github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-11-06 04:59:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Apply consistent YAML formatting

Browse Source
This commit is contained in:
Michael B. Gale
2026-10-30 12:03:46 +00:00
parent fef52000cc
commit 2c6d525faa
98 changed files with 865 additions and 872 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.github/workflows/__all-platform-bundle.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -84,8 +84,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'true'
setup-kotlin: 'true'
use-all-platform-bundle: "true"
setup-kotlin: "true"
- id: init
uses: ./../action/init
with:

22
.github/workflows/__analysis-kinds.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -73,8 +73,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: javascript
@@ -82,16 +82,16 @@ jobs:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
upload-database: false
post-processed-sarif-path: '${{ runner.temp }}/post-processed'
post-processed-sarif-path: "${{ runner.temp }}/post-processed"
- name: Upload SARIF files
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: |
analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
path: '${{ runner.temp }}/results/*.sarif'
path: "${{ runner.temp }}/results/*.sarif"
retention-days: 7
- name: Upload post-processed SARIF
@@ -99,7 +99,7 @@ jobs:
with:
name: |
post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
path: '${{ runner.temp }}/post-processed'
path: "${{ runner.temp }}/post-processed"
retention-days: 7
if-no-files-found: error
@@ -107,16 +107,16 @@ jobs:
if: contains(matrix.analysis-kinds, 'code-scanning')
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
EXPECT_PRESENT: 'false'
SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
EXPECT_PRESENT: "false"
with:
script: ${{ env.CHECK_SCRIPT }}
- name: Check quality query appears in quality SARIF
if: contains(matrix.analysis-kinds, 'code-quality')
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
SARIF_PATH: '${{ runner.temp }}/results/javascript.quality.sarif'
EXPECT_PRESENT: 'true'
SARIF_PATH: "${{ runner.temp }}/results/javascript.quality.sarif"
EXPECT_PRESENT: "true"
with:
script: ${{ env.CHECK_SCRIPT }}
env:

14
.github/workflows/__analyze-ref-input.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -80,8 +80,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -91,7 +91,7 @@ jobs:
run: ./build.sh
- uses: ./../action/analyze
with:
ref: 'refs/heads/main'
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
ref: "refs/heads/main"
sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
env:
CODEQL_ACTION_TEST_MODE: true

18
.github/workflows/__autobuild-action.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -69,8 +69,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: csharp
@@ -78,12 +78,12 @@ jobs:
- uses: ./../action/autobuild
env:
# Explicitly disable the CLR tracer.
COR_ENABLE_PROFILING: ''
COR_PROFILER: ''
COR_PROFILER_PATH_64: ''
CORECLR_ENABLE_PROFILING: ''
CORECLR_PROFILER: ''
CORECLR_PROFILER_PATH_64: ''
COR_ENABLE_PROFILING: ""
COR_PROFILER: ""
COR_PROFILER_PATH_64: ""
CORECLR_ENABLE_PROFILING: ""
CORECLR_PROFILER: ""
CORECLR_PROFILER_PATH_64: ""
- uses: ./../action/analyze
- name: Check database
run: |

10
.github/workflows/__autobuild-direct-tracing-with-working-dir.yml generated vendored
View File

@@ -17,21 +17,21 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
java-version:
type: string
description: The version of Java to install
required: false
default: '17'
default: "17"
workflow_call:
inputs:
java-version:
type: string
description: The version of Java to install
required: false
default: '17'
default: "17"
defaults:
run:
shell: bash
@@ -72,8 +72,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Test setup
run: |
# Make sure that Gradle build succeeds in autobuild-dir ...

6
.github/workflows/__autobuild-working-dir.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -51,8 +51,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Test setup
run: |
# Make sure that Gradle build succeeds in autobuild-dir ...

12
.github/workflows/__build-mode-autobuild.yml generated vendored
View File

@@ -17,21 +17,21 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
java-version:
type: string
description: The version of Java to install
required: false
default: '17'
default: "17"
workflow_call:
inputs:
java-version:
type: string
description: The version of Java to install
required: false
default: '17'
default: "17"
defaults:
run:
shell: bash
@@ -80,8 +80,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Set up Java test repo configuration
run: |
mv * .github ../action/tests/multi-language-repo/
@@ -92,7 +92,7 @@ jobs:
id: init
with:
build-mode: autobuild
db-location: '${{ runner.temp }}/customDbLocation'
db-location: "${{ runner.temp }}/customDbLocation"
languages: java
tools: ${{ steps.prepare-test.outputs.tools-url }}

12
.github/workflows/__build-mode-manual.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -80,13 +80,13 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
id: init
with:
build-mode: manual
db-location: '${{ runner.temp }}/customDbLocation'
db-location: "${{ runner.temp }}/customDbLocation"
languages: java
tools: ${{ steps.prepare-test.outputs.tools-url }}

8
.github/workflows/__build-mode-none.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -53,13 +53,13 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
id: init
with:
build-mode: none
db-location: '${{ runner.temp }}/customDbLocation'
db-location: "${{ runner.temp }}/customDbLocation"
languages: java
tools: ${{ steps.prepare-test.outputs.tools-url }}

8
.github/workflows/__build-mode-rollback.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -51,8 +51,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Set up Java test repo configuration
run: |
mv * .github ../action/tests/multi-language-repo/
@@ -63,7 +63,7 @@ jobs:
id: init
with:
build-mode: none
db-location: '${{ runner.temp }}/customDbLocation'
db-location: "${{ runner.temp }}/customDbLocation"
languages: java
tools: ${{ steps.prepare-test.outputs.tools-url }}

10
.github/workflows/__bundle-from-nightly.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Bundle: From nightly'
name: "PR Check - Bundle: From nightly"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -36,7 +36,7 @@ jobs:
include:
- os: ubuntu-26.04
version: linked
name: 'Bundle: From nightly'
name: "Bundle: From nightly"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -51,8 +51,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- id: init
uses: ./../action/init
env:

