From 2c6d525faa37685eb8a677b041e49725dd8d44cb Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 30 Oct 2026 12:03:46 +0000 Subject: [PATCH] Apply consistent YAML formatting --- .github/ISSUE_TEMPLATE/config.yml | 2 +- .../check-codescanning-config/action.yml | 8 +- .github/actions/query-filter-test/action.yml | 2 +- .github/actions/release-branches/action.yml | 8 +- .github/actions/release-initialise/action.yml | 9 +- .github/workflows/__all-platform-bundle.yml | 10 +- .github/workflows/__analysis-kinds.yml | 22 +- .github/workflows/__analyze-ref-input.yml | 14 +- .github/workflows/__autobuild-action.yml | 18 +- ...obuild-direct-tracing-with-working-dir.yml | 10 +- .github/workflows/__autobuild-working-dir.yml | 6 +- .github/workflows/__build-mode-autobuild.yml | 12 +- .github/workflows/__build-mode-manual.yml | 12 +- .github/workflows/__build-mode-none.yml | 8 +- .github/workflows/__build-mode-rollback.yml | 8 +- .github/workflows/__bundle-from-nightly.yml | 10 +- .github/workflows/__bundle-from-toolcache.yml | 10 +- .github/workflows/__bundle-toolcache.yml | 10 +- .../workflows/__cleanup-db-cluster-dir.yml | 8 +- .github/workflows/__config-export.yml | 12 +- .github/workflows/__config-input.yml | 6 +- .github/workflows/__cpp-deptrace-disabled.yml | 12 +- .../__cpp-deptrace-enabled-on-macos.yml | 12 +- .github/workflows/__cpp-deptrace-enabled.yml | 12 +- .github/workflows/__diagnostics-export.yml | 12 +- .../workflows/__diagnostics-without-db.yml | 10 +- .../__export-file-baseline-information.yml | 14 +- .github/workflows/__extractor-ram-threads.yml | 6 +- .github/workflows/__global-proxy.yml | 6 +- .github/workflows/__go-custom-queries.yml | 16 +- ...indirect-tracing-workaround-diagnostic.yml | 20 +- ...ect-tracing-workaround-no-file-program.yml | 18 +- .../__go-indirect-tracing-workaround.yml | 14 +- .../workflows/__go-tracing-autobuilder.yml | 16 +- .../__go-tracing-custom-build-steps.yml | 14 +- .../__go-tracing-legacy-workflow.yml | 16 +- .github/workflows/__go.yml | 16 +- .github/workflows/__init-with-registries.yml | 12 +- .../workflows/__javascript-source-root.yml | 6 +- .github/workflows/__job-run-uuid-sarif.yml | 10 +- .github/workflows/__language-aliases.yml | 8 +- .github/workflows/__linux-arm64.yml | 10 +- .github/workflows/__local-bundle.yml | 10 +- .../workflows/__multi-language-autodetect.yml | 14 +- .github/workflows/__overlay-init-fallback.yml | 6 +- ...ackaging-codescanning-config-inputs-js.yml | 18 +- .../__packaging-config-inputs-js.yml | 18 +- .github/workflows/__packaging-config-js.yml | 18 +- .github/workflows/__packaging-inputs-js.yml | 18 +- .../__per-language-bundle-validation.yml | 6 +- .github/workflows/__remote-config.yml | 10 +- .../__resolve-environment-action.yml | 6 +- .github/workflows/__ruby.yml | 6 +- .github/workflows/__rust.yml | 6 +- .github/workflows/__split-workflow.yml | 16 +- .github/workflows/__start-proxy.yml | 8 +- .github/workflows/__submit-sarif-failure.yml | 8 +- .github/workflows/__swift-autobuild.yml | 6 +- .github/workflows/__swift-custom-build.yml | 12 +- .github/workflows/__unset-environment.yml | 10 +- .github/workflows/__unsupported-macos.yml | 8 +- .github/workflows/__upload-ref-sha-input.yml | 18 +- .github/workflows/__upload-sarif.yml | 40 +- .github/workflows/__with-checkout-path.yml | 10 +- .github/workflows/codeql.yml | 152 ++++---- .github/workflows/codescanning-config-cli.yml | 342 +++++++++--------- .../workflows/publish-immutable-action.yml | 4 +- .github/workflows/python312-windows.yml | 32 +- .github/workflows/query-filters.yml | 82 ++--- .github/workflows/test-codeql-bundle-all.yml | 56 +-- .github/workflows/update-bundle.yml | 4 +- .github/workflows/update-release-branch.yml | 116 +++--- ...e-supported-enterprise-server-versions.yml | 2 +- action.yml | 8 +- autobuild/action.yml | 8 +- init/action.yml | 16 +- pr-checks/checks/analyze-ref-input.yml | 4 +- pr-checks/checks/init-with-registries.yml | 6 +- pr-checks/checks/overlay-init-fallback.yml | 2 +- pr-checks/checks/upload-ref-sha-input.yml | 8 +- pr-checks/checks/upload-sarif.yml | 20 +- pr-checks/sync.ts | 14 +- resolve-environment/action.yml | 8 +- setup-codeql/action.yml | 10 +- src/testdata/pr-diff-range.yml | 3 +- .../codeql/codeql-config-query-filters1.yml | 12 +- .../codeql/codeql-config-query-filters2.yml | 18 +- .../codeql/codeql-config-query-filters3.yml | 37 +- .../.github/codeql/custom-queries.yml | 8 +- .../complex-javascript-qlpack/qlpack.yml | 2 +- .../complex-python-qlpack/qlpack.yml | 2 +- .../codeql-qlpacks/cpp-qlpack/qlpack.yml | 2 +- .../codeql-qlpacks/csharp-qlpack/qlpack.yml | 2 +- .../codeql-qlpacks/go-qlpack/qlpack.yml | 2 +- .../codeql-qlpacks/java-qlpack/qlpack.yml | 2 +- .../javascript-qlpack/qlpack.yml | 2 +- .../codeql-qlpacks/python-qlpack/qlpack.yml | 2 +- upload-sarif/action.yml | 12 +- 98 files changed, 865 insertions(+), 872 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 1c514912c..f66079071 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -2,4 +2,4 @@ blank_issues_enabled: true contact_links: - name: Contact GitHub Support url: https://support.github.com/request - about: Contact Support + about: Contact Support diff --git a/.github/actions/check-codescanning-config/action.yml b/.github/actions/check-codescanning-config/action.yml index 0c65c3a41..bd680cc9f 100644 --- a/.github/actions/check-codescanning-config/action.yml +++ b/.github/actions/check-codescanning-config/action.yml @@ -1,7 +1,7 @@ name: Check Code-Scanning Config description: | - Checks the code scanning configuration file generated by the - action to ensure it contains the expected contents + Checks the code scanning configuration file generated by the + action to ensure it contains the expected contents inputs: languages: required: false @@ -52,7 +52,7 @@ runs: tools: ${{ inputs.tools }} db-location: ${{ runner.temp }}/codescanning-config-cli-test env: - CODEQL_ACTION_TEST_MODE: 'true' + CODEQL_ACTION_TEST_MODE: "true" - name: Install dependencies shell: bash @@ -62,7 +62,7 @@ runs: working-directory: ${{ github.action_path }} shell: bash env: - EXPECTED_CONFIG_FILE_CONTENTS: '${{ inputs.expected-config-file-contents }}' + EXPECTED_CONFIG_FILE_CONTENTS: "${{ inputs.expected-config-file-contents }}" run: ts-node ./index.ts "$RUNNER_TEMP/user-config.yaml" "$EXPECTED_CONFIG_FILE_CONTENTS" - name: Clean up shell: bash diff --git a/.github/actions/query-filter-test/action.yml b/.github/actions/query-filter-test/action.yml index f1dfc38bf..ab4f9286a 100644 --- a/.github/actions/query-filter-test/action.yml +++ b/.github/actions/query-filter-test/action.yml @@ -54,7 +54,7 @@ runs: - name: Check SARIF uses: ./../action/.github/actions/check-sarif with: - sarif-file: ${{ inputs.sarif-file }} + sarif-file: ${{ inputs.sarif-file }} queries-run: ${{ inputs.queries-run}} queries-not-run: ${{ inputs.queries-not-run}} - name: Cleanup after test diff --git a/.github/actions/release-branches/action.yml b/.github/actions/release-branches/action.yml index 7734411c7..3d08d43ec 100644 --- a/.github/actions/release-branches/action.yml +++ b/.github/actions/release-branches/action.yml @@ -1,11 +1,11 @@ -name: 'Release branches' -description: 'Determine branches for release & backport' +name: "Release branches" +description: "Determine branches for release & backport" inputs: major_version: - description: 'The version as extracted from the package.json file' + description: "The version as extracted from the package.json file" required: true latest_tag: - description: 'The most recent tag published to the repository' + description: "The most recent tag published to the repository" required: true outputs: backport_source_branch: diff --git a/.github/actions/release-initialise/action.yml b/.github/actions/release-initialise/action.yml index b734377a7..d0e99f4ed 100644 --- a/.github/actions/release-initialise/action.yml +++ b/.github/actions/release-initialise/action.yml @@ -1,17 +1,16 @@ -name: 'Prepare release job' -description: 'Prepare for updating a release branch' +name: "Prepare release job" +description: "Prepare for updating a release branch" runs: using: "composite" steps: - - name: Dump environment run: env shell: bash - name: Dump GitHub context env: - GITHUB_CONTEXT: '${{ toJson(github) }}' + GITHUB_CONTEXT: "${{ toJson(github) }}" run: echo "$GITHUB_CONTEXT" shell: bash @@ -19,7 +18,7 @@ runs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - cache: 'npm' + cache: "npm" - name: Install JavaScript dependencies shell: bash diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index 5f2a6fa86..22635a0d1 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -84,8 +84,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'true' - setup-kotlin: 'true' + use-all-platform-bundle: "true" + setup-kotlin: "true" - id: init uses: ./../action/init with: diff --git a/.github/workflows/__analysis-kinds.yml b/.github/workflows/__analysis-kinds.yml index a0a14c8c5..f916bda40 100644 --- a/.github/workflows/__analysis-kinds.yml +++ b/.github/workflows/__analysis-kinds.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -73,8 +73,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: javascript @@ -82,16 +82,16 @@ jobs: tools: ${{ steps.prepare-test.outputs.tools-url }} - uses: ./../action/analyze with: - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" upload-database: false - post-processed-sarif-path: '${{ runner.temp }}/post-processed' + post-processed-sarif-path: "${{ runner.temp }}/post-processed" - name: Upload SARIF files uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: | analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }} - path: '${{ runner.temp }}/results/*.sarif' + path: "${{ runner.temp }}/results/*.sarif" retention-days: 7 - name: Upload post-processed SARIF @@ -99,7 +99,7 @@ jobs: with: name: | post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }} - path: '${{ runner.temp }}/post-processed' + path: "${{ runner.temp }}/post-processed" retention-days: 7 if-no-files-found: error @@ -107,16 +107,16 @@ jobs: if: contains(matrix.analysis-kinds, 'code-scanning') uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 env: - SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif' - EXPECT_PRESENT: 'false' + SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif" + EXPECT_PRESENT: "false" with: script: ${{ env.CHECK_SCRIPT }} - name: Check quality query appears in quality SARIF if: contains(matrix.analysis-kinds, 'code-quality') uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 env: - SARIF_PATH: '${{ runner.temp }}/results/javascript.quality.sarif' - EXPECT_PRESENT: 'true' + SARIF_PATH: "${{ runner.temp }}/results/javascript.quality.sarif" + EXPECT_PRESENT: "true" with: script: ${{ env.CHECK_SCRIPT }} env: diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index 1e899b39a..e12f918e4 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -80,8 +80,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: tools: ${{ steps.prepare-test.outputs.tools-url }} @@ -91,7 +91,7 @@ jobs: run: ./build.sh - uses: ./../action/analyze with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" env: CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__autobuild-action.yml b/.github/workflows/__autobuild-action.yml index fcf5094e1..c9e495d0a 100644 --- a/.github/workflows/__autobuild-action.yml +++ b/.github/workflows/__autobuild-action.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -69,8 +69,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: csharp @@ -78,12 +78,12 @@ jobs: - uses: ./../action/autobuild env: # Explicitly disable the CLR tracer. - COR_ENABLE_PROFILING: '' - COR_PROFILER: '' - COR_PROFILER_PATH_64: '' - CORECLR_ENABLE_PROFILING: '' - CORECLR_PROFILER: '' - CORECLR_PROFILER_PATH_64: '' + COR_ENABLE_PROFILING: "" + COR_PROFILER: "" + COR_PROFILER_PATH_64: "" + CORECLR_ENABLE_PROFILING: "" + CORECLR_PROFILER: "" + CORECLR_PROFILER_PATH_64: "" - uses: ./../action/analyze - name: Check database run: | diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml index d0830846a..b28b6a084 100644 --- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml +++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml @@ -17,21 +17,21 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: java-version: type: string description: The version of Java to install required: false - default: '17' + default: "17" workflow_call: inputs: java-version: type: string description: The version of Java to install required: false - default: '17' + default: "17" defaults: run: shell: bash @@ -72,8 +72,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Test setup run: | # Make sure that Gradle build succeeds in autobuild-dir ... diff --git a/.github/workflows/__autobuild-working-dir.yml b/.github/workflows/__autobuild-working-dir.yml index 489e4ed7d..930df5d7c 100644 --- a/.github/workflows/__autobuild-working-dir.yml +++ b/.github/workflows/__autobuild-working-dir.