[andraghetti]

Motivation

The ROCm security baseline skips C/C++ CodeQL in repositories with more than 1,000 C/C++ files. So rocm-systems gets no C/C++ scan, and HRR capture gets none either. A one-off run on 1 October found world-writable file creation in the capture writer. #12253 fixed it. Nothing in CI stops it from coming back. This change adds a C++ CodeQL job that scans the capture code and nothing else.

Technical Details

• .github/workflows/hrr-capture-codeql.yml runs on pull requests and develop pushes that touch projects/clr/hipamd/src/hrr/**. It also runs when its own files change. The develop run gives code scanning a base, so it can call a PR alert new.
• The job runs in rocm/dev-ubuntu-22.04:7.2, pinned by digest, for the ROCm headers. Init, build and analyze all run in this container, because the tracer only sees compilers started in its own environment.
• The image has no git. The job installs it first, because without git actions/checkout downloads the whole repository instead of the sparse tree.
• .github/scripts/hrr_capture_codeql_build.sh compiles the .cpp files in projects/clr/hipamd/src/hrr with HIP_HRR_CAPTURE_ENABLED. There are five on this base. A new file is picked up without a change here. It uses the definitions and include paths that amdhip64 and rocclr give them on Linux. It does not run CMake and builds nothing else in hipamd or rocclr.
• The flag list is written out by hand. If hipamd changes its flags, this list has to follow. A missing flag breaks the build step; it does not quietly scan less.
• The job runs the security-extended suite, which is cpp-security-extended for C++.
• .github/scripts/hrr_capture_codeql_filter.py keeps only results whose primary location is under projects/clr/hipamd/src/hrr/. CodeQL paths filters do not apply to C/C++, so the filtering happens on the SARIF. The capture files include rocclr headers, which raise nine alerts of their own. Those are not this job's. A result with no location is kept.
• The filtered SARIF goes to code scanning under the category /hrr-capture. The job then fails if any capture alert is left. Capture has none on develop, so any alert is new.
• The 1 October run also reported a cpp/path-injection false positive in write_code_object(). It does not reproduce with CodeQL 2.27.2, so nothing is excluded for it. The workflow header says to dismiss it once in code scanning if it returns: the file name is a hex hash of the code object.
• .github/scripts/tests/hrr_capture_codeql_filter_test.py has nine unittest cases for the filter. They use unittest because the image has Python but no pytest. The job runs them before the scan.
• Every file is named hrr-capture-codeql* or hrr_capture_codeql_*. A replay CodeQL job (AIRUNTIME-2874) can then add its own files without conflicts.

Issue Tracking

JIRA ID: AIRUNTIME-2873

Test Plan

The workflow cannot run without a push, so I ran its commands by hand on gbt350. They ran on CPU in the same image, with CodeQL CLI 2.27.2. The commit was 0062c180fe, on develop 25c7cab4d1. The MI350X gate did not run, because the change touches no C++, CMake or capture code.

• This branch: sparse tree as the workflow checks it out, filter tests, traced build, cpp-security-extended analysis, then the filter.
• Negative control: the same run with projects/clr/hipamd/src/hrr from before fix(hrr): keep capture archives private and refuse planted links #12253 (83201fcd49^). I also ran the filter tests with a filter that keeps every result. Both ran on the earlier base 8394703, with commit 549f9a32b3. The rebase changed neither the filter nor its tests.
• develop 25c7cab4d1: has no such job. The branch scan doubles as develop's baseline, because the branch does not change capture.
• actionlint 1.7.7 and zizmor 1.16.0 on the workflow.

Test Result

Check	This branch (0062c18, on 25c7cab)	Negative control (on 8394703)	develop 25c7cab
Filter tests	9 of 9 pass	6 of 9 fail when the filter keeps every result	no job
Traced build	5 capture files compiled	4 capture files compiled	no job
Raw CodeQL results	9, all in elfio.hpp, device.hpp, command.hpp	12	no job
Capture alerts after filter	0, job passes	3 cpp/world-writable-file-creation in hip_capture_writer.cpp (lines 450, 566, 1303), job fails	no job
Wall time	about 1 minute	about 1 minute	no job
actionlint, zizmor	clean	n/a	n/a

Not tested: the GitHub side. That covers checkout and the CodeQL actions inside the container, the upload to code scanning, the alert display on a PR, and uploads from fork PRs. The first run of this PR will exercise them. Windows-only branches of the capture code are not compiled, so they are not scanned.

Submission Checklist

• Look over the contributing guidelines at https://github.com/ROCm/rocm-systems/blob/develop/CONTRIBUTING.md.

[therock-pr-bot]

✅ All Policy Checks Passed

Check	Status	Details
📝 PR Description	✅ Pass	—
⛔ Forbidden Files	✅ Pass	—
🧪 Unit Test	✅ Pass	—
🚫 Draft PR	🔜 To Be Enabled	—
🚩 Feature Flag	🔜 To Be Enabled	—
📊 Code Coverage	🔜 To Be Enabled	—

🎉 All policy checks passed!

📖 Need help? See the Policy FAQ for details on every check and how to fix failures.

🙋 Wish to Override Policy?

[Copilot]

🟡 Changes recommended

The filtering step uses Bash-only syntax under the container’s default shell, blocking SARIF uploads.

1 open issue

• Use Bash shell for Bash-specific SARIF filtering step · New

What changed in this PR

Adds focused C++ CodeQL coverage for HRR capture, filling the gap left by the repository-wide security baseline.

Changes:

• Adds a containerized workflow for capture changes and develop baselines.
• Compiles capture sources independently and filters results to capture locations.
• Adds nine filter tests and fails the job when capture alerts remain.

File	Description
.github/​workflows/​hrr-capture-codeql.yml	Orchestrates scanning, filtering, upload and alert gating.
.github/​scripts/​tests/​hrr_capture_codeql_filter_test.py	Tests filtering and command-line output.
.github/​scripts/​hrr_capture_codeql_filter.py	Retains and counts capture-related SARIF results.
.github/​scripts/​hrr_capture_codeql_build.sh	Compiles capture sources for CodeQL tracing.

_{Review effort: Balanced}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[danielbolsson]

Checked 30cfa63: the build script compiles only projects/clr/hipamd/src/hrr/*.cpp, the filter keeps results with a primary location in that directory (and those with none), its tests cover the prefix-sharing and absolute-URI cases, and the action pins resolve. Nothing blocking.

[andraghetti]

Closed. HRR will wait for the ROCm security baseline to turn on C/C++ CodeQL for rocm-systems, which needs larger runners.