From a7d11acdd8b93feb4a70b0b294837421a72e5518 Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Mon, 20 Jul 2026 15:22:27 +0530 Subject: [PATCH 01/14] RDKB-66116 : update dbus dependency branch to 1.14.10-3-1deepin3 Reason for change: Address PRs native builds failing in the javascript-templates Test Procedure: PRs native builds should pass for javascript-templates Risks: Low Priority: P2 --- cov_docker_script/component_config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cov_docker_script/component_config.json b/cov_docker_script/component_config.json index c4d738f..13ca66b 100644 --- a/cov_docker_script/component_config.json +++ b/cov_docker_script/component_config.json @@ -76,7 +76,7 @@ { "name": "dbus", "repo": "https://github.com/deepin-community/dbus.git", - "branch" : "master", + "branch" : "1.14.10-3-1deepin3", "build": { "type": "cmake", "build_dir": "build", From 90f1181fad291a69392f72aaf794d2ab5ef3a0df Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Mon, 20 Jul 2026 17:29:37 +0530 Subject: [PATCH 02/14] switch dbus dependency branch to dbus-1.14 --- cov_docker_script/component_config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cov_docker_script/component_config.json b/cov_docker_script/component_config.json index 13ca66b..91c1659 100644 --- a/cov_docker_script/component_config.json +++ b/cov_docker_script/component_config.json @@ -76,7 +76,7 @@ { "name": "dbus", "repo": "https://github.com/deepin-community/dbus.git", - "branch" : "1.14.10-3-1deepin3", + "branch" : "dbus-1.14", "build": { "type": "cmake", "build_dir": "build", From e15cad9ba3298bf33e58c949cceddbc5e21bbc69 Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B <57708013+pavankumar464@users.noreply.github.com> Date: Mon, 20 Jul 2026 17:32:12 +0530 Subject: [PATCH 03/14] Update component_config.json --- cov_docker_script/component_config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cov_docker_script/component_config.json b/cov_docker_script/component_config.json index 91c1659..ed426a2 100644 --- a/cov_docker_script/component_config.json +++ b/cov_docker_script/component_config.json @@ -76,7 +76,7 @@ { "name": "dbus", "repo": "https://github.com/deepin-community/dbus.git", - "branch" : "dbus-1.14", + "branch": "dbus-1.14", "build": { "type": "cmake", "build_dir": "build", From ab52f90d3062fa1dcfa39518b1c364e48c2cbb02 Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Tue, 21 Jul 2026 10:31:34 +0530 Subject: [PATCH 04/14] use freedesktop dbus repo and normalize branch key formatting --- cov_docker_script/component_config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cov_docker_script/component_config.json b/cov_docker_script/component_config.json index ed426a2..e3e6448 100644 --- a/cov_docker_script/component_config.json +++ b/cov_docker_script/component_config.json @@ -75,7 +75,7 @@ }, { "name": "dbus", - "repo": "https://github.com/deepin-community/dbus.git", + "repo": "https://gitlab.freedesktop.org/dbus/dbus.git", "branch": "dbus-1.14", "build": { "type": "cmake", From 433e70c98c701ec42ccc0c1389701ffe7d222ce7 Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Tue, 21 Jul 2026 12:01:16 +0530 Subject: [PATCH 05/14] add repository-specific CodeQL workflow --- .github/workflows/codeql.yml | 80 ++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..4a053a4 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,80 @@ +name: CodeQL Analysis + +on: + push: + branches: [ main, 'sprint/**', 'release/**', develop ] + pull_request: + branches: [ main, 'sprint/**', 'release/**', topic/RDK*, develop ] + schedule: + - cron: '23 3 * * 1' + +permissions: + actions: read + contents: read + security-events: write + +concurrency: + group: codeql-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + analyze-cpp: + name: Analyze C/C++ + runs-on: ubuntu-latest + container: + image: ghcr.io/rdkcentral/docker-rdk-ci:latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + submodules: recursive + + - name: Initialize CodeQL (C/C++) + uses: github/codeql-action/init@v3 + with: + languages: cpp + build-mode: manual + queries: security-extended,security-and-quality + config: | + paths-ignore: + - source/duktape/** + - build/** + + - name: Build native component for CodeQL extraction + run: | + git config --global --add safe.directory '*' + git submodule update --init --recursive --remote + chmod +x build_tools_workflows/cov_docker_script/setup_dependencies.sh + ./build_tools_workflows/cov_docker_script/setup_dependencies.sh ./cov_docker_script/component_config.json + chmod +x build_tools_workflows/cov_docker_script/build_native.sh + ./build_tools_workflows/cov_docker_script/build_native.sh ./cov_docker_script/component_config.json "$(pwd)" + env: + GITHUB_TOKEN: ${{ secrets.RDKCM_RDKE || github.token }} + + - name: Perform CodeQL analysis (C/C++) + uses: github/codeql-action/analyze@v3 + with: + category: '/language:cpp' + + analyze-python: + name: Analyze Python + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Initialize CodeQL (Python) + uses: github/codeql-action/init@v3 + with: + languages: python + queries: security-extended,security-and-quality + config: | + paths-ignore: + - build/** + + - name: Perform CodeQL analysis (Python) + uses: github/codeql-action/analyze@v3 + with: + category: '/language:python' From 02143c408f9aa2946d655d780a38bf9335fe6f92 Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Tue, 21 Jul 2026 21:24:28 +0530 Subject: [PATCH 06/14] revert: remove repository-specific CodeQL workflow --- .github/workflows/codeql.yml | 80 ------------------------------------ 1 file changed, 80 deletions(-) delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 4a053a4..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: CodeQL Analysis - -on: - push: - branches: [ main, 'sprint/**', 'release/**', develop ] - pull_request: - branches: [ main, 'sprint/**', 'release/**', topic/RDK*, develop ] - schedule: - - cron: '23 3 * * 1' - -permissions: - actions: read - contents: read - security-events: write - -concurrency: - group: codeql-${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - analyze-cpp: - name: Analyze C/C++ - runs-on: ubuntu-latest - container: - image: ghcr.io/rdkcentral/docker-rdk-ci:latest - - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - submodules: recursive - - - name: Initialize CodeQL (C/C++) - uses: github/codeql-action/init@v3 - with: - languages: cpp - build-mode: manual - queries: security-extended,security-and-quality - config: | - paths-ignore: - - source/duktape/** - - build/** - - - name: Build native component for CodeQL extraction - run: | - git config --global --add safe.directory '*' - git submodule update --init --recursive --remote - chmod +x build_tools_workflows/cov_docker_script/setup_dependencies.sh - ./build_tools_workflows/cov_docker_script/setup_dependencies.sh ./cov_docker_script/component_config.json - chmod +x build_tools_workflows/cov_docker_script/build_native.sh - ./build_tools_workflows/cov_docker_script/build_native.sh ./cov_docker_script/component_config.json "$(pwd)" - env: - GITHUB_TOKEN: ${{ secrets.RDKCM_RDKE || github.token }} - - - name: Perform CodeQL analysis (C/C++) - uses: github/codeql-action/analyze@v3 - with: - category: '/language:cpp' - - analyze-python: - name: Analyze Python - runs-on: ubuntu-latest - - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Initialize CodeQL (Python) - uses: github/codeql-action/init@v3 - with: - languages: python - queries: security-extended,security-and-quality - config: | - paths-ignore: - - build/** - - - name: Perform CodeQL analysis (Python) - uses: github/codeql-action/analyze@v3 - with: - category: '/language:python' From e10d8fd8ecd9bb9a18b416f8a02ef88f569851f7 Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Tue, 21 Jul 2026 21:42:30 +0530 Subject: [PATCH 07/14] add