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -51,8 +51,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Test setup run: | # Make sure that Gradle build succeeds in autobuild-dir ... diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml index 2e8957336..e0e74bda1 100644 --- a/.github/workflows/__build-mode-autobuild.yml +++ b/.github/workflows/__build-mode-autobuild.yml @@ -17,21 +17,21 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: java-version: type: string description: The version of Java to install required: false - default: '17' + default: "17" workflow_call: inputs: java-version: type: string description: The version of Java to install required: false - default: '17' + default: "17" defaults: run: shell: bash @@ -80,8 +80,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Set up Java test repo configuration run: | mv * .github ../action/tests/multi-language-repo/ @@ -92,7 +92,7 @@ jobs: id: init with: build-mode: autobuild - db-location: '${{ runner.temp }}/customDbLocation' + db-location: "${{ runner.temp }}/customDbLocation" languages: java tools: ${{ steps.prepare-test.outputs.tools-url }} diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml index 14cdc5654..ecca03952 100644 --- a/.github/workflows/__build-mode-manual.yml +++ b/.github/workflows/__build-mode-manual.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -80,13 +80,13 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init id: init with: build-mode: manual - db-location: '${{ runner.temp }}/customDbLocation' + db-location: "${{ runner.temp }}/customDbLocation" languages: java tools: ${{ steps.prepare-test.outputs.tools-url }} diff --git a/.github/workflows/__build-mode-none.yml b/.github/workflows/__build-mode-none.yml index 690e7fe38..c01ba2539 100644 --- a/.github/workflows/__build-mode-none.yml +++ b/.github/workflows/__build-mode-none.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -53,13 +53,13 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init id: init with: build-mode: none - db-location: '${{ runner.temp }}/customDbLocation' + db-location: "${{ runner.temp }}/customDbLocation" languages: java tools: ${{ steps.prepare-test.outputs.tools-url }} diff --git a/.github/workflows/__build-mode-rollback.yml b/.github/workflows/__build-mode-rollback.yml index 0e53ba195..e18b41156 100644 --- a/.github/workflows/__build-mode-rollback.yml +++ b/.github/workflows/__build-mode-rollback.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -51,8 +51,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Set up Java test repo configuration run: | mv * .github ../action/tests/multi-language-repo/ @@ -63,7 +63,7 @@ jobs: id: init with: build-mode: none - db-location: '${{ runner.temp }}/customDbLocation' + db-location: "${{ runner.temp }}/customDbLocation" languages: java tools: ${{ steps.prepare-test.outputs.tools-url }} diff --git a/.github/workflows/__bundle-from-nightly.yml b/.github/workflows/__bundle-from-nightly.yml index 08fb84959..57b2503e6 100644 --- a/.github/workflows/__bundle-from-nightly.yml +++ b/.github/workflows/__bundle-from-nightly.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Bundle: From nightly' +name: "PR Check - Bundle: From nightly" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -36,7 +36,7 @@ jobs: include: - os: ubuntu-26.04 version: linked - name: 'Bundle: From nightly' + name: "Bundle: From nightly" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -51,8 +51,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - id: init uses: ./../action/init env: diff --git a/.github/workflows/__bundle-from-toolcache.yml b/.github/workflows/__bundle-from-toolcache.yml index 79245e665..23011be21 100644 --- a/.github/workflows/__bundle-from-toolcache.yml +++ b/.github/workflows/__bundle-from-toolcache.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Bundle: From toolcache' +name: "PR Check - Bundle: From toolcache" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -36,7 +36,7 @@ jobs: include: - os: ubuntu-26.04 version: toolcache - name: 'Bundle: From toolcache' + name: "Bundle: From toolcache" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -60,8 +60,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Check toolcache contains CodeQL continue-on-error: true run: | diff --git a/.github/workflows/__bundle-toolcache.yml b/.github/workflows/__bundle-toolcache.yml index 3f7264820..fca833697 100644 --- a/.github/workflows/__bundle-toolcache.yml +++ b/.github/workflows/__bundle-toolcache.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Bundle: Caching checks' +name: "PR Check - Bundle: Caching checks" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -40,7 +40,7 @@ jobs: version: linked - os: windows-2025 version: linked - name: 'Bundle: Caching checks' + name: "Bundle: Caching checks" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -64,8 +64,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Remove CodeQL from toolcache run: | cd ./../action diff --git a/.github/workflows/__cleanup-db-cluster-dir.yml b/.github/workflows/__cleanup-db-cluster-dir.yml index 904932ced..ce9ee41da 100644 --- a/.github/workflows/__cleanup-db-cluster-dir.yml +++ b/.github/workflows/__cleanup-db-cluster-dir.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -51,8 +51,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Add a file to the database cluster directory run: | mkdir -p "${{ runner.temp }}/customDbLocation/javascript" @@ -62,7 +62,7 @@ jobs: id: init with: build-mode: none - db-location: '${{ runner.temp }}/customDbLocation' + db-location: "${{ runner.temp }}/customDbLocation" languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml index 82ff82728..da9e743a6 100644 --- a/.github/workflows/__config-export.yml +++ b/.github/workflows/__config-export.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -53,8 +53,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: javascript @@ -62,18 +62,18 @@ jobs: tools: ${{ steps.prepare-test.outputs.tools-url }} - uses: ./../action/analyze with: - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" upload-database: false - name: Upload SARIF uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json - path: '${{ runner.temp }}/results/javascript.sarif' + path: "${{ runner.temp }}/results/javascript.sarif" retention-days: 7 - name: Check config properties appear in SARIF uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 env: - SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif' + SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif" with: script: | const fs = require('fs'); diff --git a/.github/workflows/__config-input.yml b/.github/workflows/__config-input.yml index 8c4544a7a..03934bd43 100644 --- a/.github/workflows/__config-input.yml +++ b/.github/workflows/__config-input.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -60,8 +60,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Copy queries into workspace run: | cp -a ../action/queries . diff --git a/.github/workflows/__cpp-deptrace-disabled.yml b/.github/workflows/__cpp-deptrace-disabled.yml index d84e32298..5f24cd8cf 100644 --- a/.github/workflows/__cpp-deptrace-disabled.yml +++ b/.github/workflows/__cpp-deptrace-disabled.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - C/C++: disabling autoinstalling dependencies (Linux)' +name: "PR Check - C/C++: disabling autoinstalling dependencies (Linux)" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -40,7 +40,7 @@ jobs: version: default - os: ubuntu-26.04 version: nightly-latest - name: 'C/C++: disabling autoinstalling dependencies (Linux)' + name: "C/C++: disabling autoinstalling dependencies (Linux)" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -55,8 +55,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Test setup run: | cp -a ../action/tests/cpp-autobuild autobuild-dir @@ -75,5 +75,5 @@ jobs: exit 1 fi env: - DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false' + DOTNET_GENERATE_ASPNET_CERTIFICATE: "false" CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml index cca23b089..c0794ee87 100644 --- a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml +++ b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - C/C++: autoinstalling dependencies is skipped (macOS)' +name: "PR Check - C/C++: autoinstalling dependencies is skipped (macOS)" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -38,7 +38,7 @@ jobs: version: linked - os: macos-26 version: nightly-latest - name: 'C/C++: autoinstalling dependencies is skipped (macOS)' + name: "C/C++: autoinstalling dependencies is skipped (macOS)" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -53,8 +53,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Test setup run: | cp -a ../action/tests/cpp-autobuild autobuild-dir @@ -75,5 +75,5 @@ jobs: exit 1 fi env: - DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false' + DOTNET_GENERATE_ASPNET_CERTIFICATE: "false" CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__cpp-deptrace-enabled.yml b/.github/workflows/__cpp-deptrace-enabled.yml index 51ce4401c..dd74b17d6 100644 --- a/.github/workflows/__cpp-deptrace-enabled.yml +++ b/.github/workflows/__cpp-deptrace-enabled.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - C/C++: autoinstalling dependencies (Linux)' +name: "PR Check - C/C++: autoinstalling dependencies (Linux)" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -40,7 +40,7 @@ jobs: version: default - os: ubuntu-26.04 version: nightly-latest - name: 'C/C++: autoinstalling dependencies (Linux)' + name: "C/C++: autoinstalling dependencies (Linux)" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -55,8 +55,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Test setup run: | cp -a ../action/tests/cpp-autobuild autobuild-dir @@ -75,5 +75,5 @@ jobs: exit 1 fi env: - DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false' + DOTNET_GENERATE_ASPNET_CERTIFICATE: "false" CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml index d6494ac78..58923dac7 100644 --- a/.github/workflows/__diagnostics-export.yml +++ b/.github/workflows/__diagnostics-export.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -62,8 +62,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init id: init with: @@ -82,18 +82,18 @@ jobs: --ready-for-status-page - uses: ./../action/analyze with: - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" upload-database: false - name: Upload SARIF uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json - path: '${{ runner.temp }}/results/javascript.sarif' + path: "${{ runner.temp }}/results/javascript.sarif" retention-days: 7 - name: Check diagnostics appear in SARIF env: - SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif' + SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif" run: | cd ../action npx tsx ./pr-checks/check-diagnostics.ts diff --git a/.github/workflows/__diagnostics-without-db.yml b/.github/workflows/__diagnostics-without-db.yml index 9a1c3d6d9..5fbd580cc 100644 --- a/.github/workflows/__diagnostics-without-db.yml +++ b/.github/workflows/__diagnostics-without-db.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -67,8 +67,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Initialise failing analysis id: init uses: ./../action/init @@ -87,11 +87,11 @@ jobs: # `category` input. Without this step, that part of the init post-action would fail. if: false with: - category: '/test-codeql-version:${{ matrix.version }}' + category: "/test-codeql-version:${{ matrix.version }}" - name: Check diagnostics appear on disk env: - DIAGNOSTICS_DIR: '${{ runner.temp }}/codeql-action-temp-diagnostics/' + DIAGNOSTICS_DIR: "${{ runner.temp }}/codeql-action-temp-diagnostics/" run: | cd ../action npx tsx ./pr-checks/diagnostics-without-db.ts diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index 050012257..b4e9138fe 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -84,8 +84,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init id: init with: @@ -100,12 +100,12 @@ jobs: run: ./build.sh - uses: ./../action/analyze with: - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" - name: Upload SARIF uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json - path: '${{ runner.temp }}/results/javascript.sarif' + path: "${{ runner.temp }}/results/javascript.sarif" retention-days: 7 - name: Check results run: | diff --git a/.github/workflows/__extractor-ram-threads.yml b/.github/workflows/__extractor-ram-threads.yml index 2275921b4..bf9343d8d 100644 --- a/.github/workflows/__extractor-ram-threads.yml +++ b/.github/workflows/__extractor-ram-threads.