diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index bac0ba9c9..73045aedb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,62 +19,8 @@ env: CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks jobs: - # Identify the CodeQL tool versions to use in the analysis job. - check-codeql-versions: - if: github.triggering_actor != 'dependabot[bot]' - runs-on: ubuntu-26.04 - outputs: - versions: ${{ steps.compare.outputs.versions }} - - permissions: - contents: read - # We currently need `security-events: read` to access feature flags. - security-events: read - - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Set up default CodeQL bundle - id: setup-default - uses: ./setup-codeql - - name: Set up linked CodeQL bundle - id: setup-linked - uses: ./setup-codeql - with: - tools: linked - - name: Compare default and linked CodeQL bundle versions - id: compare - env: - CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }} - CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }} - run: | - CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)" - CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)" - echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT" - echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED" - - # If we're running on a pull request, run with both bundles, even if `tools: linked` would - # be the same as `tools: null`. This allows us to make the job for each of the bundles a - # required status check. - # - # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be - # the same as running with `tools: null`. - if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then - VERSIONS_JSON='[null]' - else - VERSIONS_JSON='[null, "linked"]' - fi - - # Output a JSON-encoded list with the distinct versions to test against. - echo "Suggested matrix config for analysis job: $VERSIONS_JSON" - echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT - analyze-javascript: if: github.triggering_actor != 'dependabot[bot]' - needs: [check-codeql-versions] - strategy: - fail-fast: false - matrix: - tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }} runs-on: ubuntu-26.04 permissions: @@ -90,7 +36,6 @@ jobs: with: languages: javascript config-file: ./.github/codeql/codeql-config-javascript.yml - tools: ${{ matrix.tools }} # confirm steps.init.outputs.codeql-path points to the codeql binary - name: Print CodeQL Version run: > @@ -101,7 +46,7 @@ jobs: uses: ./analyze with: category: "/language:javascript" - upload: ${{ (!matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }} + upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }} analyze-other: if: github.triggering_actor != 'dependabot[bot]'