Skip to content

Document CodeQL static-analysis setup in README #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tillkamppeter merged 1 commit into from
Aug 16, 2026
Merged

Document CodeQL static-analysis setup in README #87

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,3 +120,27 @@ compatibility.
* [cups-filters 2021 (PDF)](https://ftp.pwg.org/pub/pwg/liaison/openprinting/presentations/cups-filters-cups-snap-ipp-usb-and-more-2021.pdf)
* [cups-filters 2022 (PDF)](https://ftp.pwg.org/pub/pwg/liaison/openprinting/presentations/cups-filters-cups-snap-ipp-usb-and-more-2022.pdf)

## Continuous Integration and Static Analysis

This repository is checked on every push and pull request by GitHub Actions
workflows in `.github/workflows/`:

- **Build** (`build.yml`) - builds the project (multi-architecture where
applicable) so build/link regressions are caught early.
- **CodeQL** (`codeql-analysis.yml`) - GitHub's semantic static-analysis engine, using the
`security-and-quality` query suite.

### CodeQL Static Analysis Configuration

This repository uses a custom GitHub Actions workflow for CodeQL static analysis located at `.github/workflows/codeql-analysis.yml`. To ensure accurate analysis and avoid conflicts with GitHub's default settings, the following repository configurations are required:

1. **Enable Advanced Setup**:
- Go to **Settings** -> **Code security and analysis**.
- Under **Code scanning**, locate **CodeQL analysis**.
- If "Default" is enabled, click the three dots (...) and select **Switch to advanced**.
2. **Disable Default Setup**:
- The "Default" setup must be disabled for the custom workflow to upload results successfully.
3. **Custom Workflow Dependencies**:
- Our custom workflow is designed to install specific project dependencies and perform a manual build before the analysis. This ensures that CodeQL has a complete build graph for the C sources in this repository.

*Note: If the Default setup is active, GitHub may reject the results uploaded by the manual workflow, causing the CI job to fail.*
Loading