10
.github/workflows/__bundle-from-toolcache.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Bundle: From toolcache'
name: "PR Check - Bundle: From toolcache"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -36,7 +36,7 @@ jobs:
include:
- os: ubuntu-26.04
version: toolcache
name: 'Bundle: From toolcache'
name: "Bundle: From toolcache"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -60,8 +60,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Check toolcache contains CodeQL
continue-on-error: true
run: |

10
.github/workflows/__bundle-toolcache.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Bundle: Caching checks'
name: "PR Check - Bundle: Caching checks"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -40,7 +40,7 @@ jobs:
version: linked
- os: windows-2025
version: linked
name: 'Bundle: Caching checks'
name: "Bundle: Caching checks"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -64,8 +64,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Remove CodeQL from toolcache
run: |
cd ./../action

8
.github/workflows/__cleanup-db-cluster-dir.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -51,8 +51,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Add a file to the database cluster directory
run: |
mkdir -p "${{ runner.temp }}/customDbLocation/javascript"
@@ -62,7 +62,7 @@ jobs:
id: init
with:
build-mode: none
db-location: '${{ runner.temp }}/customDbLocation'
db-location: "${{ runner.temp }}/customDbLocation"
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}

12
.github/workflows/__config-export.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -53,8 +53,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: javascript
@@ -62,18 +62,18 @@ jobs:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
upload-database: false
- name: Upload SARIF
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
path: '${{ runner.temp }}/results/javascript.sarif'
path: "${{ runner.temp }}/results/javascript.sarif"
retention-days: 7
- name: Check config properties appear in SARIF
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
with:
script: |
const fs = require('fs');

6
.github/workflows/__config-input.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -60,8 +60,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Copy queries into workspace
run: |
cp -a ../action/queries .

12
.github/workflows/__cpp-deptrace-disabled.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - C/C++: disabling autoinstalling dependencies (Linux)'
name: "PR Check - C/C++: disabling autoinstalling dependencies (Linux)"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -40,7 +40,7 @@ jobs:
version: default
- os: ubuntu-26.04
version: nightly-latest
name: 'C/C++: disabling autoinstalling dependencies (Linux)'
name: "C/C++: disabling autoinstalling dependencies (Linux)"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -55,8 +55,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Test setup
run: |
cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
exit 1
fi
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
CODEQL_ACTION_TEST_MODE: true

12
.github/workflows/__cpp-deptrace-enabled-on-macos.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - C/C++: autoinstalling dependencies is skipped (macOS)'
name: "PR Check - C/C++: autoinstalling dependencies is skipped (macOS)"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -38,7 +38,7 @@ jobs:
version: linked
- os: macos-26
version: nightly-latest
name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
name: "C/C++: autoinstalling dependencies is skipped (macOS)"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -53,8 +53,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Test setup
run: |
cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
exit 1
fi
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
CODEQL_ACTION_TEST_MODE: true

12
.github/workflows/__cpp-deptrace-enabled.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - C/C++: autoinstalling dependencies (Linux)'
name: "PR Check - C/C++: autoinstalling dependencies (Linux)"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -40,7 +40,7 @@ jobs:
version: default
- os: ubuntu-26.04
version: nightly-latest
name: 'C/C++: autoinstalling dependencies (Linux)'
name: "C/C++: autoinstalling dependencies (Linux)"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -55,8 +55,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Test setup
run: |
cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
exit 1
fi
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
CODEQL_ACTION_TEST_MODE: true

12
.github/workflows/__diagnostics-export.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -62,8 +62,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
id: init
with:
@@ -82,18 +82,18 @@ jobs:
--ready-for-status-page
- uses: ./../action/analyze
with:
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
upload-database: false
- name: Upload SARIF
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
path: '${{ runner.temp }}/results/javascript.sarif'
path: "${{ runner.temp }}/results/javascript.sarif"
retention-days: 7
- name: Check diagnostics appear in SARIF
env:
SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
run: |
cd ../action
npx tsx ./pr-checks/check-diagnostics.ts

10
.github/workflows/__diagnostics-without-db.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -67,8 +67,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Initialise failing analysis
id: init
uses: ./../action/init
@@ -87,11 +87,11 @@ jobs:
# `category` input. Without this step, that part of the init post-action would fail.
if: false
with:
category: '/test-codeql-version:${{ matrix.version }}'
category: "/test-codeql-version:${{ matrix.version }}"
- name: Check diagnostics appear on disk
env:
DIAGNOSTICS_DIR: '${{ runner.temp }}/codeql-action-temp-diagnostics/'
DIAGNOSTICS_DIR: "${{ runner.temp }}/codeql-action-temp-diagnostics/"
run: |
cd ../action
npx tsx ./pr-checks/diagnostics-without-db.ts

14
.github/workflows/__export-file-baseline-information.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -84,8 +84,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
id: init
with:
@@ -100,12 +100,12 @@ jobs:
run: ./build.sh
- uses: ./../action/analyze
with:
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
- name: Upload SARIF
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
path: '${{ runner.temp }}/results/javascript.sarif'
path: "${{ runner.temp }}/results/javascript.sarif"
retention-days: 7
- name: Check results
run: |

6
.github/workflows/__extractor-ram-threads.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -51,8 +51,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: java

6
.github/workflows/__global-proxy.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -53,8 +53,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'false'
use-all-platform-bundle: "false"
setup-kotlin: "false"
- name: Block direct internet access to force proxy usage
run: |
apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1