conditional CodeQL scans for C/C++, Python, and JavaScript --- .github/workflows/native-build.yml | 126 +++++++++++++++++++++++++++++ 1 file changed, 126 insertions(+) diff --git a/.github/workflows/native-build.yml b/.github/workflows/native-build.yml index 5be45d3..c983bbc 100644 --- a/.github/workflows/native-build.yml +++ b/.github/workflows/native-build.yml @@ -6,6 +6,11 @@ on: pull_request: branches: [ main, 'sprint/**', 'release/**', topic/RDK*, develop ] +permissions: + actions: read + contents: read + security-events: write + jobs: build-jst-on-pr: name: Build javascript-templates component in github rdkcentral @@ -31,3 +36,124 @@ jobs: ./build_tools_workflows/cov_docker_script/build_native.sh ./cov_docker_script/component_config.json "$(pwd)" env: GITHUB_TOKEN: ${{ secrets.RDKCM_RDKE }} + + detect-source-changes: + name: Detect source path changes for CodeQL + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + outputs: + has_cpp: ${{ steps.filter.outputs.cpp }} + has_python: ${{ steps.filter.outputs.python }} + has_js: ${{ steps.filter.outputs.javascript }} + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Detect changed source paths + id: filter + uses: dorny/paths-filter@v3 + with: + filters: | + cpp: + - 'source/**/*.c' + - 'source/**/*.h' + - 'source/**/*.cpp' + - 'tools/**/*.c' + - 'tools/**/*.h' + - 'tools/**/*.cpp' + - 'tests/**/*.c' + - 'tests/**/*.h' + - 'tests/**/*.cpp' + python: + - 'build_tools_workflows/**/*.py' + - 'cov_docker_script/**/*.py' + - 'tools/**/*.py' + - 'tests/**/*.py' + javascript: + - 'source/**/*.js' + + codeql-c-cpp: + name: CodeQL (C/C++) + needs: detect-source-changes + if: github.event_name == 'pull_request' && needs.detect-source-changes.outputs.has_cpp == 'true' + runs-on: ubuntu-latest + container: + image: ghcr.io/rdkcentral/docker-rdk-ci:latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Initialize CodeQL (C/C++) + uses: github/codeql-action/init@v4 + with: + languages: c-cpp + build-mode: manual + + - name: Build component for CodeQL + run: | + git config --global --add safe.directory '*' + git submodule update --init --recursive --remote + chmod +x build_tools_workflows/cov_docker_script/setup_dependencies.sh + ./build_tools_workflows/cov_docker_script/setup_dependencies.sh ./cov_docker_script/component_config.json + chmod +x build_tools_workflows/cov_docker_script/build_native.sh + ./build_tools_workflows/cov_docker_script/build_native.sh ./cov_docker_script/component_config.json "$(pwd)" + env: + GITHUB_TOKEN: ${{ secrets.RDKCM_RDKE }} + + - name: Analyze C/C++ + uses: github/codeql-action/analyze@v4 + with: + category: '/language:c-cpp' + + codeql-python: + name: CodeQL (Python) + needs: detect-source-changes + if: github.event_name == 'pull_request' && needs.detect-source-changes.outputs.has_python == 'true' + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Initialize CodeQL (Python) + uses: github/codeql-action/init@v4 + with: + languages: python + build-mode: none + config: | + paths: + - build_tools_workflows + - cov_docker_script + - tools + - tests + + - name: Analyze Python + uses: github/codeql-action/analyze@v4 + with: + category: '/language:python' + + codeql-javascript: + name: CodeQL (JavaScript) + needs: detect-source-changes + if: github.event_name == 'pull_request' && needs.detect-source-changes.outputs.has_js == 'true' + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Initialize CodeQL (JavaScript) + uses: github/codeql-action/init@v4 + with: + languages: javascript-typescript + build-mode: none + config: | + paths: + - source + + - name: Analyze JavaScript + uses: github/codeql-action/analyze@v4 + with: + category: '/language:javascript-typescript' From 87ac22b1c01f5ca4c6f1eb9a48ed66c5296ed08e Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Tue, 21 Jul 2026 21:50:13 +0530 Subject: [PATCH 08/14] skip native component build when PR does not touch source paths --- .github/workflows/native-build.