ci: fix sast from forked repos (#142)

.github/workflows/build.yml

@@ -1,4 +1,9 @@
-name: SonarQube Cloud
+# .github/workflows/build.yml
+# UNTRUSTED CONTEXT. This workflow runs fork-authored code.
+# It must never reference `secrets.*` (other than the default GITHUB_TOKEN,
+# which is read-only here). Do not add SONAR_TOKEN to this file.
+
+name: Build
 
 on:
   push:
@@ -7,14 +12,15 @@ on:
   pull_request:
     types: [ opened, reopened, synchronize ]
 
+permissions:
+  contents: read
+
 jobs:
-  sonar:
+  build:
-    name: Analyze
+    name: Build under Build Wrapper
     runs-on: ubuntu-24.04
     env:
       BUILD_WRAPPER_OUT_DIR: bw-output
-      SONAR_EXCLUSIONS: betterRenderer/**,ref/**,imgui/**,stb/**,build/**,bw-output/**
-      SONAR_SCANNER_JAVA_OPTS: -Xmx5g
     steps:
       - uses: actions/checkout@v5
         with:
@@ -46,7 +52,7 @@ jobs:
           sudo ldconfig
 
       # A little bit of magic for unbreaking GCC. Not an issue for Clang and MSVC.
-      # Fix for specific hard-errors for a combo of: varagrs and always_inline
+      # Fix for specific hard-errors for a combo of: varargs and always_inline
       - name: Patch GLM for GCC
         run: |
           sed -i 's/GLM_FUNC_QUALIFIER std::string format(const char\* message, \.\.\.)/inline std::string format(const char* message, ...)/' \
@@ -71,17 +77,34 @@ jobs:
             --out-dir "${BUILD_WRAPPER_OUT_DIR}" \
             cmake --build build --config Release -j"$(nproc)"
 
-      # sonar.cfamily.taintAnalysis=false
+      # Metadata the trusted workflow needs to identify the PR.
-      # it's a deliberate choice, due to memory exhausting of a Github-hosted runner.
+      # Treated as UNVERIFIED input there and re-checked against the API.
-      #
+      - name: Record event metadata
-      # Why off?: The jobs were OOM-killed. It's a trade-off, we still get everything else.
+        run: |
-      # Most bugs are caught though.
+          mkdir -p .sonar-meta
-      - name: SonarQube Cloud scan
+          echo "${{ github.event_name }}"                     > .sonar-meta/event
-        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0
+          echo "${{ github.event.pull_request.number }}"       > .sonar-meta/pr_number
-        env:
+          echo "${{ github.event.pull_request.head.sha }}"     > .sonar-meta/head_sha
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          echo "${{ github.event.pull_request.base.ref }}"     > .sonar-meta/base_ref
-          SONAR_HOST_URL: https://sonarcloud.io
+          echo "${{ github.event.pull_request.head.ref }}"     > .sonar-meta/head_ref
+          echo "${{ github.sha }}"                             > .sonar-meta/sha
+
+      # The C/C++ analyzer needs the sources AND the build-wrapper output.
+      # compile_commands.json holds absolute paths, so the trusted workflow must
+      # unpack this at the same $GITHUB_WORKSPACE path — same repo, so it matches.
+      - name: Pack analysis input
+        run: |
+          tar -czf /tmp/workspace.tar.gz \
+            --exclude='./build/CMakeFiles' \
+            --exclude='*.o' \
+            --exclude='*.a' \
+            --exclude='*.so' \
+            -C "$GITHUB_WORKSPACE" .
+
+      - name: Upload analysis input
+        uses: actions/upload-artifact@v4
         with:
-          args: >
+          name: sonar-input
-            --define sonar.cfamily.compile-commands=${{ env.BUILD_WRAPPER_OUT_DIR }}/compile_commands.json
+          path: /tmp/workspace.tar.gz
-            --define sonar.cfamily.taintAnalysis=false 
+          retention-days: 1
+          if-no-files-found: error