16
.github/workflows/__go-custom-queries.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Go: Custom queries'
name: "PR Check - Go: Custom queries"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -58,7 +58,7 @@ jobs:
version: linked
- os: ubuntu-26.04
version: nightly-latest
name: 'Go: Custom queries'
name: "Go: Custom queries"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -82,8 +82,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: go
@@ -93,5 +93,5 @@ jobs:
run: ./build.sh
- uses: ./../action/analyze
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
CODEQL_ACTION_TEST_MODE: true

20
.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Go: diagnostic when Go is changed after init step'
name: "PR Check - Go: diagnostic when Go is changed after init step"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
go-version:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
go-version:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -46,7 +46,7 @@ jobs:
include:
- os: ubuntu-26.04
version: default
name: 'Go: diagnostic when Go is changed after init step'
name: "Go: diagnostic when Go is changed after init step"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -66,8 +66,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: go
@@ -75,17 +75,17 @@ jobs:
# Deliberately change Go after the `init` step
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: '1.20'
go-version: "1.20"
- name: Build code
run: go build main.go
- uses: ./../action/analyze
with:
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
upload-database: false
- name: Check diagnostic appears in SARIF
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
with:
script: |
const fs = require('fs');

18
.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Go: diagnostic when `file` is not installed'
name: "PR Check - Go: diagnostic when `file` is not installed"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
go-version:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
go-version:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -46,7 +46,7 @@ jobs:
include:
- os: ubuntu-26.04
version: default
name: 'Go: diagnostic when `file` is not installed'
name: "Go: diagnostic when `file` is not installed"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -66,8 +66,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Remove `file` program
run: |
echo $(which file)
@@ -81,12 +81,12 @@ jobs:
run: go build main.go
- uses: ./../action/analyze
with:
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
upload-database: false
- name: Check diagnostic appears in SARIF
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
with:
script: |
const fs = require('fs');

14
.github/workflows/__go-indirect-tracing-workaround.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Go: workaround for indirect tracing'
name: "PR Check - Go: workaround for indirect tracing"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
go-version:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
go-version:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -46,7 +46,7 @@ jobs:
include:
- os: ubuntu-26.04
version: default
name: 'Go: workaround for indirect tracing'
name: "Go: workaround for indirect tracing"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -66,8 +66,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: go

16
.github/workflows/__go-tracing-autobuilder.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Go: tracing with autobuilder step'
name: "PR Check - Go: tracing with autobuilder step"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
go-version:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
go-version:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -66,7 +66,7 @@ jobs:
version: nightly-latest
- os: macos-26
version: nightly-latest
name: 'Go: tracing with autobuilder step'
name: "Go: tracing with autobuilder step"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -86,8 +86,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: go
@@ -106,5 +106,5 @@ jobs:
exit 1
fi
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
CODEQL_ACTION_TEST_MODE: true

14
.github/workflows/__go-tracing-custom-build-steps.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Go: tracing with custom build steps'
name: "PR Check - Go: tracing with custom build steps"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
go-version:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
go-version:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -66,7 +66,7 @@ jobs:
version: nightly-latest
- os: macos-26
version: nightly-latest
name: 'Go: tracing with custom build steps'
name: "Go: tracing with custom build steps"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -86,8 +86,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: go

16
.github/workflows/__go-tracing-legacy-workflow.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Go: tracing with legacy workflow'
name: "PR Check - Go: tracing with legacy workflow"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
go-version:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
go-version:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -66,7 +66,7 @@ jobs:
version: nightly-latest
- os: macos-26
version: nightly-latest
name: 'Go: tracing with legacy workflow'
name: "Go: tracing with legacy workflow"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -86,8 +86,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: go
@@ -100,5 +100,5 @@ jobs:
exit 1
fi
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
CODEQL_ACTION_TEST_MODE: true

16
.github/workflows/__go.yml generated vendored
View File

@@ -19,10 +19,10 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
jobs:
go-custom-queries:
name: 'Go: Custom queries'
name: "Go: Custom queries"
permissions:
contents: read
security-events: read
@@ -31,7 +31,7 @@ jobs:
dotnet-version: ${{ inputs.dotnet-version }}
go-version: ${{ inputs.go-version }}
go-indirect-tracing-workaround-diagnostic:
name: 'Go: diagnostic when Go is changed after init step'
name: "Go: diagnostic when Go is changed after init step"
permissions:
contents: read
security-events: read
@@ -39,7 +39,7 @@ jobs:
with:
go-version: ${{ inputs.go-version }}
go-indirect-tracing-workaround-no-file-program:
name: 'Go: diagnostic when `file` is not installed'
name: "Go: diagnostic when `file` is not installed"
permissions:
contents: read
security-events: read
@@ -47,7 +47,7 @@ jobs:
with:
go-version: ${{ inputs.go-version }}
go-indirect-tracing-workaround:
name: 'Go: workaround for indirect tracing'
name: "Go: workaround for indirect tracing"
permissions:
contents: read
security-events: read
@@ -55,7 +55,7 @@ jobs:
with:
go-version: ${{ inputs.go-version }}
go-tracing-autobuilder:
name: 'Go: tracing with autobuilder step'
name: "Go: tracing with autobuilder step"
permissions:
contents: read
security-events: read
@@ -63,7 +63,7 @@ jobs:
with:
go-version: ${{ inputs.go-version }}
go-tracing-custom-build-steps:
name: 'Go: tracing with custom build steps'
name: "Go: tracing with custom build steps"
permissions:
contents: read
security-events: read
@@ -71,7 +71,7 @@ jobs:
with:
go-version: ${{ inputs.go-version }}
go-tracing-legacy-workflow:
name: 'Go: tracing with legacy workflow'
name: "Go: tracing with legacy workflow"
permissions:
contents: read
security-events: read

