ProxyBridge/.github/workflows/codeql.yml at master · AnatolyJacobs/ProxyBridge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
name: "CodeQL"

on:
  push:
    branches: [ "master", "dev" ]
  pull_request:
    branches: [ "master", "dev" ]
  schedule:
    - cron: '0 4 * * 1'

jobs:

  analyze-cpp:
    name: Analyze (c-cpp)
    runs-on: windows-latest
    permissions:
      security-events: write

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
        with:
          languages: c-cpp

      - name: Download WinDivert
        run: |
          $url = "https://github.com/basil00/WinDivert/releases/download/v2.2.2/WinDivert-2.2.2-A.zip"
          $expectedHash = "63CB41763BB4B20F600B6DE04E991A9C2BE73279E317D4D82F237B150C5F3F15"
          Invoke-WebRequest -Uri $url -OutFile "WinDivert.zip" -UseBasicParsing
          $actualHash = (Get-FileHash "WinDivert.zip" -Algorithm SHA256).Hash
          if ($actualHash -ne $expectedHash) {
            Write-Error "WinDivert.zip SHA256 mismatch! Expected: $expectedHash  Got: $actualHash"
            exit 1
          }
          Expand-Archive -Path "WinDivert.zip" -DestinationPath "C:\"
        shell: pwsh

      - name: Build (MSVC)
        shell: pwsh
        run: |
          $vsPath = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" `
            -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 `
            -property installationPath
          $vcvars = Join-Path $vsPath "VC\Auxiliary\Build\vcvars64.bat"
          # Compile-only (/c) so CodeQL traces every C translation unit without needing
          # WinDivert.lib, NSIS or the linker. Covers the core DLL, the CLI and the GUI.
          $common = "/nologo /c /W4 /wd4100 /wd4189 /wd4267 /wd4244 /wd4996 /D_CRT_SECURE_NO_WARNINGS /D_WINSOCK_DEPRECATED_NO_WARNINGS /GS /guard:cf"
          # Core DLL
          cmd /c "`"$vcvars`" && cl.exe $common /DPROXYBRIDGE_EXPORTS /I`"C:\WinDivert-2.2.2-A\include`" Windows\src\ProxyBridge.c"
          # CLI
          cmd /c "`"$vcvars`" && cl.exe $common /D_WIN32_WINNT=0x0601 /DUNICODE /D_UNICODE Windows\cli\main.c"
          # Native C GUI (built from the gui folder so its subfolder includes resolve)
          cmd /c "`"$vcvars`" && cd Windows\gui && cl.exe $common /utf-8 /DUNICODE /D_UNICODE main.c profile\profile.c"

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
        with:
          category: "/language:c-cpp"

  analyze-swift:
    name: Analyze (swift)
    runs-on: macos-latest
    permissions:
      security-events: write

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
        with:
          languages: swift

      - name: Set up Xcode
        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
        with:
          xcode-version: latest-stable

      - name: Create stub xcconfig files
        run: |
          cat > MacOS/ProxyBridge/Signing-Config-app.xcconfig << 'EOF'
          PRODUCT_MODULE_NAME = ProxyBridge
          PRODUCT_NAME = ProxyBridge
          PRODUCT_BUNDLE_IDENTIFIER = com.interceptsuite.ProxyBridge
          ARCHS = arm64 x86_64
          ONLY_ACTIVE_ARCH = NO
          EOF
          # PRODUCT_NAME must match the extension's product filename recorded in the
          # Xcode project (com.interceptsuite.ProxyBridge.extension.systemextension),
          # otherwise the app target's "Embed System Extensions" copy phase fails with
          # "no such file". The module name stays the sanitized identifier.
          cat > MacOS/ProxyBridge/Signing-Config-ext.xcconfig << 'EOF'
          PRODUCT_MODULE_NAME = com_interceptsuite_ProxyBridge_extension
          PRODUCT_NAME = com.interceptsuite.ProxyBridge.extension
          PRODUCT_BUNDLE_IDENTIFIER = com.interceptsuite.ProxyBridge.extension
          ARCHS = arm64 x86_64
          ONLY_ACTIVE_ARCH = NO
          EOF

      - name: Build (no signing)
        run: |
          cd MacOS/ProxyBridge
          xcodebuild \
            -project ProxyBridge.xcodeproj \
            -scheme ProxyBridge \
            -configuration Release \
            -derivedDataPath build/DerivedData \
            ARCHS="arm64 x86_64" \
            ONLY_ACTIVE_ARCH=NO \
            CODE_SIGNING_ALLOWED=NO \
            CODE_SIGN_IDENTITY="" \
            DEVELOPMENT_TEAM="" \
            clean build

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
        with:
          category: "/language:swift"