From cf7a5d3e119e77868a4ad695211e3bc308d81094 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 12 Aug 2025 12:24:43 +0100 Subject: [PATCH] Add support for named collections of workflows --- .github/workflows/__go.yml | 57 +++++++++++++++++++ pr-checks/checks/go-custom-queries.yml | 1 + ...indirect-tracing-workaround-diagnostic.yml | 1 + ...ect-tracing-workaround-no-file-program.yml | 1 + .../checks/go-indirect-tracing-workaround.yml | 1 + pr-checks/checks/go-tracing-autobuilder.yml | 1 + .../checks/go-tracing-custom-build-steps.yml | 1 + .../checks/go-tracing-legacy-workflow.yml | 1 + pr-checks/sync.py | 51 +++++++++++++++++ 9 files changed, 115 insertions(+) create mode 100644 .github/workflows/__go.yml diff --git a/.github/workflows/__go.yml b/.github/workflows/__go.yml new file mode 100644 index 000000000..4a658abea --- /dev/null +++ b/.github/workflows/__go.yml @@ -0,0 +1,57 @@ +# Warning: This file is generated automatically, and should not be modified. +# Instead, please modify the template in the pr-checks directory and run: +# pr-checks/sync.sh +# to regenerate this file. + +name: Manual Check - go +env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GO111MODULE: auto +on: + push: + paths: + - .github/workflows/__go.yml + workflow_dispatch: {} +jobs: + go-custom-queries: + name: 'Go: Custom queries' + permissions: + contents: read + security-events: read + uses: ./.github/workflows/__go-custom-queries.yml + go-tracing-legacy-workflow: + name: 'Go: tracing with legacy workflow' + permissions: + contents: read + security-events: read + uses: ./.github/workflows/__go-tracing-legacy-workflow.yml + go-indirect-tracing-workaround: + name: 'Go: workaround for indirect tracing' + permissions: + contents: read + security-events: read + uses: ./.github/workflows/__go-indirect-tracing-workaround.yml + go-tracing-custom-build-steps: + name: 'Go: tracing with custom build steps' + permissions: + contents: read + security-events: read + uses: ./.github/workflows/__go-tracing-custom-build-steps.yml + go-tracing-autobuilder: + name: 'Go: tracing with autobuilder step' + permissions: + contents: read + security-events: read + uses: ./.github/workflows/__go-tracing-autobuilder.yml + go-indirect-tracing-workaround-diagnostic: + name: 'Go: diagnostic when Go is changed after init step' + permissions: + contents: read + security-events: read + uses: ./.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml + go-indirect-tracing-workaround-no-file-program: + name: 'Go: diagnostic when `file` is not installed' + permissions: + contents: read + security-events: read + uses: ./.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml diff --git a/pr-checks/checks/go-custom-queries.yml b/pr-checks/checks/go-custom-queries.yml index 2b3258bc7..4eeabfd71 100644 --- a/pr-checks/checks/go-custom-queries.yml +++ b/pr-checks/checks/go-custom-queries.yml @@ -1,5 +1,6 @@ name: "Go: Custom queries" description: "Checks that Go works in conjunction with a config file specifying custom queries" +collection: go operatingSystems: - ubuntu versions: diff --git a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml index 7e0acbe6d..48a15b5df 100644 --- a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml +++ b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml @@ -1,5 +1,6 @@ name: "Go: diagnostic when Go is changed after init step" description: "Checks that we emit a diagnostic if Go is changed after the init step" +collection: go # only Linux is affected operatingSystems: ["ubuntu"] # pinned to a version which does not support statically linked binaries for indirect tracing diff --git a/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml b/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml index 830dea00f..bc6c05f6f 100644 --- a/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml +++ b/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml @@ -1,5 +1,6 @@ name: "Go: diagnostic when `file` is not installed" description: "Checks that we emit a diagnostic if the `file` program is not installed" +collection: go # only Linux is affected operatingSystems: ["ubuntu"] # pinned to a version which does not support statically linked binaries for indirect tracing diff --git a/pr-checks/checks/go-indirect-tracing-workaround.yml b/pr-checks/checks/go-indirect-tracing-workaround.yml