12
.github/workflows/__init-with-registries.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Packaging: Download using registries'
name: "PR Check - Packaging: Download using registries"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -40,7 +40,7 @@ jobs:
version: linked
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Download using registries'
name: "Packaging: Download using registries"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -55,12 +55,12 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Init with registries
uses: ./../action/init
with:
db-location: '${{ runner.temp }}/customDbLocation'
db-location: "${{ runner.temp }}/customDbLocation"
tools: ${{ steps.prepare-test.outputs.tools-url }}
config-file: ./.github/codeql/codeql-config-registries.yml
languages: javascript

6
.github/workflows/__javascript-source-root.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -55,8 +55,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Move codeql-action
run: |
mkdir ../new-source-root

10
.github/workflows/__job-run-uuid-sarif.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -51,8 +51,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
id: init
with:
@@ -60,12 +60,12 @@ jobs:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
- name: Upload SARIF
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
path: '${{ runner.temp }}/results/javascript.sarif'
path: "${{ runner.temp }}/results/javascript.sarif"
retention-days: 7
- name: Check results
run: |

8
.github/workflows/__language-aliases.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -51,14 +51,14 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: C#,java-kotlin,typescript
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: 'Check languages'
- name: "Check languages"
run: |
expected_languages="csharp,java,javascript"
actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

10
.github/workflows/__linux-arm64.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -80,8 +80,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: ${{ env.LANGUAGES }}

10
.github/workflows/__local-bundle.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -80,8 +80,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Fetch latest CodeQL bundle
run: |
wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst

14
.github/workflows/__multi-language-autodetect.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -114,8 +114,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Install Python 3.13.15 for older CLI versions
# Older CLI versions don't work with Python 3.13.16 or newer because their Python extractor
# imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
@@ -123,7 +123,7 @@ jobs:
if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
with:
python-version: '3.13.15'
python-version: "3.13.15"
- name: Use Xcode 16
# Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15.
@@ -133,7 +133,7 @@ jobs:
- uses: ./../action/init
id: init
with:
db-location: '${{ runner.temp }}/customDbLocation'
db-location: "${{ runner.temp }}/customDbLocation"
languages: ${{ runner.os == 'Linux' && 'cpp,csharp,go,java,javascript,python,ruby' || '' }}
tools: ${{ steps.prepare-test.outputs.tools-url }}

6
.github/workflows/__overlay-init-fallback.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -53,8 +53,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: actions # Any language without overlay support will do

18
.github/workflows/__packaging-codescanning-config-inputs-js.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Packaging: Config and input passed to the CLI'
name: "PR Check - Packaging: Config and input passed to the CLI"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -60,7 +60,7 @@ jobs:
version: default
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Config and input passed to the CLI'
name: "Packaging: Config and input passed to the CLI"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -93,11 +93,11 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
config-file: '.github/codeql/codeql-config-packaging3.yml'
config-file: ".github/codeql/codeql-config-packaging3.yml"
packs: +codeql-testing/codeql-pack1@1.0.0
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +105,7 @@ jobs:
run: ./build.sh
- uses: ./../action/analyze
with:
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
upload-database: false
- name: Check results

18
.github/workflows/__packaging-config-inputs-js.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Packaging: Config and input'
name: "PR Check - Packaging: Config and input"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -60,7 +60,7 @@ jobs:
version: default
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Config and input'
name: "Packaging: Config and input"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -93,11 +93,11 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
config-file: '.github/codeql/codeql-config-packaging3.yml'
config-file: ".github/codeql/codeql-config-packaging3.yml"
packs: +codeql-testing/codeql-pack1@1.0.0
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +105,7 @@ jobs:
run: ./build.sh
- uses: ./../action/analyze
with:
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
upload-database: false
- name: Check results

18
.github/workflows/__packaging-config-js.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Packaging: Config file'
name: "PR Check - Packaging: Config file"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -60,7 +60,7 @@ jobs:
version: default
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Config file'
name: "Packaging: Config file"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -93,18 +93,18 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
config-file: '.github/codeql/codeql-config-packaging.yml'
config-file: ".github/codeql/codeql-config-packaging.yml"
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
run: ./build.sh
- uses: ./../action/analyze
with:
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
upload-database: false
- name: Check results

18
.github/workflows/__packaging-inputs-js.yml generated vendored
View File

@@ -3,7 +3,7 @@
# pr-checks/sync.sh
# to regenerate this file.
name: 'PR Check - Packaging: Action input'
name: "PR Check - Packaging: Action input"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -60,7 +60,7 @@ jobs:
version: default
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Action input'
name: "Packaging: Action input"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -93,11 +93,11 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
config-file: '.github/codeql/codeql-config-packaging2.yml'
config-file: ".github/codeql/codeql-config-packaging2.yml"
languages: javascript
packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql
tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +105,7 @@ jobs:
run: ./build.sh
- uses: ./../action/analyze
with:
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
- name: Check results
uses: ./../action/.github/actions/check-sarif

6
.github/workflows/__per-language-bundle-validation.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -95,8 +95,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Remove CodeQL from toolcache
run: |
cd ./../action

10
.github/workflows/__remote-config.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -82,8 +82,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
tools: ${{ steps.prepare-test.outputs.tools-url }}

6
.github/workflows/__resolve-environment-action.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -55,8 +55,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: go,javascript-typescript

6
.github/workflows/__ruby.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -61,8 +61,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: ruby

6
.github/workflows/__rust.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -59,8 +59,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
languages: rust

16
.github/workflows/__split-workflow.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -90,11 +90,11 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
config-file: '.github/codeql/codeql-config-packaging3.yml'
config-file: ".github/codeql/codeql-config-packaging3.yml"
packs: +codeql-testing/codeql-pack1@1.0.0
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -103,7 +103,7 @@ jobs:
- uses: ./../action/analyze
with:
skip-queries: true
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
upload-database: false
- name: Assert No Results
@@ -114,7 +114,7 @@ jobs:
fi
- uses: ./../action/analyze
with:
output: '${{ runner.temp }}/results'
output: "${{ runner.temp }}/results"
upload-database: false
- name: Assert Results
run: |

