iprange/.github/workflows/security.yml at master · firehol/iprange · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
name: Security

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  schedule:
    - cron: '23 3 * * 2'
  workflow_dispatch:

permissions: {}

jobs:
  sanitizers:
    name: Sanitizers
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10

      - name: Install test dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            autoconf \
            automake \
            build-essential \
            clang \
            libtool \
            make \
            pkg-config

      - name: Run sanitizer suite
        run: |
          ./autogen.sh
          ./configure --disable-man
          make -j"$(nproc)"
          make check-sanitizers

  coverage:
    name: Coverage
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    env:
      CODACY_API_TOKEN: ${{ secrets.CODACY_API_TOKEN }}
      CODACY_ORGANIZATION_PROVIDER: gh
      CODACY_USERNAME: firehol
      CODACY_PROJECT_NAME: iprange
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10

      - name: Install coverage dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            autoconf \
            automake \
            build-essential \
            lcov \
            libtool \
            make \
            pkg-config

      - name: Generate LCOV report
        run: |
          ./autogen.sh
          CFLAGS='-O0 -g --coverage' LDFLAGS='--coverage' ./configure --disable-man
          make -j"$(nproc)"
          IPRANGE_BIN="$PWD/iprange" ./run-tests.sh
          BUILD_DIR="$PWD" TEST_CFLAGS='-O0 -g --coverage' TEST_LDFLAGS='--coverage' ./run-unit-tests.sh
          lcov --capture --directory . --output-file coverage.info --ignore-errors mismatch,gcov,inconsistent
          lcov --remove coverage.info '/usr/*' '*/tests.unit/*' --output-file coverage.filtered.info --ignore-errors inconsistent,corrupt,unused
          mv coverage.filtered.info coverage.info
          lcov --summary coverage.info --ignore-errors inconsistent,corrupt

      - name: Upload coverage artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: coverage-lcov
          path: coverage.info
          retention-days: 14

      - name: Upload coverage to Codacy
        if: env.CODACY_API_TOKEN != ''
        run: |
          curl -fsSLO https://artifacts.codacy.com/bin/codacy-coverage-reporter/14.1.3/codacy-coverage-reporter-linux
          curl -fsSLO https://github.com/codacy/codacy-coverage-reporter/releases/download/14.1.3/codacy-coverage-reporter-linux.SHA512SUM
          sha512sum -c codacy-coverage-reporter-linux.SHA512SUM
          chmod +x codacy-coverage-reporter-linux
          ./codacy-coverage-reporter-linux report \
            --api-token "$CODACY_API_TOKEN" \
            --organization-provider "$CODACY_ORGANIZATION_PROVIDER" \
            --username "$CODACY_USERNAME" \
            --project-name "$CODACY_PROJECT_NAME" \
            -r coverage.info

  static-analysis:
    name: Static analysis ratchet
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10

      - name: Install static analysis dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            cppcheck \
            flawfinder

      - name: Run cppcheck
        run: |
          cppcheck \
            --enable=warning,performance,portability \
            --error-exitcode=1 \
            --inline-suppr \
            --suppress=missingIncludeSystem \
            --suppress=resourceLeak:src/ipset_load.c \
            --suppress=resourceLeak:src/ipset6_load.c \
            '-DVERSION="ci"' \
            src 2> cppcheck.log

      - name: Run flawfinder
        run: |
          flawfinder \
            --minlevel=4 \
            --error-level=4 \
            --dataonly \
            --quiet \
            src > flawfinder.log

      - name: Upload static analysis artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: static-analysis
          path: |
            cppcheck.log
            flawfinder.log
          retention-days: 14