C++: MISRA via GitHub CodeQL?

Evaluate GitHub CodeQL and Alternatives for MISRA C++17 Compliance

Presentation: Prepare a walkthrough demonstrating how CodeQL is set up, used, and integrated into workflows. Focus on user experience aspects, such as whether it can be run locally or only in pull requests, and how developers interact with it.
MISRA Coverage Report: Evaluate the extent to which GitHub CodeQL supports MISRA C++17 rules. Roughly document which rules are covered, any gaps, and possible workarounds.
Licensing Investigation: Investigate and document the licensing terms for using GitHub CodeQL, specifically for MISRA compliance. Include details on any limitations or additional costs for both the score project and commercial usage.

Installing and Configuring CodeQL and the CodeQL Coding Standards Pack

Note: Before following the instructions here check the Conclusion at the bottom.

Background
The CodeQL-Coding-Standards currently supports the CERT C++ 2016 coding standard, with MISRA C++ 2023 in development and expected for release in Q1 2025. The supported language version is C++14, although the CodeQL engine itself supports C++17.

Part 1: Installing and Running Locally

Install CodeQL Engine
Download the CodeQL CLI binaries from the CodeQL CLI releases page. Extract and add the binaries to your PATH.
Download the Coding Standards Packs

codeql pack download codeql/misra-cpp-coding-standards

The recommended codeql pack download command does not work for the MISRA CPP or CERT CPP packs due to missing entries in the GitHub Container Registry (GHCR).
Instead, manually download the required packs:

~~- Navigate to the CodeQL Coding Standards release page.~~
~~- Download the coding-standards-codeql-packs.zip archive.~~
~~- Extract the archive, and copy the directories (misra-cpp-coding-standards and common-cpp-coding-standards) to the qlpacks directory of your CodeQL installation.~~

Test the Setup Locally
Used a sample C++ project to create and analyze a CodeQL database.
Example workflow:

Create a CodeQL database: codeql database create --language=cpp --command="bazel build //main:main --spawn_strategy=local --nouse_action_cache --noremote_accept_cached --noremote_upload_local_results" ndicu-cpp-database --overwrite --logdir=logs
Analyze the database with the MISRA CPP pack: codeql database analyze --format=sarifv2.1.0 --output=out_misra.sarif ndicu-cpp-database /path/to/codeql/qlpacks/codeql/misra-cpp-coding-standards --additional-packs=/path/to/codeql/qlpacks/codeql/common-cpp-coding-standards
codeql database analyze --format=sarifv2.1.0 --output=out_misra.sarif ndicu-cpp-database codeql/misra-cpp-coding-standards
Review results: Open the out_misra.sarif file in VS Code with the SARIF Viewer extension.

Results:

Part 2: Installing and Running in GitHub Workflow

Enable CodeQL Analysis for the Repository

Navigate to the repository's Settings > Code Security and Analysis section.
Under Code scanning, enable GitHub Advanced Security and set up CodeQL analysis.

Configure the GitHub Workflow
Use the codeql-action GitHub Action in your workflow file(check C++: MISRA via GitHub CodeQL? #185 (comment) for complete one):

jobs:
  codeql:
    name: Analyze code with CodeQL
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          packs: codeql/misra-cpp-coding-standards  # Specify the pack (currently unavailable in GHCR)

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v3
        with:
          output: results.sarif

Note: The codeql/misra-cpp-coding-standards pack is not available in GHCR, which blocks direct integration into GitHub workflows.

Current Limitation
~~Since the required packs are not published to GHCR, CodeQL Coding Standards integration in GitHub workflows is not fully supported. ~~

Conclusion
The current lack of support for automated pack installation via codeql pack download or GHCR hinders seamless integration of MISRA pack from codeql-coding-standards. The tool can be used with manual setup locally.
Tool can be integrated now in workflows and can be easily installed locally.

@nradakovic

Since the required packs are not published to GHCR, CodeQL Coding Standards integration in GitHub workflows is not fully supported.

Conclusion The current lack of support for automated pack installation via codeql pack download or GHCR hinders seamless integration of MISRA pack from codeql-coding-standards.

@nradakovic Do you already understand enough about the tooling to raise an issue wherever it belongs?

@AlexanderLanin

@AlexanderLanin
I may not have fully understood the question, so my response might not completely align, but here it goes:

If the question is about categorizing the topic, it clearly falls under quality and testing. However, if you're asking about tool integration specifically, it largely depends on how we want to define the responsibilities between the infrastructure/tooling team and the testing team.

In my view, it would make more sense for the testing team to handle the integration (with our support, of course), as they will ultimately be the primary owners of it.

That said, I do have a question: Have we already decided which tool we want to use? Is clang-tidy still being considered, or is it out of scope?

@nicu1989

Hehe same here. My understanding was that GitHub needs to publish something to GHCR. So maybe we can just create a ticket in their repositories (codeql...) and ask for that.

testing team: to be aligned

tool: no decision. See 4th point in this issue.

//edit: oh sorry. I got the wrong name here! I meant to ask @nicu1989 not @nradakovic. Now I get the confusion. Sorry.

@AlexanderLanin

Thank you for the work you have done @AlexanderLanin. I'm not to deep into github but would that not be an option that we push the code to GHCR if the don't want to do?

Is there also some ticket about something like misra in rust? Would be good to know what is needed to get certified also for the Rust projects.

For rust see #80

Opened an issue #845 with the guys from codeql-coding-standards for the missing ghcr packs.

LE: The packs are not published yet. Check ticket for more details.

UPDATE: Seems like the packs are now published.

This means that for:

local setup:

no need for point 2. Download the Coding Standards Packs (manual download of packs coding-standards-codeql-packs.zip)
codeql pack download codeql/misra-cpp-coding-standards

/# codeql pack download codeql/misra-cpp-coding-standards
Package specifications to check for download: codeql/misra-cpp-coding-standards
Package install location: /root/.codeql/packages
Installed fresh codeql/misra-cpp-coding-standards@2.41.0

create the DB
run : codeql database analyze --format=sarifv2.1.0 --output=out_misra.sarif ndicu-cpp-database codeql/misra-cpp-coding-standards

github workflow

a more complete workflow:

name: "CodeQL Advanced"

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
        - language: c-cpp
          build-mode: manual
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        packs: codeql/misra-cpp-coding-standards

    - if: matrix.build-mode == 'manual'
      shell: bash
      run: |
        bazel build //main:main

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3        
      with:
        category: "/language:${{matrix.language}}"
        output: sarif-results.sarif

    - name: Upload Artifact
      uses: actions/upload-artifact@v4
      with:
        name: sarif-results.sarif
        path: sarif-results.sarif

Navigation Menu

Repository navigation

C++: MISRA via GitHub CodeQL? #185

Evaluate GitHub CodeQL and Alternatives for MISRA C++17 Compliance

Installing and Configuring CodeQL and the CodeQL Coding Standards Pack

local setup:

github workflow

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

C++: MISRA via GitHub CodeQL? #185

Description

Evaluate GitHub CodeQL and Alternatives for MISRA C++17 Compliance

Activity

nicu1989 commented on Jan 20, 2025

Installing and Configuring CodeQL and the CodeQL Coding Standards Pack

AlexanderLanin commented on Jan 20, 2025

nradakovic commented on Jan 20, 2025

AlexanderLanin commented on Jan 21, 2025

FScholPer commented on Jan 22, 2025

AlexanderLanin commented on Jan 22, 2025

nicu1989 commented on Jan 24, 2025

nicu1989 commented on Feb 13, 2025

local setup:

github workflow

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions