Repository navigation
Repo sync #87
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Generate code scanning query lists | |
| # Manual CodeQL CLI release runs, about every two weeks, generate query table reusables | |
| # from github/codeql and open a pull request when they change. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| SOURCE_BRANCH: | |
| description: 'Branch to pull the source files from in the codeql repo (for example codeql-cli-2.x.x).' | |
| type: string | |
| required: true | |
| default: 'main' | |
| pull_request: | |
| paths: | |
| - .github/workflows/generate-code-scanning-query-lists.yml | |
| - src/codeql-queries/scripts/generate-code-scanning-query-list.ts | |
| - src/codeql-queries/scripts/generate-code-quality-query-list.ts | |
| - .github/actions/install-cocofix/action.yml | |
| permissions: | |
| contents: read | |
| jobs: | |
| generate-security-query-lists: | |
| if: github.repository == 'github/docs-internal' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: ./.github/actions/node-npm-setup | |
| - name: Checkout codeql repo | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: github/codeql | |
| path: codeql | |
| ref: ${{ inputs.SOURCE_BRANCH || 'main' }} | |
| - name: Get the codeql SHA being synced | |
| id: codeql | |
| shell: bash | |
| run: | | |
| cd codeql | |
| OPENAPI_COMMIT_SHA=$(git rev-parse HEAD) | |
| echo "OPENAPI_COMMIT_SHA=$OPENAPI_COMMIT_SHA" >> $GITHUB_OUTPUT | |
| echo "Copied files from github/codeql repo. Commit SHA: $OPENAPI_COMMIT_SHA" | |
| - name: Download CodeQL CLI | |
| # fetch-codeql lives in the checked-out github/codeql repository. | |
| uses: ./codeql/.github/actions/fetch-codeql | |
| - name: Test CodeQL CLI Download | |
| shell: bash | |
| run: codeql --version | |
| # Start the CodeQL CLI server once so later CodeQL commands avoid repeated JVM initialization. | |
| - name: Start CodeQL CLI server in the background | |
| shell: bash | |
| run: | | |
| codeql execute cli-server & | |
| sleep 3 | |
| codeql --version | |
| - uses: ./.github/actions/install-cocofix | |
| with: | |
| # The Docs Engineering Bot app has repo-level Packages permission and cannot | |
| # read org-scoped packages, so cocofix installation requires the PAT. | |
| token: ${{ secrets.DOCS_BOT_PAT_BASE }} | |
| - name: Build code scanning security query lists | |
| shell: bash | |
| run: | | |
| for lang in "actions" "cpp" "csharp" "go" "java" "javascript" "python" "ruby" "rust" "swift"; do | |
| echo "Generating code scanning query list for $lang" | |
| npm run generate-code-scanning-query-list -- \ | |
| --verbose \ | |
| --codeql-path codeql \ | |
| --codeql-dir codeql \ | |
| -o data/reusables/code-scanning/codeql-query-tables/$lang.md \ | |
| $lang | |
| done | |
| - name: Upload security query lists | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 | |
| with: | |
| name: security-query-lists | |
| path: data/reusables/code-scanning/codeql-query-tables/ | |
| generate-quality-query-lists: | |
| if: github.repository == 'github/docs-internal' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: ./.github/actions/node-npm-setup | |
| - name: Checkout codeql repo | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: github/codeql | |
| path: codeql | |
| ref: ${{ inputs.SOURCE_BRANCH || 'main' }} | |
| - name: Get the codeql SHA being synced | |
| id: codeql | |
| shell: bash | |
| run: | | |
| cd codeql | |
| OPENAPI_COMMIT_SHA=$(git rev-parse HEAD) | |
| echo "OPENAPI_COMMIT_SHA=$OPENAPI_COMMIT_SHA" >> $GITHUB_OUTPUT | |
| echo "Copied files from github/codeql repo. Commit SHA: $OPENAPI_COMMIT_SHA" | |
| - name: Download CodeQL CLI | |
| # fetch-codeql lives in the checked-out github/codeql repository. | |
| uses: ./codeql/.github/actions/fetch-codeql | |
| - name: Test CodeQL CLI Download | |
| shell: bash | |
| run: codeql --version | |
| # Start the CodeQL CLI server once so later CodeQL commands avoid repeated JVM initialization. | |
| - name: Start CodeQL CLI server in the background | |
| shell: bash | |
| run: | | |
| codeql execute cli-server & | |
| sleep 3 | |
| codeql --version | |
| - name: Build code quality query lists | |
| shell: bash | |
| run: | | |
| for lang in "csharp" "go" "java" "javascript" "python" "ruby"; do | |
| echo "Generating code quality query list for $lang" | |
| npm run generate-code-quality-query-list -- \ | |
| --verbose \ | |
| --codeql-path codeql \ | |
| --codeql-dir codeql \ | |
| -o data/reusables/code-quality/codeql-query-tables/$lang.md \ | |
| $lang | |
| done | |
| - name: Upload quality query lists | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 | |
