Skip to content

Add github workflow for doxygen. #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kimkulling merged 1 commit into from
Aug 4, 2026
Merged

Add github workflow for doxygen. #43

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 50 additions & 0 deletions .github/workflows/doxygen.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
name: Doxygen

on:
push:
branches: [ "main" ]
# Allow running this workflow manually from the Actions tab.
workflow_dispatch:

# Allow the job to publish to GitHub Pages.
permissions:
contents: read

Check warning on line 11 in .github/workflows/doxygen.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Move this read permission from workflow level to job level. 


See more on https://sonarcloud.io/project/issues?id=kimkulling_tiny_ui&issues=AZ_M7MtWoQLPR9bh7buR&open=AZ_M7MtWoQLPR9bh7buR&pullRequest=43
pages: write

Check warning on line 12 in .github/workflows/doxygen.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Move this write permission from workflow level to job level. 


See more on https://sonarcloud.io/project/issues?id=kimkulling_tiny_ui&issues=AZ_M7MtWoQLPR9bh7buS&open=AZ_M7MtWoQLPR9bh7buS&pullRequest=43
id-token: write

Check warning on line 13 in .github/workflows/doxygen.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Move this write permission from workflow level to job level. 


See more on https://sonarcloud.io/project/issues?id=kimkulling_tiny_ui&issues=AZ_M7MtWoQLPR9bh7buT&open=AZ_M7MtWoQLPR9bh7buT&pullRequest=43

# Only one concurrent deployment; skip in-progress runs queued between the run and latest queued.
concurrency:
group: "pages"
cancel-in-progress: false

jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

@coderabbitai coderabbitai Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow files =="
git ls-files .github/workflows || true

echo "== doxygen workflow excerpt =="
if [ -f .github/workflows/doxygen.yml ]; then
  cat -n .github/workflows/doxygen.yml
fi

echo "== action uses with refs (all workflows) =="
rg -n 'uses:\s*[^#\s]+' .github/workflows || true

Repository: kimkulling/tiny_ui

Length of output: 2130

🌐 Web query:

GitHub Actions workflows pin third-party actions immutable commit SHA CWE-829

💡 Result:

Pinning third-party GitHub Actions to an immutable, full-length commit SHA (Secure Hash Algorithm) is a critical security best practice that mitigates supply chain risks associated with CWE-829: Inclusion of Functionality from Untrusted Control Sphere [1][2][3]. When an action is referenced using a mutable tag (e.g., @v4) or a branch name (e.g., @main), the workflow fetches whatever code currently points to that reference at runtime [2][4][5]. If the action's repository is compromised or a malicious actor gains control over the tag, they can silently inject backdoors or malicious logic into your CI/CD pipeline, which often has access to sensitive secrets and tokens [1][2][4][5]. Pinning to a specific 40-character commit SHA ensures that the exact, reviewed version of the code is always executed, providing immutability at the Git level [1][4][3]. This protects against upstream tampering because changing the executed code would require the attacker to generate a SHA-1 collision, which is computationally infeasible for valid Git object payloads [1][6][7]. To maintain this security posture without sacrificing convenience: 1. Pin to the full-length SHA: Use the 40-character commit hash in your workflow file [1][3][5]. 2. Maintain human-readable labels: Append the version tag as a comment (e.g., uses: actions/checkout@b4ffde6 # v4.1.0) [2][4][5]. This allows tools like Dependabot and Renovate to continue tracking version updates and opening upgrade pull requests while keeping your workflow pinned to an immutable hash [4][3][5]. 3. Enable security policies: Organizations can enforce this practice by configuring repository or organization-level policies to require actions to be pinned to a full-length commit SHA [1]. This practice directly addresses CWE-829 by preventing the inclusion of potentially untrusted or unauthorized code from external sources [2][8][9]. The CodeQL security analysis engine specifically flags unpinned actions under the CWE-829 category because they introduce an unacceptable risk of executing untrusted code [6][10][8].

Citations:

Other (CWE-829): Inclusion of Functionality from Untrusted Control Sphere

Reachability: Internal

Pin GitHub Actions to immutable commit SHAs.

Mutable version tags can resolve to different action code later. Pin the third-party action refs in .github/workflows/doxygen.yml to approved full-length SHAs, with the major version retained in a comment.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 24-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 1 file
  • .github/workflows/doxygen.yml#L24-L24 (this comment)
  • .github/workflows/doxygen.yml#L37-L37
  • .github/workflows/doxygen.yml#L50-L50
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/doxygen.yml at line 24, Pin the third-party actions at
.github/workflows/doxygen.yml lines 24, 37, and 50 to their approved full-length
commit SHAs, replacing mutable version refs while retaining each action’s major
version in an inline comment.


- name: Install Doxygen
run: |
sudo apt-get update -y -qq
sudo apt-get install -y doxygen

- name: Generate documentation
# INPUT/OUTPUT_DIRECTORY in the Doxyfile are relative to docs/, so run there.
working-directory: docs
run: doxygen Doxyfile.in

- name: Upload Pages artifact
uses: actions/upload-pages-artifact@v3
with:
path: docs/out/html

deploy:
needs: build
runs-on: ubuntu-latest
environment:
name: github-pages
url: ${{ steps.deployment.outputs.page_url }}
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4
Loading