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -51,8 +51,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: java diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml index 0c68f0dd4..c2f9f8514 100644 --- a/.github/workflows/__global-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -53,8 +53,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'false' + use-all-platform-bundle: "false" + setup-kotlin: "false" - name: Block direct internet access to force proxy usage run: | apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1 diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml index db7acd1ac..95287af32 100644 --- a/.github/workflows/__go-custom-queries.yml +++ b/.github/workflows/__go-custom-queries.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Go: Custom queries' +name: "PR Check - Go: Custom queries" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -58,7 +58,7 @@ jobs: version: linked - os: ubuntu-26.04 version: nightly-latest - name: 'Go: Custom queries' + name: "Go: Custom queries" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -82,8 +82,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: go @@ -93,5 +93,5 @@ jobs: run: ./build.sh - uses: ./../action/analyze env: - DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false' + DOTNET_GENERATE_ASPNET_CERTIFICATE: "false" CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml index b570ae4a6..bee84bef9 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Go: diagnostic when Go is changed after init step' +name: "PR Check - Go: diagnostic when Go is changed after init step" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,21 +17,21 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: go-version: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: go-version: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -46,7 +46,7 @@ jobs: include: - os: ubuntu-26.04 version: default - name: 'Go: diagnostic when Go is changed after init step' + name: "Go: diagnostic when Go is changed after init step" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -66,8 +66,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: go @@ -75,17 +75,17 @@ jobs: # Deliberately change Go after the `init` step - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: '1.20' + go-version: "1.20" - name: Build code run: go build main.go - uses: ./../action/analyze with: - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" upload-database: false - name: Check diagnostic appears in SARIF uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 env: - SARIF_PATH: '${{ runner.temp }}/results/go.sarif' + SARIF_PATH: "${{ runner.temp }}/results/go.sarif" with: script: | const fs = require('fs'); diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml index 137583625..3b535ecb4 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Go: diagnostic when `file` is not installed' +name: "PR Check - Go: diagnostic when `file` is not installed" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,21 +17,21 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: go-version: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: go-version: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -46,7 +46,7 @@ jobs: include: - os: ubuntu-26.04 version: default - name: 'Go: diagnostic when `file` is not installed' + name: "Go: diagnostic when `file` is not installed" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -66,8 +66,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Remove `file` program run: | echo $(which file) @@ -81,12 +81,12 @@ jobs: run: go build main.go - uses: ./../action/analyze with: - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" upload-database: false - name: Check diagnostic appears in SARIF uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 env: - SARIF_PATH: '${{ runner.temp }}/results/go.sarif' + SARIF_PATH: "${{ runner.temp }}/results/go.sarif" with: script: | const fs = require('fs'); diff --git a/.github/workflows/__go-indirect-tracing-workaround.yml b/.github/workflows/__go-indirect-tracing-workaround.yml index 5296e5837..6a659f8eb 100644 --- a/.github/workflows/__go-indirect-tracing-workaround.yml +++ b/.github/workflows/__go-indirect-tracing-workaround.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Go: workaround for indirect tracing' +name: "PR Check - Go: workaround for indirect tracing" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,21 +17,21 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: go-version: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: go-version: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -46,7 +46,7 @@ jobs: include: - os: ubuntu-26.04 version: default - name: 'Go: workaround for indirect tracing' + name: "Go: workaround for indirect tracing" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -66,8 +66,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: go diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml index 2b7005698..3a12fe90f 100644 --- a/.github/workflows/__go-tracing-autobuilder.yml +++ b/.github/workflows/__go-tracing-autobuilder.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Go: tracing with autobuilder step' +name: "PR Check - Go: tracing with autobuilder step" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,21 +17,21 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: go-version: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: go-version: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -66,7 +66,7 @@ jobs: version: nightly-latest - os: macos-26 version: nightly-latest - name: 'Go: tracing with autobuilder step' + name: "Go: tracing with autobuilder step" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -86,8 +86,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: go @@ -106,5 +106,5 @@ jobs: exit 1 fi env: - DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false' + DOTNET_GENERATE_ASPNET_CERTIFICATE: "false" CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml index cc14651de..798cb55c3 100644 --- a/.github/workflows/__go-tracing-custom-build-steps.yml +++ b/.github/workflows/__go-tracing-custom-build-steps.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Go: tracing with custom build steps' +name: "PR Check - Go: tracing with custom build steps" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,21 +17,21 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: go-version: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: go-version: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -66,7 +66,7 @@ jobs: version: nightly-latest - os: macos-26 version: nightly-latest - name: 'Go: tracing with custom build steps' + name: "Go: tracing with custom build steps" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -86,8 +86,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: go diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml index df62bf53c..92ed9dc2f 100644 --- a/.github/workflows/__go-tracing-legacy-workflow.yml +++ b/.github/workflows/__go-tracing-legacy-workflow.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Go: tracing with legacy workflow' +name: "PR Check - Go: tracing with legacy workflow" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,21 +17,21 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: go-version: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: go-version: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -66,7 +66,7 @@ jobs: version: nightly-latest - os: macos-26 version: nightly-latest - name: 'Go: tracing with legacy workflow' + name: "Go: tracing with legacy workflow" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -86,8 +86,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: go @@ -100,5 +100,5 @@ jobs: exit 1 fi env: - DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false' + DOTNET_GENERATE_ASPNET_CERTIFICATE: "false" CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__go.yml b/.github/workflows/__go.yml index 3688dc6fd..e16be4009 100644 --- a/.github/workflows/__go.yml +++ b/.github/workflows/__go.yml @@ -19,10 +19,10 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" jobs: go-custom-queries: - name: 'Go: Custom queries' + name: "Go: Custom queries" permissions: contents: read security-events: read @@ -31,7 +31,7 @@ jobs: dotnet-version: ${{ inputs.dotnet-version }} go-version: ${{ inputs.go-version }} go-indirect-tracing-workaround-diagnostic: - name: 'Go: diagnostic when Go is changed after init step' + name: "Go: diagnostic when Go is changed after init step" permissions: contents: read security-events: read @@ -39,7 +39,7 @@ jobs: with: go-version: ${{ inputs.go-version }} go-indirect-tracing-workaround-no-file-program: - name: 'Go: diagnostic when `file` is not installed' + name: "Go: diagnostic when `file` is not installed" permissions: contents: read security-events: read @@ -47,7 +47,7 @@ jobs: with: go-version: ${{ inputs.go-version }} go-indirect-tracing-workaround: - name: 'Go: workaround for indirect tracing' + name: "Go: workaround for indirect tracing" permissions: contents: read security-events: read @@ -55,7 +55,7 @@ jobs: with: go-version: ${{ inputs.go-version }} go-tracing-autobuilder: - name: 'Go: tracing with autobuilder step' + name: "Go: tracing with autobuilder step" permissions: contents: read security-events: read @@ -63,7 +63,7 @@ jobs: with: go-version: ${{ inputs.go-version }} go-tracing-custom-build-steps: - name: 'Go: tracing with custom build steps' + name: "Go: tracing with custom build steps" permissions: contents: read security-events: read @@ -71,7 +71,7 @@ jobs: with: go-version: ${{ inputs.go-version }} go-tracing-legacy-workflow: - name: 'Go: tracing with legacy workflow' + name: "Go: tracing with legacy workflow" permissions: contents: read security-events: read diff --git a/.github/workflows/__init-with-registries.yml b/.github/workflows/__init-with-registries.yml index 2e36baddc..3a01c3e51 100644 --- a/.github/workflows/__init-with-registries.yml +++ b/.github/workflows/__init-with-registries.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Packaging: Download using registries' +name: "PR Check - Packaging: Download using registries" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -40,7 +40,7 @@ jobs: version: linked - os: ubuntu-26.04 version: nightly-latest - name: 'Packaging: Download using registries' + name: "Packaging: Download using registries" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -55,12 +55,12 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Init with registries uses: ./../action/init with: - db-location: '${{ runner.temp }}/customDbLocation' + db-location: "${{ runner.temp }}/customDbLocation" tools: ${{ steps.prepare-test.outputs.tools-url }} config-file: ./.github/codeql/codeql-config-registries.yml languages: javascript diff --git a/.github/workflows/__javascript-source-root.yml b/.github/workflows/__javascript-source-root.yml index 08c68e6f9..703c6ed75 100644 --- a/.github/workflows/__javascript-source-root.yml +++ b/.github/workflows/__javascript-source-root.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -55,8 +55,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Move codeql-action run: | mkdir ../new-source-root diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml index 5d49830cd..4a76f8b95 100644 --- a/.github/workflows/__job-run-uuid-sarif.yml +++ b/.github/workflows/__job-run-uuid-sarif.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -51,8 +51,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init id: init with: @@ -60,12 +60,12 @@ jobs: tools: ${{ steps.prepare-test.outputs.tools-url }} - uses: ./../action/analyze with: - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" - name: Upload SARIF uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json - path: '${{ runner.temp }}/results/javascript.sarif' + path: "${{ runner.temp }}/results/javascript.sarif" retention-days: 7 - name: Check results run: | diff --git a/.github/workflows/__language-aliases.yml b/.github/workflows/__language-aliases.yml index 1e5c17395..048441fd3 100644 --- a/.github/workflows/__language-aliases.yml +++ b/.github/workflows/__language-aliases.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -51,14 +51,14 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: C#,java-kotlin,typescript tools: ${{ steps.prepare-test.outputs.tools-url }} - - name: 'Check languages' + - name: "Check languages" run: | expected_languages="csharp,java,javascript" actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config) diff --git a/.github/workflows/__linux-arm64.yml b/.github/workflows/__linux-arm64.yml index de045d895..02dab69f9 100644 --- a/.github/workflows/__linux-arm64.yml +++ b/.github/workflows/__linux-arm64.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -80,8 +80,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: ${{ env.LANGUAGES }} diff --git a/.github/workflows/__local-bundle.yml b/.github/workflows/__local-bundle.yml index bc384bdf1..e4b20c9b4 100644 --- a/.github/workflows/__local-bundle.yml +++ b/.github/workflows/__local-bundle.