Update to Docker Integration and Query Upgrades (#66) #43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Pipeline | |
| on: | |
| push: | |
| branches: | |
| - v2 | |
| pull_request: | |
| branches: | |
| - v2 | |
| jobs: | |
| verify-docker: | |
| runs-on: ubuntu-latest | |
| env: | |
| CONDA_PLUGINS_AUTO_ACCEPT_TOS: true | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Build image | |
| run: docker build -f Dockerfile --platform linux/x86_64 -t iris:latest . | |
| - name: Run image | |
| run: docker run --platform=linux/amd64 iris:latest | |
| get-projects: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| projects: ${{ steps.read-json.outputs.projects }} | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Install jq | |
| run: sudo apt-get update && sudo apt-get install -y jq | |
| - name: Read projects and parameters from JSON | |
| id: read-json | |
| run: | | |
| JSON_FILE=".github/workflows/to_build.json" | |
| PROJECTS_JSON=$(cat "$JSON_FILE" | jq -c .) | |
| echo "Detected projects and parameters: $PROJECTS_JSON" | |
| echo "projects=$PROJECTS_JSON" >> $GITHUB_OUTPUT | |
| build-and-analyze: | |
| needs: get-projects | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| include: ${{ fromJson(needs.get-projects.outputs.projects) }} | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Miniconda | |
| uses: conda-incubator/setup-miniconda@v3 | |
| with: | |
| environment-file: environment.yml | |
| auto-activate-base: false | |
| activate-environment: iris | |
| auto-update-conda: true | |
| - name: Set up Java version ${{ matrix.java_version }} | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'temurin' | |
| java-version: ${{ matrix.java_version }} | |
| - name: Install Maven ${{ matrix.maven_version }} | |
| if: ${{ matrix.maven_version != '' }} | |
| run: | | |
| MAVEN_VERSION="${{ matrix.maven_version }}" | |
| MAVEN_TAR="apache-maven-${MAVEN_VERSION}-bin.tar.gz" | |
| MAVEN_URL="https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/${MAVEN_TAR}" | |
| MAVEN_INSTALL_DIR="/opt/maven/apache-maven-${MAVEN_VERSION}" | |
| echo "Downloading Maven ${MAVEN_VERSION}..." | |
| sudo curl -fSL "$MAVEN_URL" -o "/tmp/${MAVEN_TAR}" || { echo "Failed to download Maven!"; exit 1; } | |
| echo "Creating Maven install directory: ${MAVEN_INSTALL_DIR}" | |
| sudo mkdir -p "${MAVEN_INSTALL_DIR}" | |
| echo "Extracting Maven to ${MAVEN_INSTALL_DIR}..." | |
| sudo tar -xzf "/tmp/${MAVEN_TAR}" -C "/opt/maven/" || { echo "Failed to extract Maven!"; exit 1; } | |
| echo "Setting MAVEN_HOME and adding to PATH..." | |
| echo "MAVEN_HOME=${MAVEN_INSTALL_DIR}" >> $GITHUB_ENV | |
| echo "M2_HOME=${MAVEN_INSTALL_DIR}" >> $GITHUB_ENV | |
| echo "${MAVEN_INSTALL_DIR}/bin" >> $GITHUB_PATH | |
| echo "Maven ${MAVEN_VERSION} installed to ${MAVEN_INSTALL_DIR}" | |
| echo "------------------------------------------------" | |
| - name: Install Gradle ${{ matrix.gradle_version }} | |
| if: ${{ matrix.gradle_version != '' }} | |
| run: | | |
| GRADLE_VERSION="${{ matrix.gradle_version }}" | |
| GRADLE_ZIP="gradle-${GRADLE_VERSION}-bin.zip" | |
| GRADLE_URL="https://services.gradle.org/distributions/${GRADLE_ZIP}" | |
| GRADLE_INSTALL_DIR="/opt/gradle/gradle-${GRADLE_VERSION}" | |
| echo "Downloading Gradle ${GRADLE_VERSION}..." | |
| sudo curl -fSL "$GRADLE_URL" -o "/tmp/${GRADLE_ZIP}" || { echo "Failed to download Gradle!"; exit 1; } | |
| echo "Creating Gradle install directory: ${GRADLE_INSTALL_DIR}" | |
| sudo mkdir -p "${GRADLE_INSTALL_DIR}" | |
| echo "Extracting Gradle to ${GRADLE_INSTALL_DIR}..." | |
| sudo unzip -q "/tmp/${GRADLE_ZIP}" -d "/opt/gradle/" || { echo "Failed to extract Gradle!"; exit 1; } | |
