diff options
Diffstat (limited to '.github')
| -rw-r--r-- | .github/ISSUE_TEMPLATE/config.yml | 48 | ||||
| -rw-r--r-- | .github/dependabot.yml | 72 | ||||
| -rw-r--r-- | .github/pull_request_template.md | 54 | ||||
| -rw-r--r-- | .github/workflows/codeql.yml | 722 | ||||
| -rw-r--r-- | .github/workflows/pr-labeler.yml | 72 | ||||
| -rw-r--r-- | .github/workflows/pr-labeler/regex.yml | 32 | ||||
| -rw-r--r-- | .github/workflows/stale.yml | 88 |
7 files changed, 544 insertions, 544 deletions
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 7866c2197a..1c7fe8bfc4 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,24 +1,24 @@ -## @file
-# GitHub issue configuration file.
-#
-# This file is meant to direct contributors familiar with GitHub's issue tracker
-# to the external resources used by TianoCore.
-#
-# Copyright (c) Microsoft Corporation.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-##
-
-blank_issues_enabled: false
-contact_links:
- - name: Bugs and Feature Requests
- url: https://bugzilla.tianocore.org/
- about: Submit bug reports and feature requests here
- - name: Reporting Security Issues
- url: https://github.com/tianocore/tianocore.github.io/wiki/Reporting-Security-Issues
- about: Read the wiki page that describes the process here
- - name: EDK II Development Mailing List
- url: https://edk2.groups.io/g/devel
- about: Submit code patches and ask questions on the mailing list (devel@edk2.groups.io)
- - name: EDK II Discussions
- url: https://github.com/tianocore/edk2/discussions
- about: You can also reach out on the Discussion section of this repository
+## @file +# GitHub issue configuration file. +# +# This file is meant to direct contributors familiar with GitHub's issue tracker +# to the external resources used by TianoCore. +# +# Copyright (c) Microsoft Corporation. +# SPDX-License-Identifier: BSD-2-Clause-Patent +## + +blank_issues_enabled: false +contact_links: + - name: Bugs and Feature Requests + url: https://bugzilla.tianocore.org/ + about: Submit bug reports and feature requests here + - name: Reporting Security Issues + url: https://github.com/tianocore/tianocore.github.io/wiki/Reporting-Security-Issues + about: Read the wiki page that describes the process here + - name: EDK II Development Mailing List + url: https://edk2.groups.io/g/devel + about: Submit code patches and ask questions on the mailing list (devel@edk2.groups.io) + - name: EDK II Discussions + url: https://github.com/tianocore/edk2/discussions + about: You can also reach out on the Discussion section of this repository diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 479440fe63..88bf122b8d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,36 +1,36 @@ -## @file
-# Dependabot configuration file to enable GitHub services for managing and updating
-# dependencies.
-#
-# Copyright (c) Microsoft Corporation.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-##
-version: 2
-updates:
- - package-ecosystem: "pip"
- directory: "/"
- schedule:
- interval: "daily"
- commit-message:
- prefix: "pip"
- reviewers:
- - "makubacki"
- - "mdkinney"
- - "spbrogan"
- rebase-strategy: "disabled"
-
- - package-ecosystem: "github-actions"
- directory: "/"
- schedule:
- interval: "weekly"
- day: "monday"
- commit-message:
- prefix: "GitHub Action"
- reviewers:
- - "makubacki"
- - "mdkinney"
- - "spbrogan"
- rebase-strategy: "disabled"
+## @file +# Dependabot configuration file to enable GitHub services for managing and updating +# dependencies. +# +# Copyright (c) Microsoft Corporation. +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +# Please see the documentation for all configuration options: +# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates +## +version: 2 +updates: + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "daily" + commit-message: + prefix: "pip" + reviewers: + - "makubacki" + - "mdkinney" + - "spbrogan" + rebase-strategy: "disabled" + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + commit-message: + prefix: "GitHub Action" + reviewers: + - "makubacki" + - "mdkinney" + - "spbrogan" + rebase-strategy: "disabled" diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 70e8c56496..3a2fc5eadf 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,27 +1,27 @@ -# Description
-
-<_Include a description of the change and why this change was made._>
-
-<_For each item, place an "x" in between `[` and `]` if true. Example: `[x]` (you can also check items in GitHub UI)_>
-
-<_Create the PR as a Draft PR if it is only created to run CI checks._>
-
-<_Delete lines in \<\> tags before creating the PR._>
-
-- [ ] Breaking change?
- - **Breaking change** - Will this cause a break in build or boot behavior?
- - Examples: Add a new library class or move a module to a different repo.
-- [ ] Impacts security?