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -80,8 +80,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Fetch latest CodeQL bundle run: | wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index f1028a6eb..41588c945 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -114,8 +114,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Install Python 3.13.15 for older CLI versions # Older CLI versions don't work with Python 3.13.16 or newer because their Python extractor # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define. @@ -123,7 +123,7 @@ jobs: if: matrix.version != 'nightly-latest' && matrix.version != 'linked' uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: - python-version: '3.13.15' + python-version: "3.13.15" - name: Use Xcode 16 # Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15. @@ -133,7 +133,7 @@ jobs: - uses: ./../action/init id: init with: - db-location: '${{ runner.temp }}/customDbLocation' + db-location: "${{ runner.temp }}/customDbLocation" languages: ${{ runner.os == 'Linux' && 'cpp,csharp,go,java,javascript,python,ruby' || '' }} tools: ${{ steps.prepare-test.outputs.tools-url }} diff --git a/.github/workflows/__overlay-init-fallback.yml b/.github/workflows/__overlay-init-fallback.yml index a2c320fb5..3cdcec371 100644 --- a/.github/workflows/__overlay-init-fallback.yml +++ b/.github/workflows/__overlay-init-fallback.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -53,8 +53,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: actions # Any language without overlay support will do diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 070d7e391..3b703bea5 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Packaging: Config and input passed to the CLI' +name: "PR Check - Packaging: Config and input passed to the CLI" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -60,7 +60,7 @@ jobs: version: default - os: ubuntu-26.04 version: nightly-latest - name: 'Packaging: Config and input passed to the CLI' + name: "Packaging: Config and input passed to the CLI" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -93,11 +93,11 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: - config-file: '.github/codeql/codeql-config-packaging3.yml' + config-file: ".github/codeql/codeql-config-packaging3.yml" packs: +codeql-testing/codeql-pack1@1.0.0 languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} @@ -105,7 +105,7 @@ jobs: run: ./build.sh - uses: ./../action/analyze with: - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" upload-database: false - name: Check results diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index 3465616db..6a346631e 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Packaging: Config and input' +name: "PR Check - Packaging: Config and input" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -60,7 +60,7 @@ jobs: version: default - os: ubuntu-26.04 version: nightly-latest - name: 'Packaging: Config and input' + name: "Packaging: Config and input" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -93,11 +93,11 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: - config-file: '.github/codeql/codeql-config-packaging3.yml' + config-file: ".github/codeql/codeql-config-packaging3.yml" packs: +codeql-testing/codeql-pack1@1.0.0 languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} @@ -105,7 +105,7 @@ jobs: run: ./build.sh - uses: ./../action/analyze with: - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" upload-database: false - name: Check results diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index 0e7b828c0..75f426c34 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Packaging: Config file' +name: "PR Check - Packaging: Config file" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -60,7 +60,7 @@ jobs: version: default - os: ubuntu-26.04 version: nightly-latest - name: 'Packaging: Config file' + name: "Packaging: Config file" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -93,18 +93,18 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: - config-file: '.github/codeql/codeql-config-packaging.yml' + config-file: ".github/codeql/codeql-config-packaging.yml" languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} - name: Build code run: ./build.sh - uses: ./../action/analyze with: - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" upload-database: false - name: Check results diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index 80c792069..be72e2556 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: 'PR Check - Packaging: Action input' +name: "PR Check - Packaging: Action input" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -60,7 +60,7 @@ jobs: version: default - os: ubuntu-26.04 version: nightly-latest - name: 'Packaging: Action input' + name: "Packaging: Action input" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -93,11 +93,11 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: - config-file: '.github/codeql/codeql-config-packaging2.yml' + config-file: ".github/codeql/codeql-config-packaging2.yml" languages: javascript packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql tools: ${{ steps.prepare-test.outputs.tools-url }} @@ -105,7 +105,7 @@ jobs: run: ./build.sh - uses: ./../action/analyze with: - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" - name: Check results uses: ./../action/.github/actions/check-sarif diff --git a/.github/workflows/__per-language-bundle-validation.yml b/.github/workflows/__per-language-bundle-validation.yml index cb6b1a773..3313ac010 100644 --- a/.github/workflows/__per-language-bundle-validation.yml +++ b/.github/workflows/__per-language-bundle-validation.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -95,8 +95,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Remove CodeQL from toolcache run: | cd ./../action diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml index 485a4904c..1f8b1f127 100644 --- a/.github/workflows/__remote-config.yml +++ b/.github/workflows/__remote-config.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -82,8 +82,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: tools: ${{ steps.prepare-test.outputs.tools-url }} diff --git a/.github/workflows/__resolve-environment-action.yml b/.github/workflows/__resolve-environment-action.yml index 7a4e284d7..2d0ebd6fb 100644 --- a/.github/workflows/__resolve-environment-action.yml +++ b/.github/workflows/__resolve-environment-action.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -55,8 +55,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: go,javascript-typescript diff --git a/.github/workflows/__ruby.yml b/.github/workflows/__ruby.yml index 833e49789..8ce015624 100644 --- a/.github/workflows/__ruby.yml +++ b/.github/workflows/__ruby.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -61,8 +61,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: ruby diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml index 83cdbf677..0e08f9919 100644 --- a/.github/workflows/__rust.yml +++ b/.github/workflows/__rust.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -59,8 +59,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: languages: rust diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml index 0cb63b85c..b80d36819 100644 --- a/.github/workflows/__split-workflow.yml +++ b/.github/workflows/__split-workflow.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -90,11 +90,11 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: - config-file: '.github/codeql/codeql-config-packaging3.yml' + config-file: ".github/codeql/codeql-config-packaging3.yml" packs: +codeql-testing/codeql-pack1@1.0.0 languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} @@ -103,7 +103,7 @@ jobs: - uses: ./../action/analyze with: skip-queries: true - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" upload-database: false - name: Assert No Results @@ -114,7 +114,7 @@ jobs: fi - uses: ./../action/analyze with: - output: '${{ runner.temp }}/results' + output: "${{ runner.temp }}/results" upload-database: false - name: Assert Results run: | diff --git a/.github/workflows/__start-proxy.yml b/.github/workflows/__start-proxy.yml index e6906cbc3..a636a1bf5 100644 --- a/.github/workflows/__start-proxy.yml +++ b/.github/workflows/__start-proxy.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -55,8 +55,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Setup proxy for registries id: proxy uses: ./../action/start-proxy @@ -101,5 +101,5 @@ jobs: tools: ${{ steps.prepare-test.outputs.tools-url }} config-file: codeql-action@main:tests/multi-language-repo/.github/codeql/custom-queries.yml env: - CODEQL_ACTION_PROXY_API_REQUESTS: 'true' + CODEQL_ACTION_PROXY_API_REQUESTS: "true" CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__submit-sarif-failure.yml b/.github/workflows/__submit-sarif-failure.yml index b7edd62fc..8eb219c9b 100644 --- a/.github/workflows/__submit-sarif-failure.yml +++ b/.github/workflows/__submit-sarif-failure.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -55,8 +55,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./init with: @@ -76,7 +76,7 @@ jobs: # `category` input. Without this step, that part of the init post-action would fail. if: false with: - category: '/test-codeql-version:${{ matrix.version }}' + category: "/test-codeql-version:${{ matrix.version }}" env: CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF: true CODEQL_ACTION_UPLOAD_FAILED_SARIF: true diff --git a/.github/workflows/__swift-autobuild.yml b/.github/workflows/__swift-autobuild.yml index 4ba28f348..cc67bfdb6 100644 --- a/.github/workflows/__swift-autobuild.yml +++ b/.github/workflows/__swift-autobuild.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -51,8 +51,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init id: init with: diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml index c38f0daa1..1d1a8d9f1 100644 --- a/.github/workflows/__swift-custom-build.yml +++ b/.github/workflows/__swift-custom-build.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -84,8 +84,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init id: init with: @@ -107,5 +107,5 @@ jobs: exit 1 fi env: - DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false' + DOTNET_GENERATE_ASPNET_CERTIFICATE: "false" CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml index 6ef214e70..77896566e 100644 --- a/.github/workflows/__unset-environment.yml +++ b/.github/workflows/__unset-environment.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -82,8 +82,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init id: init with: diff --git a/.github/workflows/__unsupported-macos.yml b/.github/workflows/__unsupported-macos.yml index 5e388d1ec..167473b48 100644 --- a/.github/workflows/__unsupported-macos.yml +++ b/.github/workflows/__unsupported-macos.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: {} workflow_call: @@ -62,8 +62,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Check xcode_select_link run: | readlink /private/var/db/xcode_select_link @@ -86,7 +86,7 @@ jobs: if: false uses: ./analyze with: - category: '/test-codeql-version:${{ matrix.version }}' + category: "/test-codeql-version:${{ matrix.version }}" env: CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false CODEQL_ACTION_SKIP_SARIF_UPLOAD: true diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index 079bc6597..f0f38c32e 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -80,8 +80,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: tools: ${{ steps.prepare-test.outputs.tools-url }} @@ -92,12 +92,12 @@ jobs: # Generate some SARIF we can upload with the upload-sarif step - uses: ./../action/analyze with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" upload: never - uses: ./../action/upload-sarif with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" env: CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__upload-sarif.yml b/.github/workflows/__upload-sarif.yml index c35fb3f59..a1f53bbbe 100644 --- a/.github/workflows/__upload-sarif.yml +++ b/.github/workflows/__upload-sarif.