Skip to content

Add cgo script support - byo #146

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alfredosa wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Add cgo script support - byo #146

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0b95516
Add cgo script support - byo
alfredosa Dec 16, 2025
5bb437c
add codeql lang support as input
alfredosa Dec 16, 2025
36361d9
bad sequence
alfredosa Dec 16, 2025
a461589
bad json formatting, needs a list of langs
alfredosa Dec 16, 2025
dee0f93
adding back removed comment
alfredosa Dec 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 32 additions & 1 deletion .github/workflows/supply-chain-security-validation.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,16 @@ on:
default: trivy-code-scanning
type: string
required: false
cgo-setup-script:
description: 'Path to CGO dependencies setup script (relative to repo root)'

@AtzeDeVries AtzeDeVries Jan 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there not a way to kinda unify this script? The way it is setup now is that it can inject anything which is a bit of a security risk. Some form of serialization at least would be good (or an issue to fix this)

required: false
type: string
default: ''
codeql-languages:
description: 'Override auto-detected languages (comma-separated, e.g., "go,python"). If not set, auto-detection will be used.'
required: false
type: string
default: ''
secrets: {}
jobs:
validate:
Expand Down Expand Up @@ -79,27 +89,40 @@ jobs:
steps:
- name: Check out repository
uses: actions/checkout@v6

- name: Configure access to internal and private GitHub repos
run: git config --global url."https://${{ secrets.REVIEWBOT_GITHUB_TOKEN }}:x-oauth-basic@github.com/coopnorge".insteadOf "https://github.com/coopnorge"

- uses: fabasoad/setup-enry-action@e81ba89a68c7823cea7b3bf591999534f7236441 # pin@main
- name: Detected Languages
id: detected-languages
run: echo "languages=$(enry | awk -F ' ' '{print $2}' | paste -sd ',' -)" >> $GITHUB_OUTPUT

- uses: actions/github-script@v8
name: Get CodeQL supported languages
id: languages
with:
result-encoding: json
script: |
// Check if languages are explicitly provided
const overrideLanguages = '${{ inputs.codeql-languages }}';
if (overrideLanguages) {
console.log('Using explicitly provided languages:', overrideLanguages);
return overrideLanguages.split(',').map(l => l.trim()).join(',');
}

// Otherwise, use auto-detection
const enryCodeQLMapping = {
'c#': 'csharp',
};

function getCodeQLLanguage(enryLang) {
if (enryLang in enryCodeQLMapping) {
return enryCodeQLMapping[enryLang];
}
return enryLang;
}

const detectedLanguages = '${{ steps.detected-languages.outputs.languages }}'.toLowerCase().split(',').map(language => {
return getCodeQLLanguage(language)
});
Expand All @@ -111,8 +134,9 @@ jobs:

const codeqlLanguages = ['c', 'cpp', 'csharp', 'go', 'python', 'java', 'javascript', 'typescript', 'actions'];
const languages = detectedLanguages.filter(language => codeqlLanguages.includes(language));

return languages.join(',');

- name: "Determine Go version"
run: |
if [ -z "${{ inputs.codeql-go-version }}" ]; then
Expand All @@ -122,6 +146,7 @@ jobs:
echo "GO_VERSION=${{ inputs.codeql-go-version }}" >> $GITHUB_ENV
echo "GO_CHECK_LATEST=false" >> $GITHUB_ENV
fi

- name: Set Go version
uses: actions/setup-go@v6
with:
Expand All @@ -130,6 +155,12 @@ jobs:
cache: true
cache-dependency-path: "**/go.sum"

- name: Set up CGO dependencies
if: inputs.cgo-setup-script != ''
run: |
chmod +x ${{ inputs.cgo-setup-script }}
${{ inputs.cgo-setup-script }}

- name: Set Java version
uses: actions/setup-java@v5
with:
Expand Down