- - **Security** - Does the change have a direct security impact?
- - Examples: Crypto algorithm change or buffer overflow fix.
-- [ ] Includes tests?
- - **Tests** - Does the change include any explicit test code?
- - Examples: Unit tests or integration tests.
-
-## How This Was Tested
-
-<_Describe the test(s) that were run to verify the changes._>
-
-## Integration Instructions
-
-<_Describe how these changes should be integrated. Use N/A if nothing is required._>
+# Description + +<_Include a description of the change and why this change was made._> + +<_For each item, place an "x" in between `[` and `]` if true. Example: `[x]` (you can also check items in GitHub UI)_> + +<_Create the PR as a Draft PR if it is only created to run CI checks._> + +<_Delete lines in \<\> tags before creating the PR._> + +- [ ] Breaking change? + - **Breaking change** - Will this cause a break in build or boot behavior? + - Examples: Add a new library class or move a module to a different repo. +- [ ] Impacts security? + - **Security** - Does the change have a direct security impact? + - Examples: Crypto algorithm change or buffer overflow fix. +- [ ] Includes tests? + - **Tests** - Does the change include any explicit test code? + - Examples: Unit tests or integration tests. + +## How This Was Tested + +<_Describe the test(s) that were run to verify the changes._> + +## Integration Instructions + +<_Describe how these changes should be integrated. Use N/A if nothing is required._> diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e0c5f69f6c..f0b65166b1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,361 +1,361 @@ -# This workflow runs CodeQL against the repository.
-#
-# Results are uploaded to GitHub Code Scanning.
-#
-# Due to a known issue with the CodeQL extractor when building the edk2
-# codebase on Linux systems, only Windows agents are used for build with
-# the VS toolchain.
-#
-# Copyright (c) Microsoft Corporation.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-
-name: "CodeQL"
-
-on:
- push:
- branches:
- - master
- pull_request:
- branches:
- - master
- paths-ignore:
- - '!**.c'
- - '!**.h'
-
-jobs:
- analyze:
- name: Analyze
- runs-on: windows-2019
- permissions:
- actions: read
- contents: read
- security-events: write
-
- strategy:
- fail-fast: false
- matrix:
- include:
- - Package: "ArmPkg"
- ArchList: "IA32,X64"
- - Package: "CryptoPkg"
- ArchList: "IA32"
- - Package: "CryptoPkg"
- ArchList: "X64"
- - Package: "DynamicTablesPkg"
- ArchList: "IA32,X64"
- - Package: "FatPkg"
- ArchList: "IA32,X64"
- - Package: "FmpDevicePkg"
- ArchList: "IA32,X64"
- - Package: "IntelFsp2Pkg"
- ArchList: "IA32,X64"
- - Package: "IntelFsp2WrapperPkg"
- ArchList: "IA32,X64"
- - Package: "MdeModulePkg"
- ArchList: "IA32"
- - Package: "MdeModulePkg"
- ArchList: "X64"
- - Package: "MdePkg"
- ArchList: "IA32,X64"
- - Package: "PcAtChipsetPkg"
- ArchList: "IA32,X64"
- - Package: "PrmPkg"
- ArchList: "IA32,X64"
- - Package: "SecurityPkg"
- ArchList: "IA32,X64"
- - Package: "ShellPkg"
- ArchList: "IA32,X64"
- - Package: "SourceLevelDebugPkg"
- ArchList: "IA32,X64"
- - Package: "StandaloneMmPkg"
- ArchList: "IA32,X64"
- - Package: "UefiCpuPkg"
- ArchList: "IA32,X64"
- - Package: "UnitTestFrameworkPkg"
- ArchList: "IA32,X64"
-
- steps:
- - name: Checkout repository
- uses: actions/checkout@v4
-
- - name: Install Python
- uses: actions/setup-python@v5
- with:
- python-version: '3.11'
- cache: 'pip'
- cache-dependency-path: 'pip-requirements.txt'
-
- - name: Use Git Long Paths on Windows
- if: runner.os == 'Windows'
- shell: pwsh
- run: |
- git config --system core.longpaths true
-
- - name: Install/Upgrade pip Modules
- run: pip install -r pip-requirements.txt --upgrade requests sarif-tools
-
- - name: Determine CI Settings File Supported Operations
- id: get_ci_file_operations
- shell: python
- run: |
- import importlib
- import os
- import sys
- from pathlib import Path
- from edk2toolext.invocables.edk2_ci_setup import CiSetupSettingsManager
- from edk2toolext.invocables.edk2_setup import SetupSettingsManager
-
- # Find the repo CI Settings file
- ci_settings_file = list(Path(os.environ['GITHUB_WORKSPACE']).rglob('.pytool/CISettings.py'))
-
- # Note: At this point, submodules have not been pulled, only one CI Settings file should exist
- if len(ci_settings_file) != 1 or not ci_settings_file[0].is_file():
- print("::error title=Workspace Error!::Failed to find CI Settings file!")