8
.github/workflows/__start-proxy.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -55,8 +55,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Setup proxy for registries
id: proxy
uses: ./../action/start-proxy
@@ -101,5 +101,5 @@ jobs:
tools: ${{ steps.prepare-test.outputs.tools-url }}
config-file: codeql-action@main:tests/multi-language-repo/.github/codeql/custom-queries.yml
env:
CODEQL_ACTION_PROXY_API_REQUESTS: 'true'
CODEQL_ACTION_PROXY_API_REQUESTS: "true"
CODEQL_ACTION_TEST_MODE: true

8
.github/workflows/__submit-sarif-failure.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -55,8 +55,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: ./init
with:
@@ -76,7 +76,7 @@ jobs:
# `category` input. Without this step, that part of the init post-action would fail.
if: false
with:
category: '/test-codeql-version:${{ matrix.version }}'
category: "/test-codeql-version:${{ matrix.version }}"
env:
CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF: true
CODEQL_ACTION_UPLOAD_FAILED_SARIF: true

6
.github/workflows/__swift-autobuild.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -51,8 +51,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
id: init
with:

12
.github/workflows/__swift-custom-build.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -84,8 +84,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
id: init
with:
@@ -107,5 +107,5 @@ jobs:
exit 1
fi
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
CODEQL_ACTION_TEST_MODE: true

10
.github/workflows/__unset-environment.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -82,8 +82,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
id: init
with:

8
.github/workflows/__unsupported-macos.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs: {}
workflow_call:
@@ -62,8 +62,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Check xcode_select_link
run: |
readlink /private/var/db/xcode_select_link
@@ -86,7 +86,7 @@ jobs:
if: false
uses: ./analyze
with:
category: '/test-codeql-version:${{ matrix.version }}'
category: "/test-codeql-version:${{ matrix.version }}"
env:
CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
CODEQL_ACTION_SKIP_SARIF_UPLOAD: true

18
.github/workflows/__upload-ref-sha-input.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -80,8 +80,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -92,12 +92,12 @@ jobs:
# Generate some SARIF we can upload with the upload-sarif step
- uses: ./../action/analyze
with:
ref: 'refs/heads/main'
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
ref: "refs/heads/main"
sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
upload: never
- uses: ./../action/upload-sarif
with:
ref: 'refs/heads/main'
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
ref: "refs/heads/main"
sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
env:
CODEQL_ACTION_TEST_MODE: true

40
.github/workflows/__upload-sarif.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -87,8 +87,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- uses: ./../action/init
with:
tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -99,8 +99,8 @@ jobs:
# Generate some SARIF we can upload with the upload-sarif step
- uses: ./../action/analyze
with:
ref: 'refs/heads/main'
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
ref: "refs/heads/main"
sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
upload: never
output: ${{ runner.temp }}/results
@@ -109,15 +109,15 @@ jobs:
uses: ./../action/upload-sarif
id: upload-sarif
with:
ref: 'refs/heads/main'
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
ref: "refs/heads/main"
sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
sarif_file: ${{ runner.temp }}/results
category: |
${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:all-files/
- name: 'Fail for missing output from `upload-sarif` step for `code-scanning`'
- name: "Fail for missing output from `upload-sarif` step for `code-scanning`"
if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-scanning)
run: exit 1
- name: 'Fail for missing output from `upload-sarif` step for `code-quality`'
- name: "Fail for missing output from `upload-sarif` step for `code-quality`"
if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)
run: exit 1
@@ -126,12 +126,12 @@ jobs:
id: upload-single-sarif-code-scanning
if: contains(matrix.analysis-kinds, 'code-scanning')
with:
ref: 'refs/heads/main'
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
ref: "refs/heads/main"
sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
sarif_file: ${{ runner.temp }}/results/javascript.sarif
category: |
${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-scanning/
- name: 'Fail for missing output from `upload-single-sarif-code-scanning` step'
- name: "Fail for missing output from `upload-single-sarif-code-scanning` step"
if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-sarif-code-scanning.outputs.sarif-ids).code-scanning)
run: exit 1
- name: Upload single SARIF file for Code Quality
@@ -139,12 +139,12 @@ jobs:
id: upload-single-sarif-code-quality
if: contains(matrix.analysis-kinds, 'code-quality')
with:
ref: 'refs/heads/main'
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
ref: "refs/heads/main"
sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
sarif_file: ${{ runner.temp }}/results/javascript.quality.sarif
category: |
${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-quality/
- name: 'Fail for missing output from `upload-single-sarif-code-quality` step'
- name: "Fail for missing output from `upload-single-sarif-code-quality` step"
if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-single-sarif-code-quality.outputs.sarif-ids).code-quality)
run: exit 1
@@ -156,12 +156,12 @@ jobs:
id: upload-single-non-sarif
if: contains(matrix.analysis-kinds, 'code-scanning')
with:
ref: 'refs/heads/main'
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
ref: "refs/heads/main"
sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
sarif_file: ${{ runner.temp }}/results/javascript.sarif.json
category: |
${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:non-sarif/
- name: 'Fail for missing output from `upload-single-non-sarif` step'
- name: "Fail for missing output from `upload-single-non-sarif` step"
if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-non-sarif.outputs.sarif-ids).code-scanning)
run: exit 1
env:

10
.github/workflows/__with-checkout-path.yml generated vendored
View File

@@ -17,7 +17,7 @@ on:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
inputs:
dotnet-version:
@@ -29,7 +29,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
workflow_call:
inputs:
dotnet-version:
@@ -41,7 +41,7 @@ on:
type: string
description: The version of Go to install
required: false
default: '>=1.21.0'
default: ">=1.21.0"
defaults:
run:
shell: bash
@@ -81,8 +81,8 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
use-all-platform-bundle: "false"
setup-kotlin: "true"
- name: Delete original checkout
run: |
# delete the original checkout so we don't accidentally use it.

152
.github/workflows/codeql.yml vendored
View File

@@ -8,7 +8,7 @@ on:
types: [checks_requested]
schedule:
# Weekly on Sunday.
- cron: '30 1 * * 0'
- cron: "30 1 * * 0"
workflow_dispatch:
defaults:
@@ -32,41 +32,41 @@ jobs:
security-events: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up default CodeQL bundle
id: setup-default
uses: ./setup-codeql
- name: Set up linked CodeQL bundle
id: setup-linked
uses: ./setup-codeql
with:
tools: linked
- name: Compare default and linked CodeQL bundle versions
id: compare
env:
CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
run: |
CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up default CodeQL bundle
id: setup-default
uses: ./setup-codeql
- name: Set up linked CodeQL bundle
id: setup-linked
uses: ./setup-codeql
with:
tools: linked
- name: Compare default and linked CodeQL bundle versions
id: compare
env:
CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
run: |
CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
# If we're running on a pull request, run with both bundles, even if `tools: linked` would
# be the same as `tools: null`. This allows us to make the job for each of the bundles a
# required status check.
#
# If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
# the same as running with `tools: null`.
if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
VERSIONS_JSON='[null]'
else
VERSIONS_JSON='[null, "linked"]'
fi
# If we're running on a pull request, run with both bundles, even if `tools: linked` would
# be the same as `tools: null`. This allows us to make the job for each of the bundles a
# required status check.
#
# If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
# the same as running with `tools: null`.
if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
VERSIONS_JSON='[null]'
else
VERSIONS_JSON='[null, "linked"]'
fi
# Output a JSON-encoded list with the distinct versions to test against.
echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
# Output a JSON-encoded list with the distinct versions to test against.
echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
analyze-javascript:
if: github.triggering_actor != 'dependabot[bot]'
@@ -74,7 +74,13 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14-xlarge,macos-15-xlarge]
os:
- ubuntu-22.04
- ubuntu-24.04
- windows-2022
- windows-2025
- macos-14-xlarge
- macos-15-xlarge
tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
runs-on: ${{ matrix.os }}
@@ -83,26 +89,26 @@ jobs:
security-events: write
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Initialize CodeQL
uses: ./init
id: init
with:
languages: javascript
config-file: ./.github/codeql/codeql-config-javascript.yml
tools: ${{ matrix.tools }}
# confirm steps.init.outputs.codeql-path points to the codeql binary
- name: Print CodeQL Version
run: >
"$CODEQL" version --format=json
env:
CODEQL: ${{steps.init.outputs.codeql-path}}
- name: Perform CodeQL Analysis
uses: ./analyze
with:
category: "/language:javascript"
upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Initialize CodeQL
uses: ./init
id: init
with:
languages: javascript
config-file: ./.github/codeql/codeql-config-javascript.yml
tools: ${{ matrix.tools }}
# confirm steps.init.outputs.codeql-path points to the codeql binary
- name: Print CodeQL Version
run: >
"$CODEQL" version --format=json
env:
CODEQL: ${{steps.init.outputs.codeql-path}}
- name: Perform CodeQL Analysis
uses: ./analyze
with:
category: "/language:javascript"
upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
analyze-other:
if: github.triggering_actor != 'dependabot[bot]'
@@ -119,21 +125,21 @@ jobs:
security-events: write
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Initialize CodeQL
uses: ./init
with:
languages: ${{ matrix.language }}
build-mode: none
config: >
paths-ignore:
- lib
- tests
queries:
- uses: security-and-quality
- name: Perform CodeQL Analysis
uses: ./analyze
with:
category: "/language:${{ matrix.language }}"
upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Initialize CodeQL
uses: ./init
with:
languages: ${{ matrix.language }}
build-mode: none
config: >
paths-ignore:
- lib
- tests
queries:
- uses: security-and-quality
- name: Perform CodeQL Analysis
uses: ./analyze
with:
category: "/language:${{ matrix.language }}"
upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}