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/native-build.yml b/.github/workflows/native-build.yml index c983bbc..4214ea0 100644 --- a/.github/workflows/native-build.yml +++ b/.github/workflows/native-build.yml @@ -14,6 +14,8 @@ permissions: jobs: build-jst-on-pr: name: Build javascript-templates component in github rdkcentral + needs: detect-source-changes + if: github.event_name != 'pull_request' || needs.detect-source-changes.outputs.has_component == 'true' runs-on: ubuntu-latest container: image: ghcr.io/rdkcentral/docker-rdk-ci:latest @@ -39,9 +41,9 @@ jobs: detect-source-changes: name: Detect source path changes for CodeQL - if: github.event_name == 'pull_request' runs-on: ubuntu-latest outputs: + has_component: ${{ steps.filter.outputs.component }} has_cpp: ${{ steps.filter.outputs.cpp }} has_python: ${{ steps.filter.outputs.python }} has_js: ${{ steps.filter.outputs.javascript }} @@ -55,6 +57,8 @@ jobs: uses: dorny/paths-filter@v3 with: filters: | + component: + - 'source/**/*' cpp: - 'source/**/*.c' - 'source/**/*.h' From 777286ff1306acdf381204d83dd2ff058d8dc643 Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B <57708013+pavankumar464@users.noreply.github.com> Date: Tue, 21 Jul 2026 22:13:37 +0530 Subject: [PATCH 09/14] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/native-build.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/native-build.yml b/.github/workflows/native-build.yml index 4214ea0..9e6c944 100644 --- a/.github/workflows/native-build.yml +++ b/.github/workflows/native-build.yml @@ -9,6 +9,7 @@ on: permissions: actions: read contents: read + pull-requests: read security-events: write jobs: @@ -76,7 +77,8 @@ jobs: - 'tests/**/*.py' javascript: - 'source/**/*.js' - + - 'jsts/**/*.js' + - 'tests/**/*.js' codeql-c-cpp: name: CodeQL (C/C++) needs: detect-source-changes @@ -156,7 +158,8 @@ jobs: config: | paths: - source - + - jsts + - tests/parser - name: Analyze JavaScript uses: github/codeql-action/analyze@v4 with: From 09c34f783f2a5d82fd21fadd7f684289bc3ae4a2 Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Tue, 21 Jul 2026 22:18:49 +0530 Subject: [PATCH 10/14] ci: update remaining actions/checkout to v4 in native-build workflow --- .github/workflows/native-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/native-build.yml b/.github/workflows/native-build.yml index 9e6c944..e0e1d92 100644 --- a/.github/workflows/native-build.yml +++ b/.github/workflows/native-build.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: native build run: | From 01648a1468e29ef8cefc2412e152be87eeff98ea Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B <57708013+pavankumar464@users.noreply.github.com> Date: Tue, 21 Jul 2026 22:28:56 +0530 Subject: [PATCH 11/14] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/native-build.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/native-build.yml b/.github/workflows/native-build.yml index e0e1d92..28d1bdb 100644 --- a/.github/workflows/native-build.yml +++ b/.github/workflows/native-build.yml @@ -52,7 +52,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v4 - + with: + fetch-depth: 0 - name: Detect changed source paths id: filter uses: dorny/paths-filter@v3 From fb92be43b4fb011edac05e5a7adccf8f141a91f3 Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Tue, 21 Jul 2026 22:36:27 +0530 Subject: [PATCH 12/14] ci: scope security-events write permission to CodeQL jobs only --- .github/workflows/native-build.