- sys.exit(1)
-
- ci_settings_file = ci_settings_file[0]
-
- # Try Finding the Settings class in the file
- module_name = 'ci_settings'
-
- spec = importlib.util.spec_from_file_location(module_name, ci_settings_file)
- module = importlib.util.module_from_spec(spec)
- spec.loader.exec_module(module)
-
- try:
- settings = getattr(module, 'Settings')
- except AttributeError:
- print("::error title=Workspace Error!::Failed to find Settings class in CI Settings file!")
- sys.exit(1)
-
- # Determine Which Operations Are Supported by the Settings Class
- ci_setup_supported = issubclass(settings, CiSetupSettingsManager)
- setup_supported = issubclass(settings, SetupSettingsManager)
-
- with open(os.environ['GITHUB_OUTPUT'], 'a') as fh:
- print(f'ci_setup_supported={str(ci_setup_supported).lower()}', file=fh)
- print(f'setup_supported={str(setup_supported).lower()}', file=fh)
-
- - name: Convert Arch to Log Format
- id: convert_arch_hyphen
- env:
- ARCH_LIST: ${{ matrix.ArchList }}
- shell: python
- run: |
- import os
-
- with open(os.environ['GITHUB_OUTPUT'], 'a') as fh:
- print(f'arch_list={os.environ["ARCH_LIST"].replace(",", "-")}', file=fh)
-
- - name: Setup
- if: steps.get_ci_file_operations.outputs.setup_supported == 'true'
- run: stuart_setup -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019
-
- - name: Upload Setup Log As An Artifact
- uses: actions/upload-artifact@v4
- if: (success() || failure()) && steps.get_ci_file_operations.outputs.setup_supported == 'true'
- with:
- name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-Setup-Log
- path: |
- **/SETUPLOG.txt
- retention-days: 7
- if-no-files-found: ignore
-
- - name: CI Setup
- if: steps.get_ci_file_operations.outputs.ci_setup_supported == 'true'
- run: stuart_ci_setup -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019
-
- - name: Upload CI Setup Log As An Artifact
- uses: actions/upload-artifact@v4
- if: (success() || failure()) && steps.get_ci_file_operations.outputs.ci_setup_supported == 'true'
- with:
- name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-CI-Setup-Log
- path: |
- **/CISETUP.txt
- retention-days: 7
- if-no-files-found: ignore
-
- - name: Update
- run: stuart_update -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019
-
- - name: Upload Update Log As An Artifact
- uses: actions/upload-artifact@v4
- if: success() || failure()
- with:
- name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-Update-Log
- path: |
- **/UPDATE_LOG.txt
- retention-days: 7
- if-no-files-found: ignore
-
- - name: Build Tools From Source
- run: python BaseTools/Edk2ToolsBuild.py -t VS2019
-
- - name: Find CodeQL Plugin Directory
- id: find_dir
- shell: python
- run: |
- import os
- import sys
- from pathlib import Path
-
- # Find the plugin directory that contains the CodeQL plugin
- plugin_dir = list(Path(os.environ['GITHUB_WORKSPACE']).rglob('BaseTools/Plugin/CodeQL'))
-
- # This should only be found once
- if len(plugin_dir) == 1:
- plugin_dir = str(plugin_dir[0])
-
- with open(os.environ['GITHUB_OUTPUT'], 'a') as fh:
- print(f'codeql_plugin_dir={plugin_dir}', file=fh)
- else:
- print("::error title=Workspace Error!::Failed to find CodeQL plugin directory!")