342
.github/workflows/codescanning-config-cli.yml vendored
View File

@@ -10,13 +10,13 @@ env:
on:
push:
branches:
- main
- releases/v*
- main
- releases/v*
pull_request:
merge_group:
types: [checks_requested]
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
concurrency:
@@ -41,187 +41,187 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-26.04
version: linked
- os: ubuntu-26.04
version: default
- os: ubuntu-26.04
version: nightly-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-26.04
version: default
- os: ubuntu-26.04
version: nightly-latest
# Code-Scanning config not created because environment variable is not set
name: Code Scanning Configuration tests
timeout-minutes: 45
runs-on: ${{ matrix.os }}
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: 'npm'
- name: Set up Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: "npm"
- name: Install dependencies
run: npm ci
- name: Install dependencies
run: npm ci
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
- name: Empty file
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: "{}"
# Request multiple languages so later checks can reuse the combined bundle.
languages: javascript,python
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Empty file
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: "{}"
# Request multiple languages so later checks can reuse the combined bundle.
languages: javascript,python
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Packs from input
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
}
languages: javascript
packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Packs from input with +
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
}
languages: javascript
packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Queries from input
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
}
languages: javascript
queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Queries from input with +
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
}
languages: javascript
queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Queries and packs from input with +
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
"packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
}
languages: javascript
queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Queries and packs from config
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
"packs": {
"javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
- name: Packs from input
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
}
}
languages: javascript
config-file-test: .github/codeql/queries-and-packs-config.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
languages: javascript
packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Queries and packs from config overriden by input
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
"packs": ["codeql/javascript-queries"]
}
languages: javascript
queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
packs: codeql/javascript-queries
config-file-test: .github/codeql/queries-and-packs-config.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Packs from input with +
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
}
languages: javascript
packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Queries and packs from config merging with input
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"packs": {
"javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
},
"queries": [
{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
]
}
languages: javascript
queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
packs: + codeql/javascript-queries
config-file-test: .github/codeql/queries-and-packs-config.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Queries from input
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
}
languages: javascript
queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Multi-language packs from config
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"packs": {
"javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
"ruby": ["codeql/ruby-queries"]
},
"queries": [
{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
]
}
languages: javascript,ruby
config-file-test: .github/codeql/multi-language-packs-config.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Queries from input with +
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
}
languages: javascript
queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Other config properties
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"name": "Config using all properties",
"packs": ["codeql/javascript-queries" ],
"disable-default-queries": true,
"paths-ignore": ["xxx"],
"paths": ["yyy"]
}
languages: javascript
packs: + codeql/javascript-queries
config-file-test: .github/codeql/other-config-properties.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Queries and packs from input with +
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
"packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
}
languages: javascript
queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Queries and packs from config
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
"packs": {
"javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
}
}
languages: javascript
config-file-test: .github/codeql/queries-and-packs-config.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Queries and packs from config overriden by input
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
"packs": ["codeql/javascript-queries"]
}
languages: javascript
queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
packs: codeql/javascript-queries
config-file-test: .github/codeql/queries-and-packs-config.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Queries and packs from config merging with input
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"packs": {
"javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
},
"queries": [
{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
]
}
languages: javascript
queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
packs: + codeql/javascript-queries
config-file-test: .github/codeql/queries-and-packs-config.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Multi-language packs from config
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"packs": {
"javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
"ruby": ["codeql/ruby-queries"]
},
"queries": [
{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
]
}
languages: javascript,ruby
config-file-test: .github/codeql/multi-language-packs-config.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Other config properties
if: success() || failure()
uses: ./../action/.github/actions/check-codescanning-config
with:
expected-config-file-contents: |
{
"name": "Config using all properties",
"packs": ["codeql/javascript-queries" ],
"disable-default-queries": true,
"paths-ignore": ["xxx"],
"paths": ["yyy"]
}
languages: javascript
packs: + codeql/javascript-queries
config-file-test: .github/codeql/other-config-properties.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}

4
.github/workflows/publish-immutable-action.yml vendored
View File

@@ -1,10 +1,10 @@
name: 'Publish Immutable Action Version'
name: "Publish Immutable Action Version"
on:
push:
tags:
# Match version tags, but not the major version tags.
- 'v[0-9]+.**'
- "v[0-9]+.**"
defaults:
run:

32
.github/workflows/python312-windows.yml vendored
View File

@@ -8,7 +8,7 @@ on:
types: [checks_requested]
schedule:
# Weekly on Monday.
- cron: '0 0 * * 1'
- cron: "0 0 * * 1"
workflow_dispatch:
concurrency:
@@ -32,22 +32,22 @@ jobs:
runs-on: windows-2025
steps:
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
with:
python-version: 3.12
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
with:
python-version: 3.12
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Prepare test
uses: ./.github/actions/prepare-test
with:
version: default
- name: Prepare test
uses: ./.github/actions/prepare-test
with:
version: default
- name: Initialize CodeQL
uses: ./../action/init
with:
tools: linked
languages: python
- name: Initialize CodeQL
uses: ./../action/init
with:
tools: linked
languages: python
- name: Analyze
uses: ./../action/analyze
- name: Analyze
uses: ./../action/analyze

82
.github/workflows/query-filters.yml vendored
View File

@@ -3,13 +3,13 @@ name: Query filters tests
on:
push:
branches:
- main
- releases/v*
- main
- releases/v*
pull_request:
merge_group:
types: [checks_requested]
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
concurrency:
@@ -29,47 +29,47 @@ jobs:
permissions:
contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: npm
- name: Install Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: npm
- name: Install dependencies
run: npm ci
- name: Install dependencies
run: npm ci
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
with:
version: linked
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
with:
version: linked
- name: Check SARIF for default queries with Single include, Single exclude
uses: ./../action/.github/actions/query-filter-test
with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run: js/zipslip
queries-not-run: js/path-injection
config-file: ./.github/codeql/codeql-config-query-filters1.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Check SARIF for default queries with Single include, Single exclude
uses: ./../action/.github/actions/query-filter-test
with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run: js/zipslip
queries-not-run: js/path-injection
config-file: ./.github/codeql/codeql-config-query-filters1.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Check SARIF for query packs with Single include, Single exclude
uses: ./../action/.github/actions/query-filter-test
with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run: js/zipslip,javascript/example/empty-or-one-block
queries-not-run: js/path-injection
config-file: ./.github/codeql/codeql-config-query-filters2.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Check SARIF for query packs with Single include, Single exclude
uses: ./../action/.github/actions/query-filter-test
with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run: js/zipslip,javascript/example/empty-or-one-block
queries-not-run: js/path-injection
config-file: ./.github/codeql/codeql-config-query-filters2.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Check SARIF for query packs and local queries with Single include, Single exclude
uses: ./../action/.github/actions/query-filter-test
with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
config-file: ./.github/codeql/codeql-config-query-filters3.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Check SARIF for query packs and local queries with Single include, Single exclude
uses: ./../action/.github/actions/query-filter-test
with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
config-file: ./.github/codeql/codeql-config-query-filters3.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}

