From 5784fad885678fce8a2d8c428f02f9e47c41d677 Mon Sep 17 00:00:00 2001 From: Daniel Schaefer Date: Tue, 10 Mar 2026 23:39:37 +0800 Subject: [PATCH 1/4] Remove nuget version It's supposed to be "nuget-version", not "version". So we've actually been using the latest version 7.3.0, which works fine. So let's just leave it off and implicitly use the latest version. Signed-off-by: Daniel Schaefer --- .github/workflows/ci.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0d3936a..33658d5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,8 +19,6 @@ jobs: - name: Setup NuGet uses: NuGet/setup-nuget@v2 - with: - version: '6.x' - name: Restore dependencies run: nuget restore FrameworkArgb\FrameworkArgb.sln From 7ac82ebc4743ac5e61fe95727444122f97c4cf09 Mon Sep 17 00:00:00 2001 From: Daniel Schaefer Date: Tue, 10 Mar 2026 23:32:03 +0800 Subject: [PATCH 2/4] Run CodeQL on GitHub Actions Signed-off-by: Daniel Schaefer --- .github/workflows/ci.yml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 33658d5..7386066 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -52,3 +52,32 @@ jobs: with: name: framework_win_argb_${{ matrix.configuration }} path: bundle + + codeql: + runs-on: windows-2022 + permissions: + security-events: write + steps: + - name: Check out repository code + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v4 + with: + languages: cpp + + - name: Setup NuGet + uses: NuGet/setup-nuget@v2 + + - name: Restore dependencies + run: nuget restore FrameworkArgb\FrameworkArgb.sln + + - name: Add MSBuild to PATH + uses: microsoft/setup-msbuild@v2 + + - name: Build solution + run: | + msbuild FrameworkArgb\FrameworkArgb.sln /property:Configuration=Release /property:Platform=x64 + + - name: Perform CodeQL analysis + uses: github/codeql-action/analyze@v4 From ed5721c563f466dc4ffa6714c4a2fbe6711a0e4c Mon Sep 17 00:00:00 2001 From: Daniel Schaefer Date: Tue, 10 Mar 2026 23:47:05 +0800 Subject: [PATCH 3/4] gh-actions: Upload Sarif and DVL files Signed-off-by: Daniel Schaefer --- .github/workflows/ci.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7386066..799cade 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -81,3 +81,22 @@ jobs: - name: Perform CodeQL analysis uses: github/codeql-action/analyze@v4 + with: + output: sarif-results + + - name: Upload SARIF file + uses: actions/upload-artifact@v4 + with: + name: codeql-sarif + path: sarif-results + + - name: Generate DVL + shell: cmd + run: | + "C:\Program Files (x86)\Windows Kits\10\Tools\dvl\dvl.exe" /manualCreate FrameworkArgb X64 /sarifPath sarif-results + + - name: Upload DVL + uses: actions/upload-artifact@v4 + with: + name: dvl + path: sarif-results/FrameworkArgb.DVL.XML From f5329bc6b5d07820a8e0fcbed3b581a1db98092f Mon Sep 17 00:00:00 2001 From: Daniel Schaefer Date: Wed, 11 Mar 2026 00:28:03 +0800 Subject: [PATCH 4/4] Pin codeql versions for Windows 25H2 Signed-off-by: Daniel Schaefer --- .github/codeql/codeql-config.yml | 6 ++++++ .github/workflows/ci.yml | 4 ++++ 2 files changed, 10 insertions(+) create mode 100644 .github/codeql/codeql-config.yml diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml new file mode 100644 index 0000000..4932d03 --- /dev/null +++ b/.github/codeql/codeql-config.yml @@ -0,0 +1,6 @@ +# CodeQL configuration for WHCP Windows 11 25H2 certification +# See: https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/static-tools-and-codeql +disable-default-queries: true +packs: + - microsoft/cpp-queries@0.0.4:codeql-suites/cpp-code-scanning.qls + - microsoft/windows-drivers@1.8.0:windows-driver-suites/recommended.qls diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 799cade..81ab004 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -65,6 +65,10 @@ jobs: uses: github/codeql-action/init@v4 with: languages: cpp + # Pin CodeQL CLI version for WHCP Windows 11 25H2 certification + # See: https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/static-tools-and-codeql + tools: https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.20.1/codeql-bundle-win64.tar.gz + config-file: .github/codeql/codeql-config.yml - name: Setup NuGet uses: NuGet/setup-nuget@v2