- sys.exit(1)
-
- - name: Get CodeQL CLI Cache Data
- id: cache_key_gen
- env:
- CODEQL_PLUGIN_DIR: ${{ steps.find_dir.outputs.codeql_plugin_dir }}
- shell: python
- run: |
- import os
- import yaml
-
- codeql_cli_ext_dep_name = 'codeqlcli_windows_ext_dep'
- codeql_plugin_file = os.path.join(os.environ['CODEQL_PLUGIN_DIR'], codeql_cli_ext_dep_name + '.yaml')
-
- with open (codeql_plugin_file) as pf:
- codeql_cli_ext_dep = yaml.safe_load(pf)
-
- cache_key_name = codeql_cli_ext_dep['name']
- cache_key_version = codeql_cli_ext_dep['version']
- cache_key = f'{cache_key_name}-{cache_key_version}'
-
- codeql_plugin_cli_ext_dep_dir = os.path.join(os.environ['CODEQL_PLUGIN_DIR'], codeql_cli_ext_dep['name'].strip() + '_extdep')
-
- with open(os.environ['GITHUB_OUTPUT'], 'a') as fh:
- print(f'codeql_cli_cache_key={cache_key}', file=fh)
- print(f'codeql_cli_ext_dep_dir={codeql_plugin_cli_ext_dep_dir}', file=fh)
-
- - name: Attempt to Load CodeQL CLI From Cache
- id: codeqlcli_cache
- uses: actions/cache@v4
- with:
- path: ${{ steps.cache_key_gen.outputs.codeql_cli_ext_dep_dir }}
- key: ${{ steps.cache_key_gen.outputs.codeql_cli_cache_key }}
-
- - name: Download CodeQL CLI
- if: steps.codeqlcli_cache.outputs.cache-hit != 'true'
- run: stuart_update -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 --codeql
-
- - name: Remove CI Plugins Irrelevant to CodeQL
- shell: python
- env:
- CODEQL_PLUGIN_DIR: ${{ steps.find_dir.outputs.codeql_plugin_dir }}
- run: |
- import os
- import shutil
- from pathlib import Path
-
- # Only these two plugins are needed for CodeQL
- plugins_to_keep = ['CompilerPlugin']
-
- plugin_dir = Path('.pytool/Plugin').absolute()
- if plugin_dir.is_dir():
- for dir in plugin_dir.iterdir():
- if str(dir.stem) not in plugins_to_keep:
- shutil.rmtree(str(dir.absolute()), ignore_errors=True)
-
- - name: CI Build
- env:
- STUART_CODEQL_PATH: ${{ steps.cache_key_gen.outputs.codeql_cli_ext_dep_dir }}
- run: stuart_ci_build -c .pytool/CISettings.py -t DEBUG -p ${{ matrix.Package }} -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 --codeql
-
- - name: Build Cleanup
- id: build_cleanup
- shell: python
- run: |
- import os
- import shutil
- from pathlib import Path
-
- dirs_to_delete = ['ia32', 'x64', 'arm', 'aarch64']
-
- def delete_dirs(path: Path):
- if path.exists() and path.is_dir():
- if path.name.lower() in dirs_to_delete:
- print(f'Removed {str(path)}')
- shutil.rmtree(path)
- return
-
- for child_dir in path.iterdir():
- delete_dirs(child_dir)
-
- build_path = Path(os.environ['GITHUB_WORKSPACE'], 'Build')
- delete_dirs(build_path)
-
- - name: Upload Build Logs As An Artifact
- uses: actions/upload-artifact@v4
- if: success() || failure()
- with:
- name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-Build-Logs
- path: |
- **/BUILD_REPORT.TXT
- **/OVERRIDELOG.TXT
- **/BUILDLOG_*.md
- **/BUILDLOG_*.txt
- **/CI_*.md
- **/CI_*.txt
- retention-days: 7
- if-no-files-found: ignore
-
- - name: Prepare Env Data for CodeQL Upload
- id: env_data
- env:
- PACKAGE_NAME: ${{ matrix.Package }}
- shell: python
- run: |
- import logging
- import os
- from edk2toollib.utility_functions import RunCmd
- from io import StringIO
- from pathlib import Path
-
- package = os.environ['PACKAGE_NAME'].strip().lower()
- directory_name = 'codeql-analysis-' + package + '-debug'
- file_name = 'codeql-db-' + package + '-debug-0.sarif'
- sarif_path = Path('Build', directory_name, file_name)
-
- with open(os.environ['GITHUB_OUTPUT'], 'a') as fh:
- if sarif_path.is_file():
- emacs_file_path = sarif_path.with_name(sarif_path.stem + "-emacs.txt")
- out_stream_buffer = StringIO()
- exit_code = RunCmd("sarif", f"emacs {sarif_path} --output {emacs_file_path} --no-autotrim",
- outstream=out_stream_buffer,
- logging_level=logging.NOTSET)
- print(f'upload_sarif_file=true', file=fh)
- print(f'emacs_file_path={emacs_file_path}', file=fh)
- print(f'sarif_file_path={sarif_path}', file=fh)
- else:
- print(f'upload_sarif_file=false', file=fh)
-
- - name: Upload CodeQL Results (SARIF) As An Artifact
- uses: actions/upload-artifact@v4
- if: steps.env_data.outputs.upload_sarif_file == 'true'
- with:
- name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-CodeQL-SARIF
- path: |
- ${{ steps.env_data.outputs.emacs_file_path }}
- ${{ steps.env_data.outputs.sarif_file_path }}
- retention-days: 14
- if-no-files-found: warn
-
- - name: Upload CodeQL Results (SARIF) To GitHub Code Scanning
- uses: github/codeql-action/upload-sarif@v3
- if: steps.env_data.outputs.upload_sarif_file == 'true'
- with:
- # Path to SARIF file relative to the root of the repository.