56
.github/workflows/test-codeql-bundle-all.yml vendored
View File

@@ -1,17 +1,17 @@
name: 'PR Check - CodeQL Bundle All'
name: "PR Check - CodeQL Bundle All"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
on:
push:
branches:
- main
- releases/v*
- main
- releases/v*
pull_request:
merge_group:
types: [checks_requested]
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
concurrency:
@@ -27,9 +27,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-26.04
version: nightly-latest
name: 'CodeQL Bundle All'
- os: ubuntu-26.04
version: nightly-latest
name: "CodeQL Bundle All"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
@@ -37,26 +37,26 @@ jobs:
timeout-minutes: 45
runs-on: ${{ matrix.os }}
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: true
- name: Install .NET
uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
with:
dotnet-version: '9.x'
- id: init
uses: ./../action/init
with:
# We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
languages: cpp,csharp,go,java,javascript,python,ruby
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
run: ./build.sh
- uses: ./../action/analyze
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: true
- name: Install .NET
uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
with:
dotnet-version: "9.x"
- id: init
uses: ./../action/init
with:
# We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
languages: cpp,csharp,go,java,javascript,python,ruby
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
run: ./build.sh
- uses: ./../action/analyze
env:
CODEQL_ACTION_TEST_MODE: true

4
.github/workflows/update-bundle.yml vendored
View File

@@ -30,7 +30,7 @@ jobs:
- name: Dump GitHub context
env:
GITHUB_CONTEXT: '${{ toJson(github) }}'
GITHUB_CONTEXT: "${{ toJson(github) }}"
run: echo "$GITHUB_CONTEXT"
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -44,7 +44,7 @@ jobs:
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: 'npm'
cache: "npm"
- name: Install dependencies
run: npm ci

116
.github/workflows/update-release-branch.yml vendored
View File

@@ -38,43 +38,43 @@ jobs:
contents: write # needed to push commits
pull-requests: write # needed to create pull request
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # Need full history for calculation of diffs
- uses: ./.github/actions/release-initialise
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # Need full history for calculation of diffs
- uses: ./.github/actions/release-initialise
# when the workflow has been manually triggered on main,
# we know that we definitely want the release branch to exist
- name: Ensure release branch exists
run: |
echo "MAJOR_VERSION ${MAJOR_VERSION}"
RELEASE_BRANCH=releases/${MAJOR_VERSION}
if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
echo "Branch $RELEASE_BRANCH already exists"
echo ""
else
echo "Creating $RELEASE_BRANCH branch"
git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
git push --set-upstream origin ${RELEASE_BRANCH}
git branch --show-current
echo ""
fi
echo "Returning to branch: ${REF_NAME}"
git checkout ${REF_NAME}
# when the workflow has been manually triggered on main,
# we know that we definitely want the release branch to exist
- name: Ensure release branch exists
run: |
echo "MAJOR_VERSION ${MAJOR_VERSION}"
RELEASE_BRANCH=releases/${MAJOR_VERSION}
if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
echo "Branch $RELEASE_BRANCH already exists"
echo ""
else
echo "Creating $RELEASE_BRANCH branch"
git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
git push --set-upstream origin ${RELEASE_BRANCH}
git branch --show-current
echo ""
fi
echo "Returning to branch: ${REF_NAME}"
git checkout ${REF_NAME}
- name: Update current release branch
if: github.event_name == 'workflow_dispatch'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
echo SOURCE_BRANCH=${REF_NAME}
echo TARGET_BRANCH=releases/${MAJOR_VERSION}
npx tsx ./pr-checks/update-release-branch.ts \
--repository-nwo ${{ github.repository }} \
--source-branch '${{ env.REF_NAME }}' \
--target-branch 'releases/${{ env.MAJOR_VERSION }}' \
--is-primary-release \
--conductor ${GITHUB_ACTOR}
- name: Update current release branch
if: github.event_name == 'workflow_dispatch'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
echo SOURCE_BRANCH=${REF_NAME}
echo TARGET_BRANCH=releases/${MAJOR_VERSION}
npx tsx ./pr-checks/update-release-branch.ts \
--repository-nwo ${{ github.repository }} \
--source-branch '${{ env.REF_NAME }}' \
--target-branch 'releases/${{ env.MAJOR_VERSION }}' \
--is-primary-release \
--conductor ${GITHUB_ACTOR}
backport:
name: "Create backport"
@@ -94,28 +94,28 @@ jobs:
contents: write # needed to push commits
pull-requests: write # needed to create pull request
steps:
- name: Generate token
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
id: app-token
with:
app-id: ${{ vars.AUTOMATION_APP_ID }}
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
- name: Generate token
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
id: app-token
with:
app-id: ${{ vars.AUTOMATION_APP_ID }}
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # Need full history for calculation of diffs
token: ${{ steps.app-token.outputs.token }}
- uses: ./.github/actions/release-initialise
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # Need full history for calculation of diffs
token: ${{ steps.app-token.outputs.token }}
- uses: ./.github/actions/release-initialise
- name: Update older release branch
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
echo SOURCE_BRANCH=${SOURCE_BRANCH}
echo TARGET_BRANCH=${TARGET_BRANCH}
npx tsx ./pr-checks/update-release-branch.ts \
--repository-nwo ${{ github.repository }} \
--source-branch ${SOURCE_BRANCH} \
--target-branch ${TARGET_BRANCH} \
--conductor ${GITHUB_ACTOR}
- name: Update older release branch
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
echo SOURCE_BRANCH=${SOURCE_BRANCH}
echo TARGET_BRANCH=${TARGET_BRANCH}
npx tsx ./pr-checks/update-release-branch.ts \
--repository-nwo ${{ github.repository }} \
--source-branch ${SOURCE_BRANCH} \
--target-branch ${TARGET_BRANCH} \
--conductor ${GITHUB_ACTOR}

2
.github/workflows/update-supported-enterprise-server-versions.yml vendored
View File

@@ -29,7 +29,7 @@ jobs:
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: 'npm'
cache: "npm"
- name: Install dependencies
run: npm ci