Merge pull request #4312 from github/henrymercer/all-platform-bundle-checks

Make the "All-platform bundle" PR check use the all-platform bundle

.github/actions/prepare-test/action.yml

@@ -36,7 +36,14 @@ runs:
         set -e # Fail this Action if `gh release list` fails.
 
         if [[ "$VERSION" == "nightly" || "$VERSION" == "nightly-latest" ]]; then
-          echo "tools-url=nightly" >> "$GITHUB_OUTPUT"
+          if [[ "$USE_ALL_PLATFORM_BUNDLE" == "true" ]]; then
+            # With `tools: nightly`, the Action downloads the bundle for the runner's platform, so look
+            # up the latest nightly release here to get its all-platform bundle instead.
+            tag=$(gh release list --repo dsp-testing/codeql-cli-nightlies --limit 1 --json tagName --jq '.[0].tagName')
+            echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/$tag/codeql-bundle.tar.gz" >> "$GITHUB_OUTPUT"
+          else
+            echo "tools-url=nightly" >> "$GITHUB_OUTPUT"
+          fi
           exit 0
         elif [[ "$VERSION" == "linked" ]]; then
           echo "tools-url=linked" >> "$GITHUB_OUTPUT"

.github/workflows/__all-platform-bundle.yml

@@ -92,6 +92,18 @@ jobs:
           # Swift is not supported on Ubuntu so we manually exclude it from the list here
           languages: cpp,csharp,go,java,javascript,python,ruby
           tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Check that the bundle contains tools for all platforms
+        env:
+          CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
+        run: |
+          # Platform-specific bundles only contain the tools for their own platform.
+          tools_dir="$(dirname "$CODEQL_PATH")/tools"
+          for platform in linux64 osx64 win64; do
+            if [[ ! -d "$tools_dir/$platform" ]]; then
+              echo "::error::Expected an all-platform CodeQL bundle, but '$tools_dir' does not contain a '$platform' directory."
+              exit 1
+            fi
+          done
       - name: Build code
         run: ./build.sh
       - uses: ./../action/analyze

.github/workflows/deflake.yml

@@ -31,7 +31,6 @@ on:
       - "PR Check - C/C\\+\\+: autoinstalling dependencies is skipped (macOS)"
       - "PR Check - C/C\\+\\+: disabling autoinstalling dependencies (Linux)"
       - "PR Check - Clean up database cluster directory"
-      - "PR Check - CodeQL Bundle All"
       - "PR Check - Config export"
       - "PR Check - Config input"
       - "PR Check - Custom source root"

.github/workflows/test-codeql-bundle-all.yml

@@ -1,62 +0,0 @@
-name: "PR Check - CodeQL Bundle All"
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    - cron: "0 5 * * *"
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-jobs:
-  test-codeql-bundle-all:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-26.04
-            version: nightly-latest
-    name: "CodeQL Bundle All"
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: true
-      - name: Install .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: "9.x"
-      - id: init
-        uses: ./../action/init
-        with:
-          # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-          languages: cpp,csharp,go,java,javascript,python,ruby
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-      - name: Build code
-        run: ./build.sh
-      - uses: ./../action/analyze
-    env:
-      CODEQL_ACTION_TEST_MODE: true

pr-checks/checks/all-platform-bundle.yml

@@ -17,6 +17,18 @@ steps:
       # Swift is not supported on Ubuntu so we manually exclude it from the list here
       languages: cpp,csharp,go,java,javascript,python,ruby
       tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Check that the bundle contains tools for all platforms
+    env:
+      CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
+    run: |
+      # Platform-specific bundles only contain the tools for their own platform.
+      tools_dir="$(dirname "$CODEQL_PATH")/tools"
+      for platform in linux64 osx64 win64; do
+        if [[ ! -d "$tools_dir/$platform" ]]; then
+          echo "::error::Expected an all-platform CodeQL bundle, but '$tools_dir' does not contain a '$platform' directory."
+          exit 1
+        fi
+      done
   - name: Build code
     run: ./build.sh
   - uses: ./../action/analyze