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/native-build.yml b/.github/workflows/native-build.yml index 28d1bdb..ee38714 100644 --- a/.github/workflows/native-build.yml +++ b/.github/workflows/native-build.yml @@ -10,7 +10,6 @@ permissions: actions: read contents: read pull-requests: read - security-events: write jobs: build-jst-on-pr: @@ -85,6 +84,10 @@ jobs: needs: detect-source-changes if: github.event_name == 'pull_request' && needs.detect-source-changes.outputs.has_cpp == 'true' runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write container: image: ghcr.io/rdkcentral/docker-rdk-ci:latest @@ -119,6 +122,10 @@ jobs: needs: detect-source-changes if: github.event_name == 'pull_request' && needs.detect-source-changes.outputs.has_python == 'true' runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write steps: - name: Checkout code @@ -146,6 +153,10 @@ jobs: needs: detect-source-changes if: github.event_name == 'pull_request' && needs.detect-source-changes.outputs.has_js == 'true' runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write steps: - name: Checkout code From 8fc6024c5abd23c859f47d0e3dfaa44c5a2ea3ec Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Tue, 21 Jul 2026 22:39:15 +0530 Subject: [PATCH 13/14] ci: split native build by event and run path detection only for PRs --- .github/workflows/native-build.yml | 32 ++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/.github/workflows/native-build.yml b/.github/workflows/native-build.yml index ee38714..cfa739f 100644 --- a/.github/workflows/native-build.yml +++ b/.github/workflows/native-build.yml @@ -12,10 +12,36 @@ permissions: pull-requests: read jobs: + build-jst-on-push: + name: Build javascript-templates component on push + if: github.event_name == 'push' + runs-on: ubuntu-latest + container: + image: ghcr.io/rdkcentral/docker-rdk-ci:latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: native build + run: | + # Trust the workspace + git config --global --add safe.directory '*' + # Pull the latest changes for the native build system + git submodule update --init --recursive --remote + # Build and install dependencies + chmod +x build_tools_workflows/cov_docker_script/setup_dependencies.sh + ./build_tools_workflows/cov_docker_script/setup_dependencies.sh ./cov_docker_script/component_config.json + # Build component + chmod +x build_tools_workflows/cov_docker_script/build_native.sh + ./build_tools_workflows/cov_docker_script/build_native.sh ./cov_docker_script/component_config.json "$(pwd)" + env: + GITHUB_TOKEN: ${{ secrets.RDKCM_RDKE }} + build-jst-on-pr: - name: Build javascript-templates component in github rdkcentral + name: Build javascript-templates component on PR needs: detect-source-changes - if: github.event_name != 'pull_request' || needs.detect-source-changes.outputs.has_component == 'true' + if: github.event_name == 'pull_request' && needs.detect-source-changes.outputs.has_component == 'true' runs-on: ubuntu-latest container: image: ghcr.io/rdkcentral/docker-rdk-ci:latest @@ -41,6 +67,7 @@ jobs: detect-source-changes: name: Detect source path changes for CodeQL + if: github.event_name == 'pull_request' runs-on: ubuntu-latest outputs: has_component: ${{ steps.filter.outputs.component }} @@ -79,6 +106,7 @@ jobs: - 'source/**/*.js' - 'jsts/**/*.js' - 'tests/**/*.js' + codeql-c-cpp: name: CodeQL (C/C++) needs: detect-source-changes From f30aeff31e86910389a7c86f09a85d0666ef0fae Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B <57708013+pavankumar464@users.noreply.github.com> Date: Tue, 21 Jul 2026 22:45:16 +0530 Subject: [PATCH 14/14] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/native-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/native-build.yml b/.github/workflows/native-build.yml index cfa739f..0044c7d 100644 --- a/.github/workflows/native-build.yml +++ b/.github/workflows/native-build.yml @@ -132,7 +132,7 @@ jobs: - name: Build component for CodeQL run: | git config --global --add safe.directory '*' - git submodule update --init --recursive --remote + git submodule update --init --recursive chmod +x build_tools_workflows/cov_docker_script/setup_dependencies.sh ./build_tools_workflows/cov_docker_script/setup_dependencies.sh ./cov_docker_script/component_config.json chmod +x build_tools_workflows/cov_docker_script/build_native.sh