- sarif_file: ${{ steps.env_data.outputs.sarif_file_path }}
- # Optional category for the results. Used to differentiate multiple results for one commit.
- # Each package is a separate category.
- category: ${{ matrix.Package }}
+# This workflow runs CodeQL against the repository. +# +# Results are uploaded to GitHub Code Scanning. +# +# Due to a known issue with the CodeQL extractor when building the edk2 +# codebase on Linux systems, only Windows agents are used for build with +# the VS toolchain. +# +# Copyright (c) Microsoft Corporation. +# SPDX-License-Identifier: BSD-2-Clause-Patent + +name: "CodeQL" + +on: + push: + branches: + - master + pull_request: + branches: + - master + paths-ignore: + - '!**.c' + - '!**.h' + +jobs: + analyze: + name: Analyze + runs-on: windows-2019 + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + include: + - Package: "ArmPkg" + ArchList: "IA32,X64" + - Package: "CryptoPkg" + ArchList: "IA32" + - Package: "CryptoPkg" + ArchList: "X64" + - Package: "DynamicTablesPkg" + ArchList: "IA32,X64" + - Package: "FatPkg" + ArchList: "IA32,X64" + - Package: "FmpDevicePkg" + ArchList: "IA32,X64" + - Package: "IntelFsp2Pkg" + ArchList: "IA32,X64" + - Package: "IntelFsp2WrapperPkg" + ArchList: "IA32,X64" + - Package: "MdeModulePkg" + ArchList: "IA32" + - Package: "MdeModulePkg" + ArchList: "X64" + - Package: "MdePkg" + ArchList: "IA32,X64" + - Package: "PcAtChipsetPkg" + ArchList: "IA32,X64" + - Package: "PrmPkg" + ArchList: "IA32,X64" + - Package: "SecurityPkg" + ArchList: "IA32,X64" + - Package: "ShellPkg" + ArchList: "IA32,X64" + - Package: "SourceLevelDebugPkg" + ArchList: "IA32,X64" + - Package: "StandaloneMmPkg" + ArchList: "IA32,X64" + - Package: "UefiCpuPkg" + ArchList: "IA32,X64" + - Package: "UnitTestFrameworkPkg" + ArchList: "IA32,X64" + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Install Python + uses: actions/setup-python@v5 + with: + python-version: '3.11' + cache: 'pip' + cache-dependency-path: 'pip-requirements.txt' + + - name: Use Git Long Paths on Windows + if: runner.os == 'Windows' + shell: pwsh + run: | + git config --system core.longpaths true + + - name: Install/Upgrade pip Modules + run: pip install -r pip-requirements.txt --upgrade requests sarif-tools + + - name: Determine CI Settings File Supported Operations + id: get_ci_file_operations + shell: python + run: | + import importlib + import os + import sys + from pathlib import Path + from edk2toolext.invocables.edk2_ci_setup import CiSetupSettingsManager + from edk2toolext.invocables.edk2_setup import SetupSettingsManager + + # Find the repo CI Settings file + ci_settings_file = list(Path(os.environ['GITHUB_WORKSPACE']).rglob('.pytool/CISettings.py')) + + # Note: At this point, submodules have not been pulled, only one CI Settings file should exist + if len(ci_settings_file) != 1 or not ci_settings_file[0].is_file(): + print("::error title=Workspace Error!::Failed to find CI Settings file!") + sys.exit(1) + + ci_settings_file = ci_settings_file[0] + + # Try Finding the Settings class in the file + module_name = 'ci_settings' + + spec = importlib.util.spec_from_file_location(module_name, ci_settings_file) + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + + try: + settings = getattr(module, 'Settings') + except AttributeError: + print("::error title=Workspace Error!::Failed to find Settings class in CI Settings file!") + sys.exit(1) + + # Determine Which Operations Are Supported by the Settings Class + ci_setup_supported = issubclass(settings, CiSetupSettingsManager) + setup_supported = issubclass(settings, SetupSettingsManager) + + with open(os.environ['GITHUB_OUTPUT'], 'a') as fh: + print(f'ci_setup_supported={str(ci_setup_supported).lower()}', file=fh) + print(f'setup_supported={str(setup_supported).lower()}', file=fh) + + - name: Convert Arch to Log Format + id: convert_arch_hyphen + env: + ARCH_LIST: ${{ matrix.ArchList }} + shell: python + run: | + import os + + with open(os.environ['GITHUB_OUTPUT'], 'a') as fh: + print(f'arch_list={os.environ["ARCH_LIST"].replace(",", "-")}', file=fh) + + - name: Setup + if: steps.get_ci_file_operations.outputs.setup_supported == 'true' + run: stuart_setup -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 + + - name: Upload Setup Log As An Artifact + uses: actions/upload-artifact@v4 + if: (success() || failure()) && steps.get_ci_file_operations.outputs.setup_supported == 'true' + with: + name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-Setup-Log + path: | + **/SETUPLOG.txt + retention-days: 7 + if-no-files-found: ignore + + - name: CI Setup + if: steps.get_ci_file_operations.outputs.ci_setup_supported == 'true' + run: stuart_ci_setup -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 + + - name: Upload CI Setup Log As An Artifact + uses: actions/upload-artifact@v4 + if: (success() || failure()) && steps.get_ci_file_operations.outputs.ci_setup_supported == 'true' + with: + name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-CI-Setup-Log + path: | + **/CISETUP.txt + retention-days: 7 + if-no-files-found: ignore + + - name: Update + run: stuart_update -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 + + - name: Upload Update Log As An Artifact + uses: actions/upload-artifact@v4 + if: success() || failure() + with: + name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-Update-Log + path: | + **/UPDATE_LOG.txt + retention-days: 7 + if-no-files-found: ignore + + - name: Build Tools From Source + run: python BaseTools/Edk2ToolsBuild.py -t VS2019 + + - name: Find CodeQL Plugin Directory + id: find_dir + shell: python + run: | + import os + import sys + from pathlib import Path + + # Find the plugin directory that contains the CodeQL plugin + plugin_dir = list(Path(os.environ['GITHUB_WORKSPACE']).rglob('BaseTools/Plugin/CodeQL')) + + # This should only be found once + if len(plugin_dir) == 1: + plugin_dir = str(plugin_dir[0]) + + with open(os.environ['GITHUB_OUTPUT'], 'a') as fh: + print(f'codeql_plugin_dir={plugin_dir}', file=fh) + else: + print("::error title=Workspace Error!::Failed to find CodeQL plugin directory!") + sys.exit(1) + + - name: Get CodeQL CLI Cache Data + id: cache_key_gen + env: + CODEQL_PLUGIN_DIR: ${{ steps.find_dir.outputs.codeql_plugin_dir }} + shell: python + run: | + import os + import yaml + + codeql_cli_ext_dep_name = 'codeqlcli_windows_ext_dep' + codeql_plugin_file = os.path.join(os.environ['CODEQL_PLUGIN_DIR'], codeql_cli_ext_dep_name + '.yaml') + + with open (codeql_plugin_file) as pf: + codeql_cli_ext_dep = yaml.safe_load(pf) + + cache_key_name = codeql_cli_ext_dep['name'] + cache_key_version = codeql_cli_ext_dep['version'] + cache_key = f'{cache_key_name}-{cache_key_version}' + + codeql_plugin_cli_ext_dep_dir = os.path.join(os.environ['CODEQL_PLUGIN_DIR'], codeql_cli_ext_dep['name'].strip() + '_extdep') + + with open(os.environ['GITHUB_OUTPUT'], 'a') as fh: + print(f'codeql_cli_cache_key={cache_key}', file=fh) + print(f'codeql_cli_ext_dep_dir={codeql_plugin_cli_ext_dep_dir}', file=fh) + + - name: Attempt to Load CodeQL CLI From Cache + id: codeqlcli_cache + uses: actions/cache@v4 + with: + path: ${{ steps.cache_key_gen.outputs.codeql_cli_ext_dep_dir }} + key: ${{ steps.cache_key_gen.outputs.codeql_cli_cache_key }} + + - name: Download CodeQL CLI + if: steps.codeqlcli_cache.outputs.cache-hit != 'true' + run: stuart_update -c .pytool/CISettings.py -t DEBUG -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 --codeql + + - name: Remove CI Plugins Irrelevant to CodeQL + shell: python + env: + CODEQL_PLUGIN_DIR: ${{ steps.find_dir.outputs.codeql_plugin_dir }} + run: | + import os + import shutil + from pathlib import Path + + # Only these two plugins are needed for CodeQL + plugins_to_keep = ['CompilerPlugin'] + + plugin_dir = Path('.pytool/Plugin').absolute() + if plugin_dir.is_dir(): + for dir in plugin_dir.iterdir(): + if str(dir.stem) not in plugins_to_keep: + shutil.rmtree(str(dir.absolute()), ignore_errors=True) + + - name: CI Build + env: + STUART_CODEQL_PATH: ${{ steps.cache_key_gen.outputs.codeql_cli_ext_dep_dir }} + run: stuart_ci_build -c .pytool/CISettings.py -t DEBUG -p ${{ matrix.Package }} -a ${{ matrix.ArchList }} TOOL_CHAIN_TAG=VS2019 --codeql + + - name: Build Cleanup + id: build_cleanup + shell: python + run: | + import os + import shutil + from pathlib import Path + + dirs_to_delete = ['ia32', 'x64', 'arm', 'aarch64'] + + def delete_dirs(path: Path): + if path.exists() and path.is_dir(): + if path.name.lower() in dirs_to_delete: + print(f'Removed {str(path)}') + shutil.rmtree(path) + return + + for child_dir in path.iterdir(): + delete_dirs(child_dir) + + build_path = Path(os.environ['GITHUB_WORKSPACE'], 'Build') + delete_dirs(build_path) + + - name: Upload Build Logs As An Artifact + uses: actions/upload-artifact@v4 + if: success() || failure() + with: + name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-Build-Logs + path: | + **/BUILD_REPORT.TXT + **/OVERRIDELOG.TXT + **/BUILDLOG_*.md + **/BUILDLOG_*.txt + **/CI_*.md + **/CI_*.txt + retention-days: 7 + if-no-files-found: ignore + + - name: Prepare Env Data for CodeQL Upload + id: env_data + env: + PACKAGE_NAME: ${{ matrix.Package }} + shell: python + run: | + import logging + import os + from edk2toollib.utility_functions import RunCmd + from io import StringIO + from pathlib import Path + + package = os.environ['PACKAGE_NAME'].strip().lower() + directory_name = 'codeql-analysis-' + package + '-debug' + file_name = 'codeql-db-' + package + '-debug-0.sarif' + sarif_path = Path('Build', directory_name, file_name) + + with open(os.environ['GITHUB_OUTPUT'], 'a') as fh: + if sarif_path.is_file(): + emacs_file_path = sarif_path.with_name(sarif_path.stem + "-emacs.txt") + out_stream_buffer = StringIO() + exit_code = RunCmd("sarif", f"emacs {sarif_path} --output {emacs_file_path} --no-autotrim", + outstream=out_stream_buffer, + logging_level=logging.NOTSET) + print(f'upload_sarif_file=true', file=fh) + print(f'emacs_file_path={emacs_file_path}', file=fh) + print(f'sarif_file_path={sarif_path}', file=fh) + else: + print(f'upload_sarif_file=false', file=fh) + + - name: Upload CodeQL Results (SARIF) As An Artifact + uses: actions/upload-artifact@v4 + if: steps.env_data.outputs.upload_sarif_file == 'true' + with: + name: ${{ matrix.Package }}-${{ steps.convert_arch_hyphen.outputs.arch_list }}-CodeQL-SARIF + path: | + ${{ steps.env_data.outputs.emacs_file_path }} + ${{ steps.env_data.outputs.sarif_file_path }} + retention-days: 14 + if-no-files-found: warn + + - name: Upload CodeQL Results (SARIF) To GitHub Code Scanning + uses: github/codeql-action/upload-sarif@v3 + if: steps.env_data.outputs.upload_sarif_file == 'true' + with: + # Path to SARIF file relative to the root of the repository. + sarif_file: ${{ steps.env_data.outputs.sarif_file_path }} + # Optional category for the results. Used to differentiate multiple results for one commit. + # Each package is a separate category. + category: ${{ matrix.Package }} diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml index 1b7daa61fa..b329d9b9d2 100644 --- a/.github/workflows/pr-labeler.yml +++ b/.github/workflows/pr-labeler.yml @@ -1,36 +1,36 @@ -# This workflow automatically applies labels to pull requests based on regular expression matches against the content
-# in the pull request.
