Skip to content

RDKB-62985 RDKB-62986: Native build for Coverity #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
GoutamD2905 merged 16 commits into from
Feb 19, 2026
Merged

RDKB-62985 RDKB-62986: Native build for Coverity #39

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
111e0f9
Native build for Coverity
sowmiyachelliah Jan 19, 2026
ade908b
Update component_config.json
sowmiyachelliah Jan 19, 2026
cde2cec
Update component_config.json
sowmiyachelliah Jan 19, 2026
3e3633a
Update component_config.json
sowmiyachelliah Jan 19, 2026
e576e65
Update code
sowmiyachelliah Jan 30, 2026
919e89e
Update native-build.yml
sowmiyachelliah Jan 30, 2026
beae32e
Update configure_options.conf
sowmiyachelliah Jan 30, 2026
76dfd24
Update component_config.json
sowmiyachelliah Jan 30, 2026
78d72b0
Update code
sowmiyachelliah Jan 30, 2026
a48ab3e
Adding sub-modules
sowmiyachelliah Feb 9, 2026
155de65
Updating README.md
sowmiyachelliah Feb 9, 2026
056451a
Updating configure_options.conf
sowmiyachelliah Feb 11, 2026
c2a5b41
Update configure_options.conf
sowmiyachelliah Feb 11, 2026
2615d01
Updating configure_options.conf and component_config.json
sowmiyachelliah Feb 17, 2026
2bcf44c
Updating component_config.json
sowmiyachelliah Feb 17, 2026
bc067ea
Merge branch 'develop' into feature/native_component_build
GoutamD2905 Feb 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions .github/workflows/native-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
name: Build Advanced Security Component in Native Environment

on:
push:
branches: [ main, 'sprint/**', 'release/**', develop ]
pull_request:
branches: [ main, 'sprint/**', 'release/**', topic/RDK*, develop ]

jobs:
build-advanced-security-on-pr:
name: Build advanced-security component in github rdkcentral
runs-on: ubuntu-latest
container:
image: ghcr.io/rdkcentral/docker-rdk-ci:latest
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using the latest tag makes CI non-reproducible and can break builds when the image changes. Pin the container image to a specific version tag or immutable digest (e.g., @sha256:...) so Coverity/native builds are stable over time.

Suggested change
image: ghcr.io/rdkcentral/docker-rdk-ci:latest
image: ghcr.io/rdkcentral/docker-rdk-ci:1.5.0

Copilot uses AI. Check for mistakes.

steps:
- name: Checkout code
uses: actions/checkout@v3
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout@v3 is outdated. Update to actions/checkout@v4 (or the repository-standard pinned major) to pick up security and performance fixes.

Suggested change
uses: actions/checkout@v3
uses: actions/checkout@v4

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout@v3 is outdated and misses fixes/features added in newer major versions. Bump to the current supported major version (and consider pinning to a commit SHA for supply-chain hardening).

Suggested change
uses: actions/checkout@v3
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

Copilot uses AI. Check for mistakes.

- name: native build
run: |
chmod +x cov_docker_script/run_setup_dependencies.sh
./cov_docker_script/run_setup_dependencies.sh
chmod +x cov_docker_script/run_native_build.sh
./cov_docker_script/run_native_build.sh
env:
GITHUB_TOKEN: ${{ secrets.RDKCM_RDKE }}
Comment on lines 11 to 36

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 12 days ago

To fix the problem, explicitly define minimal GITHUB_TOKEN permissions for this workflow or job, instead of relying on inherited repository/organization defaults. Since this workflow only checks out the repository and runs build scripts, it likely only needs read access to repository contents.

The best minimal fix without changing existing functionality is to add a permissions block at the job level for build-advanced-security-on-pr, specifying contents: read. This constrains the default GITHUB_TOKEN to read-only for repository contents, while leaving the custom GITHUB_TOKEN environment variable (secrets.RDKCM_RDKE) unchanged. Concretely, in .github/workflows/native-build.yml, under jobs:, inside the build-advanced-security-on-pr: job and at the same indentation level as runs-on, add:

permissions:
  contents: read

No new methods, imports, or additional definitions are needed; this is a pure YAML configuration change.

Suggested changeset 1
.github/workflows/native-build.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/native-build.yml b/.github/workflows/native-build.yml
--- a/.github/workflows/native-build.yml
+++ b/.github/workflows/native-build.yml
@@ -10,6 +10,8 @@
   build-advanced-security-on-pr:
     name: Build advanced-security component in github rdkcentral
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     container:
       image: ghcr.io/rdkcentral/docker-rdk-ci:latest
 
EOF
@@ -10,6 +10,8 @@
build-advanced-security-on-pr:
name: Build advanced-security component in github rdkcentral
runs-on: ubuntu-latest
permissions:
contents: read
container:
image: ghcr.io/rdkcentral/docker-rdk-ci:latest

Copilot is powered by AI and may make mistakes. Always verify output.
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overriding GITHUB_TOKEN with a separate secret increases the risk of accidental token exposure (e.g., script logging) and can also break PR builds from forks where secrets aren’t available. Prefer the built-in GitHub token (${{ github.token }} / ${{ secrets.GITHUB_TOKEN }}) or pass a separate token under a different env var name with the minimum required permissions.

Suggested change
GITHUB_TOKEN: ${{ secrets.RDKCM_RDKE }}
GITHUB_TOKEN: ${{ github.token }}
RDKCM_RDKE_TOKEN: ${{ secrets.RDKCM_RDKE }}

Copilot uses AI. Check for mistakes.
Loading
Loading