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -87,8 +87,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - uses: ./../action/init with: tools: ${{ steps.prepare-test.outputs.tools-url }} @@ -99,8 +99,8 @@ jobs: # Generate some SARIF we can upload with the upload-sarif step - uses: ./../action/analyze with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" upload: never output: ${{ runner.temp }}/results @@ -109,15 +109,15 @@ jobs: uses: ./../action/upload-sarif id: upload-sarif with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" sarif_file: ${{ runner.temp }}/results category: | ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:all-files/ - - name: 'Fail for missing output from `upload-sarif` step for `code-scanning`' + - name: "Fail for missing output from `upload-sarif` step for `code-scanning`" if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-scanning) run: exit 1 - - name: 'Fail for missing output from `upload-sarif` step for `code-quality`' + - name: "Fail for missing output from `upload-sarif` step for `code-quality`" if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality) run: exit 1 @@ -126,12 +126,12 @@ jobs: id: upload-single-sarif-code-scanning if: contains(matrix.analysis-kinds, 'code-scanning') with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" sarif_file: ${{ runner.temp }}/results/javascript.sarif category: | ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-scanning/ - - name: 'Fail for missing output from `upload-single-sarif-code-scanning` step' + - name: "Fail for missing output from `upload-single-sarif-code-scanning` step" if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-sarif-code-scanning.outputs.sarif-ids).code-scanning) run: exit 1 - name: Upload single SARIF file for Code Quality @@ -139,12 +139,12 @@ jobs: id: upload-single-sarif-code-quality if: contains(matrix.analysis-kinds, 'code-quality') with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" sarif_file: ${{ runner.temp }}/results/javascript.quality.sarif category: | ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-quality/ - - name: 'Fail for missing output from `upload-single-sarif-code-quality` step' + - name: "Fail for missing output from `upload-single-sarif-code-quality` step" if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-single-sarif-code-quality.outputs.sarif-ids).code-quality) run: exit 1 @@ -156,12 +156,12 @@ jobs: id: upload-single-non-sarif if: contains(matrix.analysis-kinds, 'code-scanning') with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" sarif_file: ${{ runner.temp }}/results/javascript.sarif.json category: | ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:non-sarif/ - - name: 'Fail for missing output from `upload-single-non-sarif` step' + - name: "Fail for missing output from `upload-single-non-sarif` step" if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-non-sarif.outputs.sarif-ids).code-scanning) run: exit 1 env: diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index d3c849c73..cef72ae57 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -17,7 +17,7 @@ on: types: - checks_requested schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: inputs: dotnet-version: @@ -29,7 +29,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" workflow_call: inputs: dotnet-version: @@ -41,7 +41,7 @@ on: type: string description: The version of Go to install required: false - default: '>=1.21.0' + default: ">=1.21.0" defaults: run: shell: bash @@ -81,8 +81,8 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' + use-all-platform-bundle: "false" + setup-kotlin: "true" - name: Delete original checkout run: | # delete the original checkout so we don't accidentally use it. diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 451238b66..efbb246fc 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -8,7 +8,7 @@ on: types: [checks_requested] schedule: # Weekly on Sunday. - - cron: '30 1 * * 0' + - cron: "30 1 * * 0" workflow_dispatch: defaults: @@ -32,41 +32,41 @@ jobs: security-events: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Set up default CodeQL bundle - id: setup-default - uses: ./setup-codeql - - name: Set up linked CodeQL bundle - id: setup-linked - uses: ./setup-codeql - with: - tools: linked - - name: Compare default and linked CodeQL bundle versions - id: compare - env: - CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }} - CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }} - run: | - CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)" - CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)" - echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT" - echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED" + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Set up default CodeQL bundle + id: setup-default + uses: ./setup-codeql + - name: Set up linked CodeQL bundle + id: setup-linked + uses: ./setup-codeql + with: + tools: linked + - name: Compare default and linked CodeQL bundle versions + id: compare + env: + CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }} + CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }} + run: | + CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)" + CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)" + echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT" + echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED" - # If we're running on a pull request, run with both bundles, even if `tools: linked` would - # be the same as `tools: null`. This allows us to make the job for each of the bundles a - # required status check. - # - # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be - # the same as running with `tools: null`. - if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then - VERSIONS_JSON='[null]' - else - VERSIONS_JSON='[null, "linked"]' - fi + # If we're running on a pull request, run with both bundles, even if `tools: linked` would + # be the same as `tools: null`. This allows us to make the job for each of the bundles a + # required status check. + # + # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be + # the same as running with `tools: null`. + if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then + VERSIONS_JSON='[null]' + else + VERSIONS_JSON='[null, "linked"]' + fi - # Output a JSON-encoded list with the distinct versions to test against. - echo "Suggested matrix config for analysis job: $VERSIONS_JSON" - echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT + # Output a JSON-encoded list with the distinct versions to test against. + echo "Suggested matrix config for analysis job: $VERSIONS_JSON" + echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT analyze-javascript: if: github.triggering_actor != 'dependabot[bot]' @@ -74,7 +74,13 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14-xlarge,macos-15-xlarge] + os: + - ubuntu-22.04 + - ubuntu-24.04 + - windows-2022 + - windows-2025 + - macos-14-xlarge + - macos-15-xlarge tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }} runs-on: ${{ matrix.os }} @@ -83,26 +89,26 @@ jobs: security-events: write steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Initialize CodeQL - uses: ./init - id: init - with: - languages: javascript - config-file: ./.github/codeql/codeql-config-javascript.yml - tools: ${{ matrix.tools }} - # confirm steps.init.outputs.codeql-path points to the codeql binary - - name: Print CodeQL Version - run: > - "$CODEQL" version --format=json - env: - CODEQL: ${{steps.init.outputs.codeql-path}} - - name: Perform CodeQL Analysis - uses: ./analyze - with: - category: "/language:javascript" - upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }} + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Initialize CodeQL + uses: ./init + id: init + with: + languages: javascript + config-file: ./.github/codeql/codeql-config-javascript.yml + tools: ${{ matrix.tools }} + # confirm steps.init.outputs.codeql-path points to the codeql binary + - name: Print CodeQL Version + run: > + "$CODEQL" version --format=json + env: + CODEQL: ${{steps.init.outputs.codeql-path}} + - name: Perform CodeQL Analysis + uses: ./analyze + with: + category: "/language:javascript" + upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }} analyze-other: if: github.triggering_actor != 'dependabot[bot]' @@ -119,21 +125,21 @@ jobs: security-events: write steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Initialize CodeQL - uses: ./init - with: - languages: ${{ matrix.language }} - build-mode: none - config: > - paths-ignore: - - lib - - tests - queries: - - uses: security-and-quality - - name: Perform CodeQL Analysis - uses: ./analyze - with: - category: "/language:${{ matrix.language }}" - upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }} + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Initialize CodeQL + uses: ./init + with: + languages: ${{ matrix.language }} + build-mode: none + config: > + paths-ignore: + - lib + - tests + queries: + - uses: security-and-quality + - name: Perform CodeQL Analysis + uses: ./analyze + with: + category: "/language:${{ matrix.language }}" + upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }} diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml index b1194460d..f2d819bbc 100644 --- a/.github/workflows/codescanning-config-cli.yml +++ b/.github/workflows/codescanning-config-cli.yml @@ -10,13 +10,13 @@ env: on: push: branches: - - main - - releases/v* + - main + - releases/v* pull_request: merge_group: types: [checks_requested] schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: concurrency: @@ -41,187 +41,187 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-26.04 - version: linked - - os: ubuntu-26.04 - version: default - - os: ubuntu-26.04 - version: nightly-latest + - os: ubuntu-26.04 + version: linked + - os: ubuntu-26.04 + version: default + - os: ubuntu-26.04 + version: nightly-latest # Code-Scanning config not created because environment variable is not set name: Code Scanning Configuration tests timeout-minutes: 45 runs-on: ${{ matrix.os }} steps: - - name: Check out repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Set up Node.js - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 - with: - node-version: 24 - cache: 'npm' + - name: Set up Node.js + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + with: + node-version: 24 + cache: "npm" - - name: Install dependencies - run: npm ci + - name: Install dependencies + run: npm ci - - name: Prepare test - id: prepare-test - uses: ./.github/actions/prepare-test - with: - version: ${{ matrix.version }} + - name: Prepare test + id: prepare-test + uses: ./.github/actions/prepare-test + with: + version: ${{ matrix.version }} - - name: Empty file - uses: ./../action/.github/actions/check-codescanning-config - with: - expected-config-file-contents: "{}" - # Request multiple languages so later checks can reuse the combined bundle. - languages: javascript,python - tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Empty file + uses: ./../action/.github/actions/check-codescanning-config + with: + expected-config-file-contents: "{}" + # Request multiple languages so later checks can reuse the combined bundle. + languages: javascript,python + tools: ${{ steps.prepare-test.outputs.tools-url }} - - name: Packs from input - if: success() || failure() - uses: ./../action/.github/actions/check-codescanning-config - with: - expected-config-file-contents: | - { - "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ] - } - languages: javascript - packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2 - tools: ${{ steps.prepare-test.outputs.tools-url }} - - - name: Packs from input with + - if: success() || failure() - uses: ./../action/.github/actions/check-codescanning-config - with: - expected-config-file-contents: | - { - "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ] - } - languages: javascript - packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2 - tools: ${{ steps.prepare-test.outputs.tools-url }} - - - name: Queries from input - if: success() || failure() - uses: ./../action/.github/actions/check-codescanning-config - with: - expected-config-file-contents: | - { - "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }] - } - languages: javascript - queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql - tools: ${{ steps.prepare-test.outputs.tools-url }} - - - name: Queries from input with + - if: success() || failure() - uses: ./../action/.github/actions/check-codescanning-config - with: - expected-config-file-contents: | - { - "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }] - } - languages: javascript - queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql - tools: ${{ steps.prepare-test.outputs.tools-url }} - - - name: Queries and packs from input with + - if: success() || failure() - uses: ./../action/.github/actions/check-codescanning-config - with: - expected-config-file-contents: | - { - "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }], - "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ] - } - languages: javascript - queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql - packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2 - tools: ${{ steps.prepare-test.outputs.tools-url }} - - - name: Queries and packs from config - if: success() || failure() - uses: ./../action/.github/actions/check-codescanning-config - with: - expected-config-file-contents: | - { - "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }], - "packs": { - "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ] + - name: Packs from input + if: success() || failure() + uses: ./../action/.github/actions/check-codescanning-config + with: + expected-config-file-contents: | + { + "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ] } - } - languages: javascript - config-file-test: .github/codeql/queries-and-packs-config.yml - tools: ${{ steps.prepare-test.outputs.tools-url }} + languages: javascript + packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2 + tools: ${{ steps.prepare-test.outputs.tools-url }} - - name: Queries and packs from config overriden by input - if: success() || failure() - uses: ./../action/.github/actions/check-codescanning-config - with: - expected-config-file-contents: | - { - "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }], - "packs": ["codeql/javascript-queries"] - } - languages: javascript - queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql - packs: codeql/javascript-queries - config-file-test: .github/codeql/queries-and-packs-config.yml - tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Packs from input with + + if: success() || failure() + uses: ./../action/.github/actions/check-codescanning-config + with: + expected-config-file-contents: | + { + "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ] + } + languages: javascript + packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2 + tools: ${{ steps.prepare-test.outputs.tools-url }} - - name: Queries and packs from config merging with input - if: success() || failure() - uses: ./../action/.github/actions/check-codescanning-config - with: - expected-config-file-contents: | - { - "packs": { - "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ] - }, - "queries": [ - { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }, - { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" } - ] - } - languages: javascript - queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql - packs: + codeql/javascript-queries - config-file-test: .github/codeql/queries-and-packs-config.yml - tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Queries from input + if: success() || failure() + uses: ./../action/.github/actions/check-codescanning-config + with: + expected-config-file-contents: | + { + "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }] + } + languages: javascript + queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql + tools: ${{ steps.prepare-test.outputs.tools-url }} - - name: Multi-language packs from config - if: success() || failure() - uses: ./../action/.github/actions/check-codescanning-config - with: - expected-config-file-contents: | - { - "packs": { - "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ], - "ruby": ["codeql/ruby-queries"] - }, - "queries": [ - { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" } - ] - } - languages: javascript,ruby - config-file-test: .github/codeql/multi-language-packs-config.yml - tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Queries from input with + + if: success() || failure() + uses: ./../action/.github/actions/check-codescanning-config + with: + expected-config-file-contents: | + { + "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }] + } + languages: javascript + queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql + tools: ${{ steps.prepare-test.outputs.tools-url }} - - name: Other config properties - if: success() || failure() - uses: ./../action/.github/actions/check-codescanning-config - with: - expected-config-file-contents: | - { - "name": "Config using all properties", - "packs": ["codeql/javascript-queries" ], - "disable-default-queries": true, - "paths-ignore": ["xxx"], - "paths": ["yyy"] - } - languages: javascript - packs: + codeql/javascript-queries - config-file-test: .github/codeql/other-config-properties.yml - tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Queries and packs from input with + + if: success() || failure() + uses: ./../action/.github/actions/check-codescanning-config + with: + expected-config-file-contents: | + { + "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }], + "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ] + } + languages: javascript + queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql + packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2 + tools: ${{ steps.prepare-test.outputs.tools-url }} + + - name: Queries and packs from config + if: success() || failure() + uses: ./../action/.github/actions/check-codescanning-config + with: + expected-config-file-contents: | + { + "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }], + "packs": { + "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ] + } + } + languages: javascript + config-file-test: .github/codeql/queries-and-packs-config.yml + tools: ${{ steps.prepare-test.outputs.tools-url }} + + - name: Queries and packs from config overriden by input + if: success() || failure() + uses: ./../action/.github/actions/check-codescanning-config + with: + expected-config-file-contents: | + { + "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }], + "packs": ["codeql/javascript-queries"] + } + languages: javascript + queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql + packs: codeql/javascript-queries + config-file-test: .github/codeql/queries-and-packs-config.yml + tools: ${{ steps.prepare-test.outputs.tools-url }} + + - name: Queries and packs from config merging with input + if: success() || failure() + uses: ./../action/.github/actions/check-codescanning-config + with: + expected-config-file-contents: | + { + "packs": { + "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ] + }, + "queries": [ + { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }, + { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" } + ] + } + languages: javascript + queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql + packs: + codeql/javascript-queries + config-file-test: .github/codeql/queries-and-packs-config.yml + tools: ${{ steps.prepare-test.outputs.tools-url }} + + - name: Multi-language packs from config + if: success() || failure() + uses: ./../action/.github/actions/check-codescanning-config + with: + expected-config-file-contents: | + { + "packs": { + "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ], + "ruby": ["codeql/ruby-queries"] + }, + "queries": [ + { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" } + ] + } + languages: javascript,ruby + config-file-test: .github/codeql/multi-language-packs-config.yml + tools: ${{ steps.prepare-test.outputs.tools-url }} + + - name: Other config properties + if: success() || failure() + uses: ./../action/.github/actions/check-codescanning-config + with: + expected-config-file-contents: | + { + "name": "Config using all properties", + "packs": ["codeql/javascript-queries" ], + "disable-default-queries": true, + "paths-ignore": ["xxx"], + "paths": ["yyy"] + } + languages: javascript + packs: + codeql/javascript-queries + config-file-test: .github/codeql/other-config-properties.yml + tools: ${{ steps.prepare-test.outputs.tools-url }} diff --git a/.github/workflows/publish-immutable-action.yml b/.github/workflows/publish-immutable-action.yml index 5e5623bb0..83485875c 100644 --- a/.github/workflows/publish-immutable-action.yml +++ b/.github/workflows/publish-immutable-action.yml @@ -1,10 +1,10 @@ -name: 'Publish Immutable Action Version' +name: "Publish Immutable Action Version" on: push: tags: # Match version tags, but not the major version tags. - - 'v[0-9]+.**' + - "v[0-9]+.**" defaults: run: diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index 303f54f1f..9ce50b8ff 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -8,7 +8,7 @@ on: types: [checks_requested] schedule: # Weekly on Monday. - - cron: '0 0 * * 1' + - cron: "0 0 * * 1" workflow_dispatch: concurrency: @@ -32,22 +32,22 @@ jobs: runs-on: windows-2025 steps: - - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 - with: - python-version: 3.12 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 + with: + python-version: 3.12 - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Prepare test - uses: ./.github/actions/prepare-test - with: - version: default + - name: Prepare test + uses: ./.github/actions/prepare-test + with: + version: default - - name: Initialize CodeQL - uses: ./../action/init - with: - tools: linked - languages: python + - name: Initialize CodeQL + uses: ./../action/init + with: + tools: linked + languages: python - - name: Analyze - uses: ./../action/analyze + - name: Analyze + uses: ./../action/analyze diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml index 745e84b2e..69ccd6c68 100644 --- a/.github/workflows/query-filters.yml +++ b/.github/workflows/query-filters.yml @@ -3,13 +3,13 @@ name: Query filters tests on: push: branches: - - main - - releases/v* + - main + - releases/v* pull_request: merge_group: types: [checks_requested] schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: concurrency: @@ -29,47 +29,47 @@ jobs: permissions: contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository. steps: - - name: Check out repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Install Node.js - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 - with: - node-version: 24 - cache: npm + - name: Install Node.js + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + with: + node-version: 24 + cache: npm - - name: Install dependencies - run: npm ci + - name: Install dependencies + run: npm ci - - name: Prepare test - id: prepare-test - uses: ./.github/actions/prepare-test - with: - version: linked + - name: Prepare test + id: prepare-test + uses: ./.github/actions/prepare-test + with: + version: linked - - name: Check SARIF for default queries with Single include, Single exclude - uses: ./../action/.github/actions/query-filter-test - with: - sarif-file: ${{ runner.temp }}/results/javascript.sarif - queries-run: js/zipslip - queries-not-run: js/path-injection - config-file: ./.github/codeql/codeql-config-query-filters1.yml - tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Check SARIF for default queries with Single include, Single exclude + uses: ./../action/.github/actions/query-filter-test + with: + sarif-file: ${{ runner.temp }}/results/javascript.sarif + queries-run: js/zipslip + queries-not-run: js/path-injection + config-file: ./.github/codeql/codeql-config-query-filters1.yml + tools: ${{ steps.prepare-test.outputs.tools-url }} - - name: Check SARIF for query packs with Single include, Single exclude - uses: ./../action/.github/actions/query-filter-test - with: - sarif-file: ${{ runner.temp }}/results/javascript.sarif - queries-run: js/zipslip,javascript/example/empty-or-one-block - queries-not-run: js/path-injection - config-file: ./.github/codeql/codeql-config-query-filters2.yml - tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Check SARIF for query packs with Single include, Single exclude + uses: ./../action/.github/actions/query-filter-test + with: + sarif-file: ${{ runner.temp }}/results/javascript.sarif + queries-run: js/zipslip,javascript/example/empty-or-one-block + queries-not-run: js/path-injection + config-file: ./.github/codeql/codeql-config-query-filters2.yml + tools: ${{ steps.prepare-test.outputs.tools-url }} - - name: Check SARIF for query packs and local queries with Single include, Single exclude - uses: ./../action/.github/actions/query-filter-test - with: - sarif-file: ${{ runner.temp }}/results/javascript.sarif - queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs - queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs - config-file: ./.github/codeql/codeql-config-query-filters3.yml - tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Check SARIF for query packs and local queries with Single include, Single exclude + uses: ./../action/.github/actions/query-filter-test + with: + sarif-file: ${{ runner.temp }}/results/javascript.sarif + queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs + queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs + config-file: ./.github/codeql/codeql-config-query-filters3.yml + tools: ${{ steps.prepare-test.outputs.tools-url }} diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml index cf63b1caa..9fae4b04a 100644 --- a/.github/workflows/test-codeql-bundle-all.yml +++ b/.github/workflows/test-codeql-bundle-all.yml @@ -1,17 +1,17 @@ -name: 'PR Check - CodeQL Bundle All' +name: "PR Check - CodeQL Bundle All" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto on: push: branches: - - main - - releases/v* + - main + - releases/v* pull_request: