sync-codeql-cli.yml

name: Sync CodeQL CLI

# **What it does**: This workflow is run manually approximately every two weeks.
#   When run, this workflow syncs the CodeQL CLI automated pipeline with the semmle-code
#   repository, and creates a pull request if there are updates.
# **Why we have it**: So we can automate CodeQL CLI documentation.
# **Who does it impact**: Anyone making CodeQL CLI changes in `github/semmle-code`, and wanting to get them published on the docs site.

on:
  workflow_dispatch:
    inputs:
      SOURCE_BRANCH:
        description: 'Branch to pull the source files from in the semmle-code repo.'
        type: string
        required: true
        default: 'main'

permissions:
  contents: write
  pull-requests: write

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
  cancel-in-progress: true

jobs:
  generate-codeql-files:
    if: github.repository == 'github/docs-internal'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Checkout semmle-code repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          # By default, only the most recent commit of the `main` branch
          # will be checked out
          token: ${{ secrets.DOCS_BOT_PAT_BASE }}
          repository: github/semmle-code
          path: semmle-code
          ref: ${{ inputs.SOURCE_BRANCH }}

      - uses: ./.github/actions/node-npm-setup

      - name: Get the semmle-code SHA being synced
        id: semmle-code
        run: |
          cd semmle-code
          OPENAPI_COMMIT_SHA=$(git rev-parse HEAD)
          echo "OPENAPI_COMMIT_SHA=$OPENAPI_COMMIT_SHA" >> $GITHUB_OUTPUT
          echo "Copied files from github/semmle-code repo. Commit SHA: $OPENAPI_COMMIT_SHA"

      - name: Install pandoc
        run: |
          # Remove all previous pandoc versions
          sudo apt-get purge --auto-remove pandoc
          # Download pandoc
          wget https://github.com/jgm/pandoc/releases/download/3.0.1/pandoc-3.0.1-1-amd64.deb
          # Install pandoc
          sudo dpkg -i pandoc-3.0.1-1-amd64.deb
          # Output the pandoc version installed
          pandoc -v
          rm pandoc-3.0.1-1-amd64.deb

      - name: Sync the CodeQL CLI data
        run: |
          npm run sync-codeql-cli
          git status
          echo "Deleting the cloned github/semmle-code repo..."
          rm -rf semmle-code

      - name: Create pull request
        env:
          # Needed for gh
          GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
        run: |
          # If nothing to commit, exit now. It's fine. No orphans.
          changes=$(git diff --name-only | wc -l)
          untracked=$(git status --untracked-files --short | wc -l)
          if [[ $changes -eq 0 ]] && [[ $untracked -eq 0 ]]; then
            echo "There are no changes to commit after running 'npm run sync-codeql-cli'. Exiting..."
            exit 0
          fi

          git config --global user.name "docs-bot"
          git config --global user.email "77750099+docs-bot@users.noreply.github.com"

          branchname=codeql-cli-update-${{ steps.semmle-code.outputs.OPENAPI_COMMIT_SHA }}

          git checkout -b $branchname
          git add .
          git commit -m "Update CodeQL CLI data"

          # Force-push to handle reruns where the branch already exists on the
          # remote from a prior failed attempt. Plain --force is safe here
          # because these branches are exclusively managed by this workflow.
          git push --force -u origin $branchname

          # If a PR already exists for this branch (e.g. a previous run
          # succeeded but the workflow still reported failure), skip creation.
          existing_pr=$(gh pr list --repo github/docs-internal --head "$branchname" --json number --jq '.[0].number')
          if [[ -n "$existing_pr" ]]; then
            echo "Pull request #$existing_pr already exists for branch $branchname. Skipping PR creation."
            exit 0
          fi

          echo "Creating pull request..."
          gh pr create \
            --title "Update CodeQL CLI manual" \
            --body '👋 humans. This PR updates the CodeQL CLI manual Markdown pages with the latest changes in preparation for the next **CodeQL CLI** release.

            This will be reviewed and merged by the Code scanning and GHAS focus team as part of the release of CodeQL CLI. (Synced from semmle-code@${{ steps.semmle-code.outputs.OPENAPI_COMMIT_SHA }})

            If CI does not pass or other problems arise, contact #technical-content on slack.' \
            --repo github/docs-internal \
            --label "codeql-cli-pipeline,skip FR board,ready-for-doc-review,workflow-generated"

      - uses: ./.github/actions/create-workflow-failure-issue
        id: create-failure-issue
        if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
        with:
          token: ${{ secrets.DOCS_BOT_PAT_BASE }}

      - uses: ./.github/actions/slack-alert
        if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
        with:
          slack_token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
          issue_url: ${{ steps.create-failure-issue.outputs.issue_url }}