GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Add security CI workflows · php-debugger/php-debugger@e848602

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
  • .github/workflows
    • clang-analyzer.yml
    • codeql.yml
    • cppcheck.yml
    • sanitizers.yml
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎.github/workflows/clang-analyzer.yml‎

Copy file name to clipboard
+35Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: "Clang Static Analyzer"
2+
3+
on:
4+
schedule:
5+
- cron: '0 4 * * 0' # Weekly Sunday 4am UTC
6+
workflow_dispatch:
7+
8+
jobs:
9+
clang-sa:
10+
name: Clang Static Analyzer
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- name: Checkout
15+
uses: actions/checkout@v6
16+
17+
- name: Install dependencies
18+
run: |
19+
sudo apt-get update
20+
sudo apt-get install -y clang clang-tools php8.3-dev
21+
22+
- name: Run scan-build
23+
run: |
24+
phpize
25+
scan-build --status-bugs -o scan-results \
26+
./configure --enable-php-debugger
27+
scan-build --status-bugs -o scan-results \
28+
make -j$(nproc)
29+
30+
- name: Upload scan-build report
31+
if: always()
32+
uses: actions/upload-artifact@v4
33+
with:
34+
name: clang-sa-report
35+
path: scan-results/
Collapse file

‎.github/workflows/codeql.yml‎

Copy file name to clipboard
+46Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: "CodeQL Security Analysis"
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
- cron: '0 6 * * 1' # Weekly Monday 6am UTC
10+
11+
permissions:
12+
security-events: write
13+
contents: read
14+
15+
jobs:
16+
codeql:
17+
name: CodeQL Analysis
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Checkout repository
22+
uses: actions/checkout@v6
23+
24+
- name: Setup PHP
25+
uses: shivammathur/setup-php@v2
26+
with:
27+
php-version: '8.4'
28+
coverage: none
29+
extensions: xmlreader
30+
31+
- name: Initialize CodeQL
32+
uses: github/codeql-action/init@v3
33+
with:
34+
languages: c-cpp
35+
queries: security-extended
36+
37+
- name: Build extension (observed by CodeQL)
38+
run: |
39+
phpize
40+
./configure --enable-php-debugger
41+
make -j$(nproc)
42+
43+
- name: Perform CodeQL Analysis
44+
uses: github/codeql-action/analyze@v3
45+
with:
46+
category: "/language:c-cpp"
Collapse file

‎.github/workflows/cppcheck.yml‎

Copy file name to clipboard
+51Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: "Cppcheck Analysis"
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
jobs:
10+
cppcheck:
11+
name: Cppcheck
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@v6
17+
18+
- name: Install cppcheck and PHP dev
19+
run: |
20+
sudo apt-get update
21+
sudo apt-get install -y cppcheck php8.3-dev
22+
23+
- name: Generate compile config
24+
run: |
25+
phpize
26+
./configure --enable-php-debugger
27+
28+
- name: Run cppcheck
29+
run: |
30+
cppcheck \
31+
--enable=warning,performance,portability \
32+
--std=c11 \
33+
--error-exitcode=1 \
34+
--suppress=missingIncludeSystem \
35+
--inline-suppr \
36+
--force \
37+
--quiet \
38+
-I . \
39+
-I src/ \
40+
-I src/base/ \
41+
-I src/debugger/ \
42+
-I src/lib/ \
43+
-I src/inspect/ \
44+
src/ xdebug.c 2>&1 | tee cppcheck-report.txt
45+
46+
- name: Upload cppcheck report
47+
if: always()
48+
uses: actions/upload-artifact@v4
49+
with:
50+
name: cppcheck-report
51+
path: cppcheck-report.txt
Collapse file

‎.github/workflows/sanitizers.yml‎

Copy file name to clipboard
+95Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
name: "Sanitizer Tests (ASAN + UBSAN)"
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
jobs:
10+
sanitizers:
11+
name: "ASAN + UBSAN — PHP ${{ matrix.php }}"
12+
runs-on: ubuntu-latest
13+
strategy:
14+
fail-fast: false
15+
matrix:
16+
php: ['8.3', '8.4']
17+
18+
env:
19+
ASAN_OPTIONS: "detect_leaks=1:detect_stack_use_after_return=1:abort_on_error=1"
20+
UBSAN_OPTIONS: "print_stacktrace=1:halt_on_error=1"
21+
22+
steps:
23+
- name: Checkout extension
24+
uses: actions/checkout@v6
25+
26+
- name: Install build dependencies
27+
run: |
28+
sudo apt-get update
29+
sudo apt-get install -y \
30+
build-essential autoconf automake libtool re2c bison \
31+
clang llvm libxml2-dev libsqlite3-dev pkg-config
32+
33+
- name: Cache PHP build
34+
uses: actions/cache@v4
35+
id: php-cache
36+
with:
37+
path: ~/php-install
38+
key: php-asan-${{ matrix.php }}-${{ hashFiles('.github/workflows/sanitizers.yml') }}
39+
40+
- name: Build PHP with sanitizers
41+
if: steps.php-cache.outputs.cache-hit != 'true'
42+
run: |
43+
git clone --depth=1 --branch="PHP-${{ matrix.php }}" \
44+
https://github.com/php/php-src.git ~/php-src
45+
46+
cd ~/php-src
47+
./buildconf --force
48+
49+
CC=clang CXX=clang++ \
50+
./configure \
51+
--prefix=$HOME/php-install \
52+
--enable-debug \
53+
--enable-address-sanitizer \
54+
--enable-undefined-sanitizer \
55+
--disable-all \
56+
--enable-cli \
57+
--enable-session \
58+
--enable-xml \
59+
--with-libxml \
60+
--enable-opcache=no \
61+
--without-pear
62+
63+
make -j$(nproc)
64+
make install
65+
66+
- name: Build extension with sanitizers
67+
run: |
68+
export PATH="$HOME/php-install/bin:$PATH"
69+
phpize
70+
CC=clang CXX=clang++ \
71+
CFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g" \
72+
LDFLAGS="-fsanitize=address,undefined" \
73+
./configure --enable-php-debugger --with-php-config=$HOME/php-install/bin/php-config
74+
make -j$(nproc)
75+
76+
- name: Verify extension loads
77+
run: |
78+
export PATH="$HOME/php-install/bin:$PATH"
79+
php -d "zend_extension=$PWD/modules/php_debugger.so" -v
80+
81+
- name: Run tests under sanitizers
82+
run: |
83+
export PATH="$HOME/php-install/bin:$PATH"
84+
export TEST_PHP_EXECUTABLE=$(which php)
85+
export TEST_PHP_ARGS="-n -d session.save_path=/tmp -d zend_extension=$PWD/modules/php_debugger.so"
86+
php -n run-xdebug-tests.php --asan -j$(nproc) -q --show-diff tests/debugger/
87+
88+
- name: Upload test logs on failure
89+
if: failure()
90+
uses: actions/upload-artifact@v4
91+
with:
92+
name: sanitizer-logs-${{ matrix.php }}
93+
path: |
94+
tests/debugger/*.log
95+
tests/debugger/*.diff

0 commit comments

Comments
0 (0)
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.