| echo "Setting GRADLE_HOME and adding to PATH..." | |
| echo "GRADLE_HOME=${GRADLE_INSTALL_DIR}" >> $GITHUB_ENV | |
| echo "${GRADLE_INSTALL_DIR}/bin" >> $GITHUB_PATH | |
| echo "Gradle ${GRADLE_VERSION} installed to ${GRADLE_INSTALL_DIR}" | |
| echo "------------------------------------------------" | |
| - name: Download and Extract CodeQL Bundle | |
| run: | | |
| # Download the CodeQL bundle | |
| curl -L https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.23.2/codeql-bundle-linux64.tar.gz -o codeql-bundle.tar.gz || exit 1 | |
| # Extract the bundle | |
| tar -xzf codeql-bundle.tar.gz || exit 1 | |
| # Store the absolute path to the extracted CodeQL directory in GITHUB_ENV. | |
| echo "CODEQL_PATH=$(pwd)/codeql" >> $GITHUB_ENV | |
| # Add the CodeQL executable's directory to the PATH for all subsequent steps. | |
| echo "$(pwd)/codeql" >> $GITHUB_PATH | |
| - name: Update CodeQL Query version in config | |
| run: sed -i "s/^CODEQL_QUERY_VERSION = \".*\"$/CODEQL_QUERY_VERSION = \"1.8.1\"/" src/config.py | |
| - name: Update JDK Path in dep_configs.json for ${{ matrix.java_version }} | |
| run: | | |
| sudo apt-get update && sudo apt-get install -y moreutils | |
| CURRENT_JAVA_VERSION="${{ matrix.java_version }}" | |
| JAVA_HOME_TO_USE="" | |
| case "$CURRENT_JAVA_VERSION" in | |
| "8") | |
| JAVA_HOME_TO_USE="/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/8.0.472-8/x64" | |
| ;; | |
| "11") | |
| JAVA_HOME_TO_USE="/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/11.0.23-9/x64" | |
| ;; | |
| "17") | |
| JAVA_HOME_TO_USE="/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.11-9/x64" | |
| ;; | |
| *) | |
| echo "Error: Unsupported Java version '$CURRENT_JAVA_VERSION'." | |
| exit 1 | |
| ;; | |
| esac | |
| jq \ | |
| --arg current_java_version "$CURRENT_JAVA_VERSION" \ | |
| --arg java_home_path "$JAVA_HOME_TO_USE" \ | |
| '.jdks[$current_java_version] = $java_home_path' \ | |
| "dep_configs.json" | sponge "dep_configs.json" | |
| - name: Relocate cached output for ${{ matrix.project_slug }} | |
| run: | | |
| mkdir -p output/${{ matrix.project_slug }}/test/analysis/${{ matrix.cwe }} | |
| mv .github/cached_output/${{ matrix.project_slug }}/* output/${{ matrix.project_slug }}/test/analysis/${{ matrix.cwe }}/ | |
| - name: Build project ${{ matrix.project_slug }} | |
| run: | | |
| echo "--- Building ${{ matrix.project_slug }} ---" | |
| conda run -n iris python scripts/fetch_and_build.py --filter ${{ matrix.project_slug }} | |
| echo "--------------------------------" | |
| - name: Generate CodeQL database for ${{ matrix.project_slug }} | |
| run: | | |
| echo "--- Generating CodeQL database for ${{ matrix.project_slug }} ---" | |
| conda run -n iris python scripts/build_codeql_dbs.py --project ${{ matrix.project_slug }} | |
| echo "----------------------------------" | |
| - name: Run IRIS for ${{ matrix.project_slug }} with CWE ${{ matrix.cwe }} | |
| run: | | |
| echo "--- Running IRIS for ${{ matrix.project_slug }} ---" | |
| conda run -n iris python src/iris.py --query ${{ matrix.cwe }} --run-id test --overwrite-api-candidates --overwrite-func-param-candidates --skip-posthoc-filter ${{ matrix.project_slug }} | |
| echo "--------------------" | |
| - name: Verify output file existence | |
| run: | | |
| JSON_FILE="output/${{ matrix.project_slug }}/test/${{ matrix.cwe }}-final/results.json" | |
| echo "Checking for .json file: $JSON_FILE" | |
| if [ -f "$JSON_FILE" ]; then | |
| echo ".json file found: $JSON_FILE" | |
| else | |
| echo "Error: .json file not found at $JSON_FILE" | |
| exit 1 | |
| fi |