \]/); - assert.match(workflow, /build-mode: manual/); + assert.match(workflow, /build-mode: none/); assert.doesNotMatch(workflow, /language: \[ 'cpp'/); + assert.doesNotMatch(workflow, /build-mode: manual/); }); -test("installs every dependency required by the C++ CMake build", () => { - assert.match(workflow, /sudo apt-get install -y[^\n]*libgtest-dev/); - assert.match(workflow, /if: matrix\.language == 'c-cpp'/); - assert.match(workflow, /cmake --build cpp\/build --parallel/); +test("does not duplicate the repositories' language build pipelines", () => { + assert.doesNotMatch(workflow, /apt-get/); + assert.doesNotMatch(workflow, /dotnet (?:restore|build)/); + assert.doesNotMatch(workflow, /cmake/); }); test("uses action versions backed by the current Node runtime", () => { assert.match(workflow, /actions\/checkout@v7/); - assert.match(workflow, /actions\/setup-dotnet@v6/); assert.match(workflow, /github\/codeql-action\/init@v4/); assert.match(workflow, /github\/codeql-action\/analyze@v4/); + assert.doesNotMatch(workflow, /actions\/setup-dotnet@/); }); test("pins the runner and disables persisted checkout credentials", () => { diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f8c7238a..01bdd8a6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -33,40 +33,14 @@ jobs: uses: actions/checkout@v7 with: persist-credentials: false - submodules: true - name: Initialize CodeQL uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} - build-mode: manual + build-mode: none queries: security-extended,security-and-quality - - name: Setup .NET (for C# analysis) - if: matrix.language == 'csharp' - uses: actions/setup-dotnet@v6 - with: - dotnet-version: '8.0.x' - - - name: Build C# - if: matrix.language == 'csharp' - run: | - cd csharp - dotnet restore - dotnet build -c Release - - - name: Install dependencies (for C++ analysis) - if: matrix.language == 'c-cpp' - run: | - sudo apt-get update - sudo apt-get install -y build-essential cmake libgtest-dev - - - name: Build C++ - if: matrix.language == 'c-cpp' - run: | - cmake -S cpp -B cpp/build -DCMAKE_BUILD_TYPE=Release - cmake --build cpp/build --parallel - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v4 with: