From 4061d4ea8998759fb1143fa01632e394368dd5f6 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 17:35:02 +0100 Subject: [PATCH] Scaffold validation job --- .../workflows/__diagnostics-without-db.yml | 33 ++++++++++++++++ pr-checks/checks/diagnostics-without-db.yml | 22 +++++++++++ pr-checks/sync.ts | 38 +++++++++++++------ 3 files changed, 81 insertions(+), 12 deletions(-) diff --git a/.github/workflows/__diagnostics-without-db.yml b/.github/workflows/__diagnostics-without-db.yml index 9c5b64d22..80bf232d0 100644 --- a/.github/workflows/__diagnostics-without-db.yml +++ b/.github/workflows/__diagnostics-without-db.yml @@ -82,5 +82,38 @@ jobs: run: | cd ../action npx tsx ./pr-checks/diagnostics-without-db.ts + env: + CODEQL_ACTION_TEST_MODE: false + CODEQL_ACTION_SKIP_SARIF_UPLOAD: true + CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks + diagnostics-without-db-validation: + if: github.triggering_actor != 'dependabot[bot]' + needs: + - diagnostics-without-db + permissions: + contents: read + security-events: read + timeout-minutes: 5 + runs-on: ubuntu-latest + steps: + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Install Node.js + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: 20.x + cache: npm + - name: Install newer npm + run: npm install -g npm@11.19.1 + - name: Install dependencies + run: npm ci + - name: Download workflow artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + pattern: test-mode-sarif + path: sarif + + - name: List artifact contents + run: ls -laR ./sarif env: CODEQL_ACTION_TEST_MODE: true diff --git a/pr-checks/checks/diagnostics-without-db.yml b/pr-checks/checks/diagnostics-without-db.yml index 2985142b9..197b40e36 100644 --- a/pr-checks/checks/diagnostics-without-db.yml +++ b/pr-checks/checks/diagnostics-without-db.yml @@ -4,6 +4,15 @@ versions: # Overridden by the FF below. - linked installNode: true + +env: + # Allow the failed SARIF file to be generated. + CODEQL_ACTION_TEST_MODE: false + # But don't actually upload it. + CODEQL_ACTION_SKIP_SARIF_UPLOAD: true + # Mark telemetry for this workflow so it can be treated separately. + CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks + steps: # We deliberately need to make this step fail before the database is initialised, but after # some diagnostic has been produced. The simplest way to do that right now is to force the @@ -25,3 +34,16 @@ steps: run: | cd ../action npx tsx ./pr-checks/diagnostics-without-db.ts +validationJobs: + diagnostics-without-db-validation: + checkout: true + installNode: true + steps: + - name: Download workflow artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + pattern: test-mode-sarif + path: sarif + + - name: List artifact contents + run: ls -laR ./sarif diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 8dc1dd1d1..1d70d5c7f 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -90,7 +90,7 @@ interface Specification extends JobSpecification { services?: any; /** Additional jobs to run after the main PR check job. */ - validationJobs?: Record; + validationJobs?: Record; /** If set, this check is part of a named collection that gets its own caller workflow. */ collection?: string; @@ -122,6 +122,10 @@ interface JobSpecification { installYq?: boolean; } +type ValidationJobSpecification = JobSpecification & { + checkout?: boolean; +}; + /** Describes language/framework-specific steps and inputs. */ interface LanguageSetup { specProperty: keyof JobSpecification; @@ -462,6 +466,20 @@ function generateJobMatrix( return matrix; } +/** + * Gets the `actions/checkout` step. + */ +function getCheckoutStep(): Step { + return { + name: "Check out repository", + uses: pinnedUses( + "actions/checkout", + "3d3c42e5aac5ba805825da76410c181273ba90b1", + "v7.0.1", + ), + }; +} + /** * Retrieves setup steps and additional input definitions based on specific languages or frameworks * that are requested by the `checkSpecification`. @@ -531,14 +549,7 @@ function generateJob( // Construct the workflow steps needed for this check. const steps: Step[] = [ - { - name: "Check out repository", - uses: pinnedUses( - "actions/checkout", - "3d3c42e5aac5ba805825da76410c181273ba90b1", - "v7.0.1", - ), - }, + getCheckoutStep(), ...setupInfo.steps, { name: "Prepare test", @@ -609,13 +620,16 @@ function generateJob( /** Generates a validation job. */ function generateValidationJob( specDocument: yaml.Document, - jobSpecification: JobSpecification, + jobSpecification: ValidationJobSpecification, checkName: string, name: string, ) { // Determine which languages or frameworks have to be installed. const { inputs, steps } = getSetupSteps(jobSpecification); + // Construct a checkout step if requested. + const checkoutStep = jobSpecification.checkout ? [getCheckoutStep()] : []; + // Extract the sequence of steps from the YAML document to persist as much formatting as possible. const specSteps = specDocument.getIn([ "validationJobs", @@ -624,7 +638,7 @@ function generateValidationJob( ]) as yaml.YAMLSeq; // Add the generated steps in front of the ones from the specification. - specSteps.items.unshift(...steps); + specSteps.items.unshift(...checkoutStep, ...steps); const validationJob: Record = { name: jobSpecification.name, @@ -635,7 +649,7 @@ function generateValidationJob( "security-events": "read", }, "timeout-minutes": 5, - "runs-on": "ubuntu-slim", + "runs-on": "ubuntu-latest", steps: specSteps, };