Repository navigation
Re-run per-language bundle validation after Actions incident 5229 #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Validates the per-language CodeQL bundles produced by a pre-release build. Unlike the checks in | |
| # `pr-checks`, this is not generated, since each language needs its own platform and build steps. | |
| # | |
| # TODO(per-language-bundles): Remove this workflow, or fold it into `pr-checks`, once per-language | |
| # bundles are published as part of a release. | |
| name: Per-language bundle validation | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GO111MODULE: auto | |
| # The pre-release whose per-language bundles we are validating. | |
| BUNDLE_TAG: codeql-bundle-20260826 | |
| on: | |
| push: | |
| branches: | |
| - henrymercer/per-language-bundles | |
| workflow_dispatch: {} | |
| defaults: | |
| run: | |
| shell: bash | |
| concurrency: | |
| cancel-in-progress: true | |
| group: per-language-bundle-validation-${{ github.ref }} | |
| jobs: | |
| validate: | |
| name: ${{ matrix.language }} | |
| if: github.triggering_actor != 'dependabot[bot]' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: actions | |
| platform: linux64 | |
| os: ubuntu-latest | |
| # The Actions QL pack depends on the JavaScript one, which is the only dependency of its | |
| # kind, so the Actions bundle has to carry the JavaScript extractor as well. | |
| expected-extractors: actions javascript | |
| - language: cpp | |
| platform: linux64 | |
| os: ubuntu-latest | |
| build-mode: manual | |
| build-command: gcc -o main main.c | |
| - language: csharp | |
| platform: linux64 | |
| os: ubuntu-latest | |
| build-mode: none | |
| - language: go | |
| platform: linux64 | |
| os: ubuntu-latest | |
| build-mode: autobuild | |
| - language: java | |
| platform: linux64 | |
| os: ubuntu-latest | |
| build-mode: none | |
| - language: javascript | |
| platform: linux64 | |
| os: ubuntu-latest | |
| - language: python | |
| platform: linux64 | |
| os: ubuntu-latest | |
| - language: ruby | |
| platform: linux64 | |
| os: ubuntu-latest | |
| - language: rust | |
| platform: linux64 | |
| os: ubuntu-latest | |
| - language: swift | |
| platform: osx64 | |
| os: macos-latest | |
| build-mode: autobuild | |
| permissions: | |
| contents: read | |
| security-events: read | |
| timeout-minutes: 45 | |
| runs-on: ${{ matrix.os }} | |
| env: | |
| CODEQL_ACTION_TEST_MODE: true | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Prepare test | |
| id: prepare-test | |
| uses: ./.github/actions/prepare-test | |
| with: | |
| # Unused: we pin `tools` to a specific per-language bundle below. | |
| version: linked | |
| use-all-platform-bundle: 'false' | |
| setup-kotlin: 'false' | |
| - uses: ./../action/init | |
| id: init | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix['build-mode'] }} | |
| tools: https://github.com/dsp-testing/henrymercer-codeql-cli-binaries/releases/download/${{ env.BUNDLE_TAG }}/codeql-bundle-${{ matrix.language }}-${{ matrix.platform }}.tar.zst | |
| - name: Check that the bundle contains only the expected extractors | |
| env: | |
| CODEQL_PATH: ${{ steps.init.outputs.codeql-path }} | |
| LANGUAGE: ${{ matrix.language }} | |
| EXPECTED_EXTRACTORS: ${{ matrix['expected-extractors'] || matrix.language }} | |
| run: | | |
| extractors="$("$CODEQL_PATH" resolve languages --format=json | jq -r 'keys[]')" | |
| echo "Extractors in the bundle:" | |
| echo "$extractors" | |
| echo "Expected: $EXPECTED_EXTRACTORS" | |
| for expected in $EXPECTED_EXTRACTORS; do | |
| if ! echo "$extractors" | grep -qx "$expected"; then | |
| echo "::error::The ${LANGUAGE} bundle does not contain the ${expected} extractor." | |
| exit 1 | |
| fi | |
| done | |
| # If the bundle contained extractors beyond those the language needs, then it would not | |
| # have been trimmed, and this job would be silently validating the combined bundle. | |
| for other in actions cpp csharp go java javascript python ruby rust swift; do | |
| if echo "$EXPECTED_EXTRACTORS" | grep -qw "$other"; then | |
| continue | |
| fi | |
| if echo "$extractors" | grep -qx "$other"; then | |
| echo "::error::The ${LANGUAGE} bundle also contains the ${other} extractor, so it is not trimmed." | |
| exit 1 | |
| fi | |
| done | |
| - name: Check that the bundle was not added to the toolcache | |
| env: | |
| CODEQL_PATH: ${{ steps.init.outputs.codeql-path }} | |
| run: | | |
| # A bundle that is missing most of its extractors must never be left in the toolcache, | |
| # where a later job analyzing a different language could pick it up. | |
| echo "CodeQL is at $CODEQL_PATH" | |
| if [[ "$CODEQL_PATH" == "$RUNNER_TOOL_CACHE"/* ]]; then | |
| echo "::error::The per-language bundle was added to the toolcache at $CODEQL_PATH." | |
| exit 1 | |
| fi | |
| # The runner image ships with its own CodeQL in the toolcache, so look for the version we | |
| # downloaded rather than for CodeQL in general. | |
| cached_version="$RUNNER_TOOL_CACHE/CodeQL/0.0.0-${BUNDLE_TAG#codeql-bundle-}" | |
| if [ -d "$cached_version" ]; then | |
| echo "::error::The per-language bundle was added to the toolcache at $cached_version." | |
| exit 1 | |
| fi | |
| - name: Build code | |
| if: matrix['build-command'] | |
| run: ${{ matrix['build-command'] }} | |
| - uses: ./../action/autobuild | |
| if: matrix['build-mode'] == 'autobuild' | |
| timeout-minutes: 30 | |
| - uses: ./../action/analyze | |
| id: analysis | |
| with: | |
| upload-database: false | |
| - name: Check that a database was created for the language | |
| env: | |
| DB_LOCATIONS: ${{ steps.analysis.outputs.db-locations }} | |
| LANGUAGE: ${{ matrix.language }} | |
| run: | | |
| database="$(echo "$DB_LOCATIONS" | jq -r --arg lang "$LANGUAGE" '.[$lang] // empty')" | |
| if [ -z "$database" ] || [ ! -d "$database" ]; then | |
| echo "::error::No CodeQL database was created for ${LANGUAGE}." | |
| echo "Databases: $DB_LOCATIONS" | |
| exit 1 | |
| fi | |
| echo "Created a ${LANGUAGE} database at ${database}." |