index 859b0516b..ddf2ab982 100644 --- a/pr-checks/checks/go-indirect-tracing-workaround.yml +++ b/pr-checks/checks/go-indirect-tracing-workaround.yml @@ -1,5 +1,6 @@ name: "Go: workaround for indirect tracing" description: "Checks that our workaround for indirect tracing for Go 1.21+ on Linux works" +collection: go # only Linux is affected operatingSystems: ["ubuntu"] # pinned to a version which does not support statically linked binaries for indirect tracing diff --git a/pr-checks/checks/go-tracing-autobuilder.yml b/pr-checks/checks/go-tracing-autobuilder.yml index 85d8c486b..9eee38d9e 100644 --- a/pr-checks/checks/go-tracing-autobuilder.yml +++ b/pr-checks/checks/go-tracing-autobuilder.yml @@ -1,5 +1,6 @@ name: "Go: tracing with autobuilder step" description: "Checks that Go tracing works when using an autobuilder step" +collection: go operatingSystems: ["ubuntu", "macos"] env: DOTNET_GENERATE_ASPNET_CERTIFICATE: "false" diff --git a/pr-checks/checks/go-tracing-custom-build-steps.yml b/pr-checks/checks/go-tracing-custom-build-steps.yml index 4b7b11582..3c606ae23 100644 --- a/pr-checks/checks/go-tracing-custom-build-steps.yml +++ b/pr-checks/checks/go-tracing-custom-build-steps.yml @@ -1,5 +1,6 @@ name: "Go: tracing with custom build steps" description: "Checks that Go tracing traces the build when using custom build steps" +collection: go operatingSystems: ["ubuntu", "macos"] installGo: "true" steps: diff --git a/pr-checks/checks/go-tracing-legacy-workflow.yml b/pr-checks/checks/go-tracing-legacy-workflow.yml index 5cec8818c..44b5b274f 100644 --- a/pr-checks/checks/go-tracing-legacy-workflow.yml +++ b/pr-checks/checks/go-tracing-legacy-workflow.yml @@ -1,5 +1,6 @@ name: "Go: tracing with legacy workflow" description: "Checks that we run the autobuilder in legacy workflows with neither an autobuild step nor manual build steps" +collection: go operatingSystems: ["ubuntu", "macos"] env: DOTNET_GENERATE_ASPNET_CERTIFICATE: "false" diff --git a/pr-checks/sync.py b/pr-checks/sync.py index ae234333e..59c8628ff 100755 --- a/pr-checks/sync.py +++ b/pr-checks/sync.py @@ -60,6 +60,7 @@ yaml.indent(mapping=2, sequence=4, offset=2) this_dir = pathlib.Path(__file__).resolve().parent allJobs = {} +collections = {} for file in (this_dir / 'checks').glob('*.yml'): with open(file, 'r') as checkStream: checkSpecification = yaml.load(checkStream) @@ -160,6 +161,14 @@ for file in (this_dir / 'checks').glob('*.yml'): checkJob['env']['CODEQL_ACTION_TEST_MODE'] = True checkName = file.stem + # If this check belongs to a named collection, record it. + if 'collection' in checkSpecification: + collection_name = checkSpecification['collection'] + collections.setdefault(collection_name, []).append({ + 'specification': checkSpecification, + 'checkName': checkName + }) + raw_file = this_dir.parent / ".github" / "workflows" / f"__{checkName}.yml.raw" with open(raw_file, 'w') as output_stream: writeHeader(output_stream) @@ -190,3 +199,45 @@ for file in (this_dir / 'checks').glob('*.yml'): content = input_stream.read() output_stream.write("\n".join(list(map(lambda x:x.rstrip(), content.splitlines()))+[''])) os.remove(raw_file) + +# write workflow files for collections +for collection_name in collections: + jobs = {} + + for check in collections[collection_name]: + checkName = check['checkName'] + checkSpecification = check['specification'] + jobs[checkName] = { + 'name': checkSpecification['name'], + 'permissions': { + 'contents': 'read', + 'security-events': 'read' + }, + 'uses': "./.github/workflows/" + f"__{checkName}.yml", + } + + raw_file = this_dir.parent / ".github" / "workflows" / f"__{collection_name}.yml.raw" + with open(raw_file, 'w') as output_stream: + writeHeader(output_stream) + yaml.dump({ + 'name': f"Manual Check - {collection_name}", + 'env': { + 'GITHUB_TOKEN': '${{ secrets.GITHUB_TOKEN }}', + 'GO111MODULE': 'auto' + }, + 'on': { + 'push': { + 'paths': [ + f'.github/workflows/__{collection_name}.yml' + ] + }, + 'workflow_dispatch': {}, + }, + 'jobs': jobs + }, output_stream) + + with open(raw_file, 'r') as input_stream: + with open(this_dir.parent / ".github" / "workflows" / f"__{collection_name}.yml", 'w') as output_stream: + content = input_stream.read() + output_stream.write("\n".join(list(map(lambda x:x.rstrip(), content.splitlines()))+[''])) + os.remove(raw_file)