ci/codeql: use filter-sarif to filter meson-private

There is a severe number of false-positive in code scanning caused by inspecting meson-internal test files like 'build/meson-private/tmpzb46osmq/testfile.c'. As a workaround, use the 'filter-sarif' action to filter out these results before uploading the SARIF (Static Analysis Results Interchange Format). This PR was inspired by rauc/rauc#1346 and the example from https://github.com/advanced-security/filter-sarif. Signed-off-by: Enrico Joerns <[email protected]> [Emil: port from rauc, use checksums for actions] Signed-off-by: Emil Velikov <[email protected]>
gregkh · Nov 16, 2024 · e928220 · e928220
1 parent 2c488b6
commit e928220
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -66,3 +66,19 @@ jobs:
         uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
         with:
           category: "/language:cpp"
+          upload: false
+          output: sarif-results
+
+      - name: Filter out meson-internal test files
+        uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1.0.1
+        with:
+          patterns: |
+            -build/meson-private/**/testfile.c
+          input: sarif-results/cpp.sarif
+          output: sarif-results/cpp.sarif
+
+      - name: Upload CodeQL results to code scanning
+        uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
+        with:
+          sarif_file: sarif-results/cpp.sarif
+          category: "/language:cpp"