-#
-# Copyright (c) Microsoft Corporation.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-# For more information, see:
-# https://github.com/github/issue-labeler
-
-name: Apply Labels Based on Message Content
-
-on:
- pull_request_target:
- types:
- - edited
- - opened
- - reopened
- - synchronize
- workflow_dispatch:
-
-jobs:
- sync:
- name: Label PR from Description
- runs-on: ubuntu-latest
-
- permissions:
- contents: read
- pull-requests: write
-
- steps:
- - name: Apply Labels Based on PR Description
- uses: github/issue-labeler@v3.1
- with:
- configuration-path: .github/workflows/pr-labeler/regex.yml
- enable-versioned-regex: 0
- repo-token: ${{ secrets.GITHUB_TOKEN }}
+# This workflow automatically applies labels to pull requests based on regular expression matches against the content +# in the pull request. +# +# Copyright (c) Microsoft Corporation. +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +# For more information, see: +# https://github.com/github/issue-labeler + +name: Apply Labels Based on Message Content + +on: + pull_request_target: + types: + - edited + - opened + - reopened + - synchronize + workflow_dispatch: + +jobs: + sync: + name: Label PR from Description + runs-on: ubuntu-latest + + permissions: + contents: read + pull-requests: write + + steps: + - name: Apply Labels Based on PR Description + uses: github/issue-labeler@v3.1 + with: + configuration-path: .github/workflows/pr-labeler/regex.yml + enable-versioned-regex: 0 + repo-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pr-labeler/regex.yml b/.github/workflows/pr-labeler/regex.yml index b14746d169..672d1dd655 100644 --- a/.github/workflows/pr-labeler/regex.yml +++ b/.github/workflows/pr-labeler/regex.yml @@ -1,16 +1,16 @@ -# Specifies labels to apply to pull requests based on regular expressions.
-#
-# Copyright (c) Microsoft Corporation.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-# For more information, see:
-# https://github.com/github/issue-labeler
-
-impact:breaking-change:
- - '\s*-\s*\[\s*[x|X]\s*\] Breaking change\?'
-
-impact:security:
- - '\s*-\s*\[\s*[x|X]\s*\] Impacts security\?'
-
-impact:testing:
- - '\s*-\s*\[\s*[x|X]\s*\] Includes tests\?'
+# Specifies labels to apply to pull requests based on regular expressions. +# +# Copyright (c) Microsoft Corporation. +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +# For more information, see: +# https://github.com/github/issue-labeler + +impact:breaking-change: + - '\s*-\s*\[\s*[x|X]\s*\] Breaking change\?' + +impact:security: + - '\s*-\s*\[\s*[x|X]\s*\] Impacts security\?' + +impact:testing: + - '\s*-\s*\[\s*[x|X]\s*\] Includes tests\?' diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index b9160b548a..27acce76c8 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -1,44 +1,44 @@ -# This workflow warns and then closes issues and PRs that have had no activity
-# for a specified amount of time.
-#
-# For more information, see:
-# https://github.com/actions/stale
-#
-# Copyright (c) Microsoft Corporation.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-
-name: Stale Check
-
-on:
- schedule:
- # At 23:35 on every day-of-week from Sunday through Saturday
- # https://crontab.guru/#35_23_*_*_0-6
- - cron: '35 23 * * 0-6'
- workflow_dispatch:
-
-jobs:
- stale:
- name: Stale
- runs-on: ubuntu-latest
- permissions:
- issues: write
- pull-requests: write
-
- steps:
- - name: Check for Stale Items
- uses: actions/stale@v8
- with:
- days-before-issue-close: -1
- days-before-issue-stale: -1
- days-before-pr-stale: 60
- days-before-pr-close: 7
- stale-pr-message: >
- This PR has been automatically marked as stale because it has not had
- activity in 60 days. It will be closed if no further activity occurs within
- 7 days. Thank you for your contributions.
- close-pr-message: >
- This pull request has been automatically been closed because it did not have any
- activity in 60 days and no follow up within 7 days after being marked stale.
- Thank you for your contributions.
- stale-pr-label: stale
+# This workflow warns and then closes issues and PRs that have had no activity +# for a specified amount of time. +# +# For more information, see: +# https://github.com/actions/stale +# +# Copyright (c) Microsoft Corporation. +# SPDX-License-Identifier: BSD-2-Clause-Patent +# + +name: Stale Check + +on: + schedule: + # At 23:35 on every day-of-week from Sunday through Saturday + # https://crontab.guru/#35_23_*_*_0-6 + - cron: '35 23 * * 0-6' + workflow_dispatch: + +jobs: + stale: + name: Stale + runs-on: ubuntu-latest + permissions: + issues: write + pull-requests: write + + steps: + - name: Check for Stale Items + uses: actions/stale@v8 + with: + days-before-issue-close: -1 + days-before-issue-stale: -1 + days-before-pr-stale: 60 + days-before-pr-close: 7 + stale-pr-message: > + This PR has been automatically marked as stale because it has not had + activity in 60 days. It will be closed if no further activity occurs within + 7 days. Thank you for your contributions. + close-pr-message: > + This pull request has been automatically been closed because it did not have any + activity in 60 days and no follow up within 7 days after being marked stale. + Thank you for your contributions. + stale-pr-label: stale |