121 lines
4.9 KiB
YAML
121 lines
4.9 KiB
YAML
name: Generate code scanning query lists
|
|
|
|
# **What it does**: This workflow is currently run manually approximately every two weeks as part
|
|
# of the release process for the CodeQL CLI. We hope to automate this in the future
|
|
# When run, this workflow generates updated query lists with data from the codeql
|
|
# repository, and creates a pull request if there are updates.
|
|
# **Why we have it**: So we can automate CodeQL query tables and show code scanning users the built in queries.
|
|
# **Who does it impact**: Anyone making CodeQL query suite changes in `github/codeql`, and wanting to get them published on the docs site.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
SOURCE_BRANCH:
|
|
description: 'Branch to pull the source files from in the codeql repo (for example codeql-cli-2.x.x).'
|
|
type: string
|
|
required: true
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
generate-query-lists:
|
|
if: github.repository == 'github/docs-internal'
|
|
runs-on: ubuntu-20.04-xl
|
|
steps:
|
|
- name: Checkout repository code
|
|
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
|
|
|
|
- uses: ./.github/actions/node-npm-setup
|
|
|
|
- name: Checkout codeql repo
|
|
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
|
|
with:
|
|
repository: github/codeql
|
|
path: codeql
|
|
ref: ${{ inputs.SOURCE_BRANCH }}
|
|
|
|
- name: Get the codeql SHA being synced
|
|
id: codeql
|
|
run: |
|
|
cd codeql
|
|
OPENAPI_COMMIT_SHA=$(git rev-parse HEAD)
|
|
echo "OPENAPI_COMMIT_SHA=$OPENAPI_COMMIT_SHA" >> $GITHUB_OUTPUT
|
|
echo "Copied files from github/codeql repo. Commit SHA: $OPENAPI_COMMIT_SHA"
|
|
|
|
- name: Download CodeQL CLI
|
|
# Look under the `codeql` directory, as this is where we checked out the `github/codeql` repo
|
|
uses: ./codeql/.github/actions/fetch-codeql
|
|
|
|
- name: Test CodeQL CLI Download
|
|
run: codeql --version
|
|
|
|
# "Server for running multiple commands while avoiding repeated JVM initialization."
|
|
# Having started this should speed up the execution of the various
|
|
# CLI calls of the executable.
|
|
- name: Start CodeQL CLI server in the background
|
|
run: |
|
|
codeql execute cli-server &
|
|
sleep 3
|
|
codeql --version
|
|
|
|
- name: Build code scanning query list
|
|
run: |
|
|
for lang in "cpp" "csharp" "go" "java" "javascript" "python" "ruby" "swift"; do
|
|
echo "Generating code scanning query list for $lang"
|
|
npm run generate-code-scanning-query-list -- \
|
|
--verbose \
|
|
--codeql-path codeql \
|
|
--codeql-dir codeql \
|
|
-o data/reusables/code-scanning/codeql-query-tables/$lang.md \
|
|
$lang
|
|
done
|
|
|
|
- name: Debug
|
|
run: |
|
|
git diff
|
|
|
|
- name: Create pull request
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_READPUBLICKEY }}
|
|
run: |
|
|
# If nothing to commit, exit now. It's fine. No orphans.
|
|
changes=$(git diff --name-only | wc -l)
|
|
untracked=$(git status --untracked-files --short | wc -l)
|
|
if [[ $changes -eq 0 ]] && [[ $untracked -eq 0 ]]; then
|
|
echo "There are no changes to commit after running the generation and conversion scripts. Exiting..."
|
|
exit 0
|
|
fi
|
|
|
|
git config --global user.name "docs-bot"
|
|
git config --global user.email "77750099+docs-bot@users.noreply.github.com"
|
|
|
|
branchname=codeql-query-tables-${{ steps.codeql.outputs.OPENAPI_COMMIT_SHA }}
|
|
|
|
# Exit if the branch already exists. Since the actions/checkout fetch-depth is 1,
|
|
# it doesn't "know" about branches locally, so we need to manually list them.
|
|
branchExists=$(git ls-remote --heads origin refs/heads/$branchname | wc -l)
|
|
|
|
if [ $branchExists -ne 0 ]; then
|
|
echo "Branch $branchname already exists in the remote repository."
|
|
exit 0
|
|
else
|
|
git checkout -b $branchname
|
|
fi
|
|
|
|
git add data/reusables/code-scanning/codeql-query-tables
|
|
git commit -m "Update CodeQL query tables"
|
|
git push origin $branchname
|
|
|
|
echo "Creating pull request..."
|
|
gh pr create \
|
|
--title "Update CodeQL query tables" \
|
|
--repo github/docs-internal \
|
|
--label "codeql-query-tables,skip FR board,ready-for-doc-review" \
|
|
--body '👋 humans. This PR updates the **CodeQL query table reusables** with the latest changes in preparation for the next **CodeQL CLI** release.
|
|
|
|
No action is required from the first responder for the Docs content team. This PR will be reviewed and merged by the Code scanning and GHAS focus team as part of the next release of CodeQL CLI. (Synced from codeql@${{ steps.codeql.outputs.OPENAPI_COMMIT_SHA }})
|
|
|
|
If CI does not pass or other problems arise, contact #docs-engineering on slack.'
|