.github/workflows/sonar.yml

@@ -0,0 +1,130 @@
+# .github/workflows/sonar.yml
+# TRUSTED CONTEXT. Has SONAR_TOKEN.
+# Rule: never execute anything that came out of the artifact. No build, no
+# npm/pip install, no scripts, no PR-supplied scanner config. Data only.
+#
+# NOTE: workflow_run workflows are only picked up from the DEFAULT branch.
+# Changes to this file take effect after they land on master.
+
+name: SonarQube Cloud
+
+on:
+  workflow_run:
+    workflows: [ "Build" ]
+    types: [ completed ]
+
+permissions:
+  contents: read
+  actions: read
+  pull-requests: write
+
+jobs:
+  sonar:
+    name: Analyze
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-24.04
+    env:
+      BUILD_WRAPPER_OUT_DIR: bw-output
+      SONAR_EXCLUSIONS: betterRenderer/**,ref/**,imgui/**,stb/**,build/**,bw-output/**
+      SONAR_SCANNER_JAVA_OPTS: -Xmx5g
+    steps:
+      # Trusted copy of the repo config, used to overwrite anything the PR
+      # might have tampered with (sonar-project.properties etc).
+      - name: Checkout trusted config from master
+        uses: actions/checkout@v5
+        with:
+          ref: master
+          path: .trusted
+
+      - name: Download analysis input
+        uses: actions/download-artifact@v4
+        with:
+          name: sonar-input
+          path: /tmp/sonar-input
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Unpack analysis input
+        run: |
+          set -euo pipefail
+          tar -xzf /tmp/sonar-input/workspace.tar.gz -C "$GITHUB_WORKSPACE"
+          # Strip PR-controlled scanner configuration, restore the trusted one.
+          rm -f "$GITHUB_WORKSPACE/sonar-project.properties" \
+                "$GITHUB_WORKSPACE/.sonarcloud.properties"
+          if [ -f "$GITHUB_WORKSPACE/.trusted/sonar-project.properties" ]; then
+            cp "$GITHUB_WORKSPACE/.trusted/sonar-project.properties" "$GITHUB_WORKSPACE/"
+          fi
+
+      - name: Resolve and verify PR metadata
+        id: meta
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          cd "$GITHUB_WORKSPACE"
+          event=$(tr -d '\r\n' < .sonar-meta/event)
+          echo "event=$event" >> "$GITHUB_OUTPUT"
+
+          if [ "$event" != "pull_request" ]; then
+            echo "Branch build, no PR parameters."
+            exit 0
+          fi
+
+          pr=$(tr -d '\r\n' < .sonar-meta/pr_number)
+          sha=$(tr -d '\r\n' < .sonar-meta/head_sha)
+
+          # The artifact is attacker-controlled: validate shape, then confirm
+          # against the API that this PR really has this head commit.
+          [[ "$pr"  =~ ^[0-9]+$ ]]          || { echo "::error::bad PR number"; exit 1; }
+          [[ "$sha" =~ ^[0-9a-f]{40}$ ]]    || { echo "::error::bad head sha";  exit 1; }
+
+          api_sha=$(gh api "repos/$REPO/pulls/$pr" --jq '.head.sha')
+          base=$(gh api "repos/$REPO/pulls/$pr" --jq '.base.ref')
+          head=$(gh api "repos/$REPO/pulls/$pr" --jq '.head.ref')
+
+          if [ "$api_sha" != "$sha" ]; then
+            echo "::error::head sha mismatch (artifact=$sha api=$api_sha)"
+            exit 1
+          fi
+
+          {
+            echo "pr=$pr"
+            echo "base=$base"
+            echo "head=$head"
+          } >> "$GITHUB_OUTPUT"
+
+      # sonar.cfamily.taintAnalysis=false
+      # it's a deliberate choice, due to memory exhausting of a Github-hosted runner.
+      #
+      # Why off?: The jobs were OOM-killed. It's a trade-off, we still get everything else.
+      # Most bugs are caught though.
+      - name: SonarQube Cloud scan (pull request)
+        if: steps.meta.outputs.event == 'pull_request'
+        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: https://sonarcloud.io
+        with:
+          args: >
+            --define sonar.cfamily.compile-commands=${{ env.BUILD_WRAPPER_OUT_DIR }}/compile_commands.json
+            --define sonar.cfamily.taintAnalysis=false
+            --define sonar.exclusions=${{ env.SONAR_EXCLUSIONS }}
+            --define sonar.scm.revision=${{ github.event.workflow_run.head_sha }}
+            --define sonar.pullrequest.key=${{ steps.meta.outputs.pr }}
+            --define sonar.pullrequest.branch=${{ steps.meta.outputs.head }}
+            --define sonar.pullrequest.base=${{ steps.meta.outputs.base }}
+
+      - name: SonarQube Cloud scan (branch)
+        if: steps.meta.outputs.event != 'pull_request'
+        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: https://sonarcloud.io
+        with:
+          args: >
+            --define sonar.cfamily.compile-commands=${{ env.BUILD_WRAPPER_OUT_DIR }}/compile_commands.json
+            --define sonar.cfamily.taintAnalysis=false
+            --define sonar.exclusions=${{ env.SONAR_EXCLUSIONS }}
+            --define sonar.branch.name=${{ github.event.workflow_run.head_branch }}
+            --define sonar.scm.revision=${{ github.event.workflow_run.head_sha }}