ci(e2e): authorize NVIDIA-owned PR revisions #27883
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # Dedicated security reporting workflow for NemoClaw. | |
| # CodeQL and ShellCheck publish findings to GitHub code scanning while the | |
| # existing PR and main workflows remain the merge-gating CI path. | |
| name: Security / Code Scanning | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: "23 6 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| security-events: write | |
| jobs: | |
| codeql: | |
| name: CodeQL (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [javascript-typescript, python] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-and-quality | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 | |
| shellcheck: | |
| name: ShellCheck SARIF | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| path: source | |
| - name: Check out the trusted ShellCheck converter | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.workflow_sha }} | |
| path: trusted-shellcheck-converter | |
| sparse-checkout: | | |
| scripts/shellcheck-json1-to-sarif.mts | |
| sparse-checkout-cone-mode: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22.19.0 | |
| - name: Install ShellCheck | |
| run: | | |
| set -euo pipefail | |
| probe="$RUNNER_TEMP/shellcheck-json1-probe.sh" | |
| printf '#!/bin/sh\ntrue\n' > "$probe" | |
| if command -v shellcheck >/dev/null 2>&1 && | |
| shellcheck --format=json1 "$probe" >/dev/null 2>&1; then | |
| echo "Using preinstalled ShellCheck" | |
| shellcheck --version | |
| else | |
| apt_options=( | |
| -o Acquire::Retries=3 | |
| -o Acquire::http::Timeout=15 | |
| -o Acquire::https::Timeout=15 | |
| ) | |
| if ! sudo apt-get "${apt_options[@]}" update; then | |
| echo "Failed to update apt package indexes for ShellCheck" >&2 | |
| exit 1 | |
| fi | |
| if ! sudo apt-get "${apt_options[@]}" install -y shellcheck; then | |
| echo "Failed to install ShellCheck" >&2 | |
| exit 1 | |
| fi | |
| if ! shellcheck --format=json1 "$probe" >/dev/null 2>&1; then | |
| echo "Installed ShellCheck does not support --format=json1" >&2 | |
| exit 1 | |
| fi | |
| echo "Using installed ShellCheck" | |
| shellcheck --version | |
| fi | |
| - name: Collect shell files | |
| id: shell-files | |
| working-directory: source | |
| run: | | |
| git ls-files -z -- '*.sh' 'install.sh' 'uninstall.sh' | sort -zu > "$GITHUB_WORKSPACE/shell-files.txt" | |
| if [ -s "$GITHUB_WORKSPACE/shell-files.txt" ]; then | |
| echo "has_files=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "has_files=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Generate ShellCheck SARIF | |
| if: steps.shell-files.outputs.has_files == 'true' | |
| working-directory: source | |
| run: | | |
| # Ubuntu's packaged ShellCheck may not support --format=sarif. | |
| # Generate json1 and convert it to SARIF for upload. | |
| mapfile -d '' -t shell_files < "$GITHUB_WORKSPACE/shell-files.txt" | |
| sc_exit=0 | |
| if shellcheck --format=json1 -- "${shell_files[@]}" > "$GITHUB_WORKSPACE/shellcheck.json"; then | |
| sc_exit=0 | |
| else | |
| sc_exit=$? | |
| fi | |
| echo "ShellCheck invocation exit status: $sc_exit" | |
| case "$sc_exit" in | |
| 0) ;; | |
| 1) | |
| echo "ShellCheck found issues; continuing because json1 output is available for SARIF conversion." | |
| ;; | |
| *) | |
| echo "ShellCheck failed to process the input files (exit=$sc_exit); refusing to convert or upload incomplete results." | |
| exit "$sc_exit" | |
| ;; | |
| esac | |
| conversion_exit=0 | |
| if env -i PATH="$PATH" node --experimental-strip-types \ | |
| "$GITHUB_WORKSPACE/trusted-shellcheck-converter/scripts/shellcheck-json1-to-sarif.mts" \ | |
| "$GITHUB_WORKSPACE/shellcheck.json" "$GITHUB_WORKSPACE/shellcheck.sarif"; then | |
| conversion_exit=0 | |
| else | |
| conversion_exit=$? | |
| fi | |
| echo "SARIF conversion exit status: $conversion_exit" | |
| if [ "$conversion_exit" -ne 0 ]; then | |
| echo "ShellCheck SARIF conversion failed; refusing to upload invalid or stale output." | |
| exit "$conversion_exit" | |
| fi | |
| - name: Check SARIF has runs | |
| id: sarif-runs | |
| if: steps.shell-files.outputs.has_files == 'true' | |
| run: | | |
| run_count="$(jq '.runs | length' shellcheck.sarif)" | |
| if [ "$run_count" -gt 0 ]; then | |
| echo "has_runs=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "has_runs=false" >> "$GITHUB_OUTPUT" | |
| echo "Skipping SARIF upload because shellcheck.sarif has zero runs." | |
| fi | |
| - name: Upload ShellCheck SARIF | |
| if: steps.shell-files.outputs.has_files == 'true' && steps.sarif-runs.outputs.has_runs == 'true' | |
| uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 | |
| with: | |
| sarif_file: shellcheck.sarif | |
| checkout_path: source |