| with: | |
| name: quality-query-lists | |
| path: data/reusables/code-quality/codeql-query-tables/ | |
| create-pull-request: | |
| if: github.repository == 'github/docs-internal' | |
| runs-on: ubuntu-latest | |
| # Serialize publishing so a second run sees the first run's PR before it force-pushes. | |
| # Pull request dry runs get their own group so they never queue behind or cancel a publisher. | |
| concurrency: | |
| group: ${{ github.workflow }}-query-table-publication-${{ github.event_name == 'pull_request' && github.run_id || 'publish' }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| needs: [generate-security-query-lists, generate-quality-query-lists] | |
| steps: | |
| - name: Checkout repository code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Checkout codeql repo | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: github/codeql | |
| path: codeql | |
| ref: ${{ inputs.SOURCE_BRANCH || 'main' }} | |
| - name: Get the codeql SHA being synced | |
| id: codeql | |
| shell: bash | |
| run: | | |
| cd codeql | |
| OPENAPI_COMMIT_SHA=$(git rev-parse HEAD) | |
| echo "OPENAPI_COMMIT_SHA=$OPENAPI_COMMIT_SHA" >> $GITHUB_OUTPUT | |
| echo "Copied files from github/codeql repo. Commit SHA: $OPENAPI_COMMIT_SHA" | |
| - name: Download security query lists | |
| uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 | |
| with: | |
| name: security-query-lists | |
| path: data/reusables/code-scanning/codeql-query-tables/ | |
| - name: Download quality query lists | |
| uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 | |
| with: | |
| name: quality-query-lists | |
| path: data/reusables/code-quality/codeql-query-tables/ | |
| - name: Insight into diff | |
| shell: bash | |
| run: | | |
| git diff | |
| - name: Create pull request | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }} | |
| DRY_RUN: ${{ github.event_name == 'pull_request'}} | |
| shell: bash | |
| run: | | |
| # Git status must only report generated query tables, so remove the | |
| # checked-out CodeQL repository. | |
| rm -fr ./codeql | |
| changes=$(git diff --name-only | wc -l) | |
| untracked=$(git status --untracked-files --short | wc -l) | |
| if [[ $changes -eq 0 ]] && [[ $untracked -eq 0 ]]; then | |
| echo "There are no changes to commit after running the generation and conversion scripts. Exiting..." | |
| exit 0 | |
| fi | |
| git config --global user.name "docs-bot" | |
| git config --global user.email "77750099+docs-bot@users.noreply.github.com" | |
| branchname=codeql-query-tables-${{ steps.codeql.outputs.OPENAPI_COMMIT_SHA }} | |
| # Pull request runs validate generated files without pushing branches. | |
| if [ "$DRY_RUN" = "true" ]; then | |
| echo "Dry-run mode when run in a pull request" | |
| echo "See the 'Insight into diff' step for the changes it would create PR about." | |
| exit 0 | |
| fi | |
| # Check for an open PR before pushing so reruns do not overwrite commits added to it. | |
| existing_pr=$(gh pr list --repo github/docs-internal --head "$branchname" --json number --jq '.[0].number') | |
| if [[ -n "$existing_pr" ]]; then | |
| echo "Pull request #$existing_pr already exists for branch $branchname. Skipping PR creation." | |
| exit 0 | |
| fi | |
| git checkout -b $branchname | |
| git add data/reusables/code-scanning/codeql-query-tables | |
| git add data/reusables/code-quality/codeql-query-tables | |
| git commit -m "Update CodeQL query tables" | |
| # Force-push over a branch left by a failed attempt; this workflow exclusively owns these branches. | |
| git push --force -u origin $branchname | |
| echo "Creating pull request..." | |
| gh pr create \ | |
| --title "Update CodeQL query tables" \ | |
| --repo github/docs-internal \ | |
| --label "codeql-query-tables,skip FR board,ready-for-doc-review,workflow-generated" \ | |
| --body '👋 humans. This PR updates the **CodeQL query table reusables** with the latest changes in preparation for the next **CodeQL CLI** release. (Synced from codeql@${{ steps.codeql.outputs.OPENAPI_COMMIT_SHA }}) | |
| No action is required from the first responder for the Docs content team. This PR is automatically added to the Docs content review board. Any writer can review this by checking that the PR looks sensible. If CI does not pass or other problems arise, contact #technical-content on slack. | |
| When the DRI for the CodeQL CLI release is ready to publish, they will ask us to merge this PR in #docs-content. | |
| _Generated by the [Generate code scanning query lists](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) workflow run._' |