CodeQL #139
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CodeQL" | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Run daily at 04:00 UTC | |
| - cron: "0 4 * * *" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| analyze: | |
| if: github.event_name != 'schedule' || github.repository == 'BerriAI/litellm' | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| security-events: write | |
| packages: read | |
| actions: read | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: actions | |
| build-mode: none | |
| - language: javascript-typescript | |
| build-mode: none | |
| - language: python | |
| build-mode: none | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 | |
| with: | |
| persist-credentials: false | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| config-file: ./.github/codeql/codeql-config.yml | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| output: sarif-results | |
| upload: failure-only | |
| # py/weak-sensitive-data-hashing (CWE-328) fires on the OCI signing call at | |
| # litellm/llms/oci/common_utils.py, which hashes the HTTP request body to | |
| # produce the x-content-sha256 header required by the OCI HTTP signing spec — | |
| # a content-integrity hash, not a password or secret hash. SHA-256 is mandated | |
| # by Oracle for this header; see | |
| # https://docs.oracle.com/en-us/iaas/Content/API/Concepts/signingrequests.htm | |
| # The `usedforsecurity=False` flag on the hashlib.sha256 call already declares | |
| # non-security intent, but CodeQL's taint flow still re-fires when callers | |
| # further up the stack are modified. The suppression is scoped to this one | |
| # file/rule pair via SARIF post-filtering so every other callsite of | |
| # py/weak-sensitive-data-hashing in the repository continues to be analyzed. | |
| - name: Filter SARIF (OCI sha256) | |
| if: matrix.language == 'python' | |
| uses: advanced-security/filter-sarif@2da736ff05ef065cb2894ac6892e47b5eac2c3c0 # v1.1 | |
| with: | |
| patterns: | | |
| -litellm/llms/oci/common_utils.py:py/weak-sensitive-data-hashing | |
| input: sarif-results/python.sarif | |
| output: sarif-results/python.sarif | |
| - name: Upload SARIF | |
| uses: github/codeql-action/upload-sarif@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1 | |
| with: | |
| sarif_file: sarif-results | |
| category: "/language:${{ matrix.language }}" |