merge_group: types: [checks_requested] schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: concurrency: @@ -27,9 +27,9 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-26.04 - version: nightly-latest - name: 'CodeQL Bundle All' + - os: ubuntu-26.04 + version: nightly-latest + name: "CodeQL Bundle All" if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read @@ -37,26 +37,26 @@ jobs: timeout-minutes: 45 runs-on: ${{ matrix.os }} steps: - - name: Check out repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Prepare test - id: prepare-test - uses: ./.github/actions/prepare-test - with: - version: ${{ matrix.version }} - use-all-platform-bundle: true - - name: Install .NET - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 - with: - dotnet-version: '9.x' - - id: init - uses: ./../action/init - with: - # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu - languages: cpp,csharp,go,java,javascript,python,ruby - tools: ${{ steps.prepare-test.outputs.tools-url }} - - name: Build code - run: ./build.sh - - uses: ./../action/analyze + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Prepare test + id: prepare-test + uses: ./.github/actions/prepare-test + with: + version: ${{ matrix.version }} + use-all-platform-bundle: true + - name: Install .NET + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 + with: + dotnet-version: "9.x" + - id: init + uses: ./../action/init + with: + # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu + languages: cpp,csharp,go,java,javascript,python,ruby + tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Build code + run: ./build.sh + - uses: ./../action/analyze env: CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index d7d90b749..c2aae42eb 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -30,7 +30,7 @@ jobs: - name: Dump GitHub context env: - GITHUB_CONTEXT: '${{ toJson(github) }}' + GITHUB_CONTEXT: "${{ toJson(github) }}" run: echo "$GITHUB_CONTEXT" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -44,7 +44,7 @@ jobs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - cache: 'npm' + cache: "npm" - name: Install dependencies run: npm ci diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml index 6ceb30c42..098b9c8af 100644 --- a/.github/workflows/update-release-branch.yml +++ b/.github/workflows/update-release-branch.yml @@ -38,43 +38,43 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull request steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 # Need full history for calculation of diffs - - uses: ./.github/actions/release-initialise + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 # Need full history for calculation of diffs + - uses: ./.github/actions/release-initialise - # when the workflow has been manually triggered on main, - # we know that we definitely want the release branch to exist - - name: Ensure release branch exists - run: | - echo "MAJOR_VERSION ${MAJOR_VERSION}" - RELEASE_BRANCH=releases/${MAJOR_VERSION} - if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then - echo "Branch $RELEASE_BRANCH already exists" - echo "" - else - echo "Creating $RELEASE_BRANCH branch" - git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG} - git push --set-upstream origin ${RELEASE_BRANCH} - git branch --show-current - echo "" - fi - echo "Returning to branch: ${REF_NAME}" - git checkout ${REF_NAME} + # when the workflow has been manually triggered on main, + # we know that we definitely want the release branch to exist + - name: Ensure release branch exists + run: | + echo "MAJOR_VERSION ${MAJOR_VERSION}" + RELEASE_BRANCH=releases/${MAJOR_VERSION} + if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then + echo "Branch $RELEASE_BRANCH already exists" + echo "" + else + echo "Creating $RELEASE_BRANCH branch" + git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG} + git push --set-upstream origin ${RELEASE_BRANCH} + git branch --show-current + echo "" + fi + echo "Returning to branch: ${REF_NAME}" + git checkout ${REF_NAME} - - name: Update current release branch - if: github.event_name == 'workflow_dispatch' - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - echo SOURCE_BRANCH=${REF_NAME} - echo TARGET_BRANCH=releases/${MAJOR_VERSION} - npx tsx ./pr-checks/update-release-branch.ts \ - --repository-nwo ${{ github.repository }} \ - --source-branch '${{ env.REF_NAME }}' \ - --target-branch 'releases/${{ env.MAJOR_VERSION }}' \ - --is-primary-release \ - --conductor ${GITHUB_ACTOR} + - name: Update current release branch + if: github.event_name == 'workflow_dispatch' + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + echo SOURCE_BRANCH=${REF_NAME} + echo TARGET_BRANCH=releases/${MAJOR_VERSION} + npx tsx ./pr-checks/update-release-branch.ts \ + --repository-nwo ${{ github.repository }} \ + --source-branch '${{ env.REF_NAME }}' \ + --target-branch 'releases/${{ env.MAJOR_VERSION }}' \ + --is-primary-release \ + --conductor ${GITHUB_ACTOR} backport: name: "Create backport" @@ -94,28 +94,28 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull request steps: - - name: Generate token - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 - id: app-token - with: - app-id: ${{ vars.AUTOMATION_APP_ID }} - private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }} + - name: Generate token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + id: app-token + with: + app-id: ${{ vars.AUTOMATION_APP_ID }} + private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }} - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 # Need full history for calculation of diffs - token: ${{ steps.app-token.outputs.token }} - - uses: ./.github/actions/release-initialise + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 # Need full history for calculation of diffs + token: ${{ steps.app-token.outputs.token }} + - uses: ./.github/actions/release-initialise - - name: Update older release branch - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - echo SOURCE_BRANCH=${SOURCE_BRANCH} - echo TARGET_BRANCH=${TARGET_BRANCH} - npx tsx ./pr-checks/update-release-branch.ts \ - --repository-nwo ${{ github.repository }} \ - --source-branch ${SOURCE_BRANCH} \ - --target-branch ${TARGET_BRANCH} \ - --conductor ${GITHUB_ACTOR} + - name: Update older release branch + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + echo SOURCE_BRANCH=${SOURCE_BRANCH} + echo TARGET_BRANCH=${TARGET_BRANCH} + npx tsx ./pr-checks/update-release-branch.ts \ + --repository-nwo ${{ github.repository }} \ + --source-branch ${SOURCE_BRANCH} \ + --target-branch ${TARGET_BRANCH} \ + --conductor ${GITHUB_ACTOR} diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index 6510f11e2..90e3e991a 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -29,7 +29,7 @@ jobs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - cache: 'npm' + cache: "npm" - name: Install dependencies run: npm ci diff --git a/action.yml b/action.yml index 87c4974ea..b410533be 100644 --- a/action.yml +++ b/action.yml @@ -1,10 +1,10 @@ -name: 'CodeQL: Stub' +name: "CodeQL: Stub" description: "Stub: Don't use this action directly. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead." -author: 'GitHub' +author: "GitHub" runs: - using: 'composite' + using: "composite" steps: - - name: 'Stub' + - name: "Stub" run: | echo 'This is a stub. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead.' exit 1 diff --git a/autobuild/action.yml b/autobuild/action.yml index b87da541d..319114914 100644 --- a/autobuild/action.yml +++ b/autobuild/action.yml @@ -1,6 +1,6 @@ -name: 'CodeQL: Autobuild' -description: 'Attempt to automatically build the code. Only used for analyzing languages that require a build. Use the `build-mode: autobuild` input in the `init` action instead.' -author: 'GitHub' +name: "CodeQL: Autobuild" +description: "Attempt to automatically build the code. Only used for analyzing languages that require a build. Use the `build-mode: autobuild` input in the `init` action instead." +author: "GitHub" inputs: token: description: "GitHub token to use for authenticating with this instance of GitHub. The token needs the `security-events: write` permission." @@ -16,4 +16,4 @@ inputs: required: false runs: using: node24 - main: '../lib/autobuild-entry.js' + main: "../lib/autobuild-entry.js" diff --git a/init/action.yml b/init/action.yml index 8d26999f7..b6721a8c7 100644 --- a/init/action.yml +++ b/init/action.yml @@ -1,6 +1,6 @@ -name: 'CodeQL: Init' -description: 'Set up CodeQL' -author: 'GitHub' +name: "CodeQL: Init" +description: "Set up CodeQL" +author: "GitHub" inputs: tools: description: >- @@ -56,7 +56,7 @@ inputs: - `code-scanning`: The default, security-focused analysis. - `code-quality`: Analysis focused on code quality. This must be enabled in conjunction with `code-scanning`. - default: 'code-scanning' + default: "code-scanning" required: true token: description: GitHub token to use for authenticating with this instance of GitHub. To download custom packs from multiple registries, use the registries input. @@ -100,7 +100,7 @@ inputs: description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries. required: false quality-queries: - description: '[Internal] DEPRECATED. Comma-separated list of code quality queries to run.' + description: "[Internal] DEPRECATED. Comma-separated list of code quality queries to run." required: false packs: description: >- @@ -140,7 +140,7 @@ inputs: This will result in more output being produced which may be useful when debugging certain issues. Debugging mode is enabled automatically when step debug logging is turned on. required: false - default: 'false' + default: "false" debug-artifact-name: description: >- The name of the artifact to store debugging information in. @@ -181,5 +181,5 @@ outputs: description: The version of the CodeQL binary used for analysis runs: using: node24 - main: '../lib/init-entry.js' - post: '../lib/init-post-entry.js' + main: "../lib/init-entry.js" + post: "../lib/init-post-entry.js" diff --git a/pr-checks/checks/analyze-ref-input.yml b/pr-checks/checks/analyze-ref-input.yml index 683d40df9..16231cefe 100644 --- a/pr-checks/checks/analyze-ref-input.yml +++ b/pr-checks/checks/analyze-ref-input.yml @@ -14,5 +14,5 @@ steps: run: ./build.sh - uses: ./../action/analyze with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" diff --git a/pr-checks/checks/init-with-registries.yml b/pr-checks/checks/init-with-registries.yml index 69e2188de..ffa5f4d12 100644 --- a/pr-checks/checks/init-with-registries.yml +++ b/pr-checks/checks/init-with-registries.yml @@ -23,9 +23,9 @@ steps: config-file: ./.github/codeql/codeql-config-registries.yml languages: javascript registries: | - - url: "https://ghcr.io/v2/" - packages: "*/*" - token: "${{ secrets.GITHUB_TOKEN }}" + - url: "https://ghcr.io/v2/" + packages: "*/*" + token: "${{ secrets.GITHUB_TOKEN }}" - name: Verify packages installed run: | diff --git a/pr-checks/checks/overlay-init-fallback.yml b/pr-checks/checks/overlay-init-fallback.yml index 26d8c8567..48b9f19b1 100644 --- a/pr-checks/checks/overlay-init-fallback.yml +++ b/pr-checks/checks/overlay-init-fallback.yml @@ -6,7 +6,7 @@ versions: steps: - uses: ./../action/init with: - languages: actions # Any language without overlay support will do + languages: actions # Any language without overlay support will do tools: ${{ steps.prepare-test.outputs.tools-url }} env: CODEQL_OVERLAY_DATABASE_MODE: overlay-base diff --git a/pr-checks/checks/upload-ref-sha-input.yml b/pr-checks/checks/upload-ref-sha-input.yml index 970082715..7a737c7de 100644 --- a/pr-checks/checks/upload-ref-sha-input.yml +++ b/pr-checks/checks/upload-ref-sha-input.yml @@ -15,10 +15,10 @@ steps: # Generate some SARIF we can upload with the upload-sarif step - uses: ./../action/analyze with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" upload: never - uses: ./../action/upload-sarif with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" diff --git a/pr-checks/checks/upload-sarif.yml b/pr-checks/checks/upload-sarif.yml index 8056a5179..205bdf0a2 100644 --- a/pr-checks/checks/upload-sarif.yml +++ b/pr-checks/checks/upload-sarif.yml @@ -19,8 +19,8 @@ steps: # Generate some SARIF we can upload with the upload-sarif step - uses: ./../action/analyze with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" upload: never output: ${{ runner.temp }}/results @@ -29,8 +29,8 @@ steps: uses: ./../action/upload-sarif id: upload-sarif with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" sarif_file: ${{ runner.temp }}/results category: | ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:all-files/ @@ -46,8 +46,8 @@ steps: id: upload-single-sarif-code-scanning if: contains(matrix.analysis-kinds, 'code-scanning') with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" sarif_file: ${{ runner.temp }}/results/javascript.sarif category: | ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-scanning/ @@ -59,8 +59,8 @@ steps: id: upload-single-sarif-code-quality if: contains(matrix.analysis-kinds, 'code-quality') with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" sarif_file: ${{ runner.temp }}/results/javascript.quality.sarif category: | ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-quality/ @@ -76,8 +76,8 @@ steps: id: upload-single-non-sarif if: contains(matrix.analysis-kinds, 'code-scanning') with: - ref: 'refs/heads/main' - sha: '5e235361806c361d4d3f8859e3c897658025a9a2' + ref: "refs/heads/main" + sha: "5e235361806c361d4d3f8859e3c897658025a9a2" sarif_file: ${{ runner.temp }}/results/javascript.sarif.json category: | ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:non-sarif/ diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 0953816c2..ec8d5a57c 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -370,7 +370,7 @@ function writeYaml(filePath: string, workflow: any): void { }); const yamlStr = yaml.stringify(workflowDoc, { aliasDuplicateObjects: false, - singleQuote: true, + singleQuote: false, lineWidth: 0, }); fs.writeFileSync(filePath, stripTrailingWhitespace(header + yamlStr), "utf8"); @@ -595,16 +595,6 @@ function generateJob( // Extract the sequence of steps from the YAML document to persist as much formatting as possible. const specSteps = specDocument.get("steps") as yaml.YAMLSeq; - // A handful of workflow specifications use double quotes for values, while we generally use single quotes. - // This replaces double quotes with single quotes for consistency. - yaml.visit(specSteps, { - Scalar(_key, node) { - if (node.type === "QUOTE_DOUBLE") { - node.type = "QUOTE_SINGLE"; - } - }, - }); - // Add the generated steps in front of the ones from the specification. specSteps.items.unshift(...steps); @@ -802,7 +792,7 @@ function main(): void { } const cron = new yaml.Scalar("0 5 * * *"); - cron.type = yaml.Scalar.QUOTE_SINGLE; + cron.type = yaml.Scalar.QUOTE_DOUBLE; const workflow = { name: `PR Check - ${checkSpecification.name}`, diff --git a/resolve-environment/action.yml b/resolve-environment/action.yml index b93efb20d..5e03ecac4 100644 --- a/resolve-environment/action.yml +++ b/resolve-environment/action.yml @@ -1,6 +1,6 @@ -name: 'CodeQL: Resolve Build Environment' -description: '[Experimental] Attempt to infer a build environment suitable for automatic builds' -author: 'GitHub' +name: "CodeQL: Resolve Build Environment" +description: "[Experimental] Attempt to infer a build environment suitable for automatic builds" +author: "GitHub" inputs: token: description: "GitHub token to use for authenticating with this instance of GitHub. The token must be the built-in GitHub Actions token, and the workflow must have the `security-events: write` permission. Most of the time it is advisable to avoid specifying this input so that the workflow falls back to using the default value." @@ -22,4 +22,4 @@ outputs: description: The inferred build environment configuration. runs: using: node24 - main: '../lib/resolve-environment-entry.js' + main: "../lib/resolve-environment-entry.js" diff --git a/setup-codeql/action.yml b/setup-codeql/action.yml index 14083b4f9..8d9c5a088 100644 --- a/setup-codeql/action.yml +++ b/setup-codeql/action.yml @@ -1,6 +1,6 @@ -name: 'CodeQL: Setup' -description: 'Installs the CodeQL CLI' -author: 'GitHub' +name: "CodeQL: Setup" +description: "Installs the CodeQL CLI" +author: "GitHub" inputs: tools: description: >- @@ -33,7 +33,7 @@ inputs: suited to those analysis kinds. Available options are the same as for the `analysis-kinds` input on the `init` Action. - default: 'code-scanning' + default: "code-scanning" required: true token: description: GitHub token to use for authenticating with this instance of GitHub. @@ -52,4 +52,4 @@ outputs: description: The version of the CodeQL binary that was installed. runs: using: node24 - main: '../lib/setup-codeql-entry.js' + main: "../lib/setup-codeql-entry.js" diff --git a/src/testdata/pr-diff-range.yml b/src/testdata/pr-diff-range.yml index 073b83198..24f02fbe3 100644 --- a/src/testdata/pr-diff-range.yml +++ b/src/testdata/pr-diff-range.yml @@ -1,8 +1,7 @@ - extensions: - addsTo: pack: codeql/util extensible: restrictAlertsTo checkPresence: false data: - - ['/checkout/path/main.js', 10, 20] + - ["/checkout/path/main.js", 10, 20] diff --git a/tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml b/tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml index 91a8dce37..fbd19b729 100644 --- a/tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml +++ b/tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml @@ -1,12 +1,12 @@ name: "Check SARIF for default queries with Single include, Single exclude" query-filters: -# This should run js/path-injection and js/zipslip -- include: - tags contain: + # This should run js/path-injection and js/zipslip + - include: + tags contain: - external/cwe/cwe-022 -# Removes js/path-injection -- exclude: - id: + # Removes js/path-injection + - exclude: + id: - js/path-injection diff --git a/tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml b/tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml index c0d686962..0bd794eb6 100644 --- a/tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml +++ b/tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml @@ -8,17 +8,17 @@ packs: - codeql-testing/codeql-pack1@1.0.0 query-filters: -# This should run js/path-injection and js/zipslip -- include: - tags contain: + # This should run js/path-injection and js/zipslip + - include: + tags contain: - external/cwe/cwe-022 -# Removes js/path-injection -- exclude: - id: + # Removes js/path-injection + - exclude: + id: - js/path-injection -# Query from extra pack -- include: - id: + # Query from extra pack + - include: + id: - javascript/example/empty-or-one-block diff --git a/tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml b/tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml index 619442d0f..26171f0bb 100644 --- a/tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml +++ b/tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml @@ -3,37 +3,36 @@ name: "Check SARIF for query packs and local queries with Single include, Single disable-default-queries: true queries: -# Local query + # Local query - name: Run an extra local query uses: ./codeql-qlpacks/javascript-qlpack/show_ifs.ql -# These queries are ignored + # These queries are ignored - name: Ignored queries uses: ./codeql-qlpacks/complex-python-qlpack/rootAndBar.qls - packs: javascript: - codeql/javascript-queries - codeql-testing/codeql-pack1@1.0.0 query-filters: -# This should run js/path-injection and js/zipslip -- include: - tags contain: - - external/cwe/cwe-022 + # This should run js/path-injection and js/zipslip + - include: + tags contain: + - external/cwe/cwe-022 -# Removes js/path-injection -- exclude: - id: - - js/path-injection + # Removes js/path-injection + - exclude: + id: + - js/path-injection -# Query from extra pack -- include: - id: - - javascript/example/empty-or-one-block + # Query from extra pack + - include: + id: + - javascript/example/empty-or-one-block -# Local query -- include: - id: - - inrepo-javascript-querypack/show-ifs + # Local query + - include: + id: + - inrepo-javascript-querypack/show-ifs diff --git a/tests/multi-language-repo/.github/codeql/custom-queries.yml b/tests/multi-language-repo/.github/codeql/custom-queries.yml index fc80426f7..0e9ff0ff4 100644 --- a/tests/multi-language-repo/.github/codeql/custom-queries.yml +++ b/tests/multi-language-repo/.github/codeql/custom-queries.yml @@ -3,22 +3,22 @@ name: Use custom queries disable-default-queries: true queries: -# Query suites + # Query suites - name: Select a query suite uses: ./codeql-qlpacks/complex-python-qlpack/rootAndBar.qls -# QL pack subset + # QL pack subset - name: Select a ql file uses: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql - name: Select a subfolder uses: ./codeql-qlpacks/complex-javascript-qlpack/foo - name: Select a folder with two subfolders uses: ./codeql-qlpacks/complex-javascript-qlpack/foo2 -# Inrepo QL pack + # Inrepo QL pack - name: Select an inrepo ql pack uses: ./codeql-qlpacks/csharp-qlpack - name: Java queries uses: ./codeql-qlpacks/java-qlpack -# External QL packs + # External QL packs - name: Go queries uses: codeql-testing/go-querypack@master - name: Cpp queries diff --git a/tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml index 95acb04f0..2fc3910e2 100644 --- a/tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml +++ b/tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml @@ -1,3 +1,3 @@ name: complex-javascript-querypack version: 0.0.1 -libraryPathDependencies: codeql-javascript \ No newline at end of file +libraryPathDependencies: codeql-javascript diff --git a/tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml index 349294dcf..129bb6078 100644 --- a/tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml +++ b/tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml @@ -1,3 +1,3 @@ name: inrepo-python-querypack version: 0.0.1 -libraryPathDependencies: codeql-python \ No newline at end of file +libraryPathDependencies: codeql-python diff --git a/tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml index 7c2ea26cd..5890a8543 100644 --- a/tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml +++ b/tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml @@ -1,3 +1,3 @@ name: inrepo-cpp-querypack version: 0.0.1 -libraryPathDependencies: codeql-cpp \ No newline at end of file +libraryPathDependencies: codeql-cpp diff --git a/tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml index 9a54e7e92..b917d2412 100644 --- a/tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml +++ b/tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml @@ -1,3 +1,3 @@ name: inrepo-csharp-querypack version: 0.0.1 -libraryPathDependencies: codeql-csharp \ No newline at end of file +libraryPathDependencies: codeql-csharp diff --git a/tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml index 59ccb6881..2bfd0c9a8 100644 --- a/tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml +++ b/tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml @@ -1,3 +1,3 @@ name: inrepo-go-querypack version: 0.0.1 -libraryPathDependencies: codeql-go \ No newline at end of file +libraryPathDependencies: codeql-go diff --git a/tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml index 06e8cae7d..86533bde3 100644 --- a/tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml +++ b/tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml @@ -1,3 +1,3 @@ name: inrepo-java-querypack version: 0.0.1 -libraryPathDependencies: codeql-java \ No newline at end of file +libraryPathDependencies: codeql-java diff --git a/tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml index f6d5a7b6d..0715661b4 100644 --- a/tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml +++ b/tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml @@ -1,3 +1,3 @@ name: inrepo-javascript-querypack version: 0.0.1 -libraryPathDependencies: codeql-javascript \ No newline at end of file +libraryPathDependencies: codeql-javascript diff --git a/tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml index 349294dcf..129bb6078 100644 --- a/tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml +++ b/tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml @@ -1,3 +1,3 @@ name: inrepo-python-querypack version: 0.0.1 -libraryPathDependencies: codeql-python \ No newline at end of file +libraryPathDependencies: codeql-python diff --git a/upload-sarif/action.yml b/upload-sarif/action.yml index dae34ec52..75c5858e2 100644 --- a/upload-sarif/action.yml +++ b/upload-sarif/action.yml @@ -1,6 +1,6 @@ -name: 'Code Scanning : Upload SARIF' -description: 'Upload the analysis results' -author: 'GitHub' +name: "Code Scanning : Upload SARIF" +description: "Upload the analysis results" +author: "GitHub" inputs: sarif_file: description: | @@ -8,7 +8,7 @@ inputs: See https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github#uploading-a-code-scanning-analysis-with-github-actions for information on the maximum number of results and maximum file size supported by code scanning. required: false - default: '../results' + default: "../results" checkout_path: description: "The path at which the analyzed repository was checked out. Used to relativize any absolute paths in the uploaded SARIF file." required: false @@ -42,5 +42,5 @@ outputs: { "code-scanning": "some-id", "code-quality": "some-other-id" } runs: using: node24 - main: '../lib/upload-sarif-entry.js' - post: '../lib/upload-sarif-post-entry.js' + main: "../lib/upload-sarif-entry.js" + post: "../lib/upload-sarif-post-entry.js"