Skip to content

Commit f8b63a3

Browse files
data-douserCopilotCopilot
authored
Add nightly CodeQL CLI update workflow (#58)
* Add nightly CodeQL CLI update workflow Detect new CodeQL CLI releases and create a PR with updated version files, rebuilt dependencies, and passing build/tests. * Update update-codeql.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com> * Update .github/workflows/update-codeql.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com> * Add validation for empty latest_tag in CodeQL update workflow (#60) * Initial plan * Add validation for empty latest_tag in update-codeql workflow Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com> * Apply suggestion from @data-douser Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com> --------- Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
1 parent 32979a8 commit f8b63a3

File tree

1 file changed

+172
-0
lines changed

1 file changed

+172
-0
lines changed

‎.github/workflows/update-codeql.yml‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
name: Update CodeQL CLI Dependencies
2+
3+
on:
4+
workflow_dispatch:
5+
# Nightly check for new CodeQL CLI releases
6+
schedule:
7+
- cron: '30 5 * * *'
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
# ─────────────────────────────────────────────────────────────────────────────
14+
# Step 1: Detect new CodeQL CLI version
15+
#
16+
# Compares the current CodeQL CLI version in .codeql-version against the
17+
# latest release from github/codeql-cli-binaries. If a newer version is
18+
# available, downstream jobs orchestrate the update and PR creation.
19+
# ─────────────────────────────────────────────────────────────────────────────
20+
detect-update:
21+
name: Detect CodeQL CLI Update
22+
runs-on: ubuntu-latest
23+
24+
outputs:
25+
current_version: ${{ steps.check-version.outputs.current_version }}
26+
latest_version: ${{ steps.check-version.outputs.latest_version }}
27+
update_needed: ${{ steps.check-version.outputs.update_needed }}
28+
version: ${{ steps.check-version.outputs.version }}
29+
30+
steps:
31+
- name: Detect - Checkout repository
32+
uses: actions/checkout@v6
33+
34+
- name: Detect - Check latest CodeQL CLI version
35+
id: check-version
36+
env:
37+
GH_TOKEN: ${{ github.token }}
38+
run: |
39+
echo "Checking latest CodeQL CLI version..."
40+
41+
# Read current version from .codeql-version (stores vX.Y.Z)
42+
current_version_raw=$(cat .codeql-version | tr -d '[:space:]')
43+
current_version="${current_version_raw#v}"
44+
45+
# Get latest release from codeql-cli-binaries
46+
latest_tag=$(gh release list --repo github/codeql-cli-binaries --json 'tagName,isLatest' --jq '.[] | select(.isLatest == true) | .tagName')
47+
48+
# Validate that we found a latest release
49+
if [ -z "${latest_tag}" ]; then
50+
echo "❌ Error: Could not determine latest CodeQL CLI version from github/codeql-cli-binaries" >&2
51+
echo "No release marked as 'latest' was found. This may indicate an API issue or repository change." >&2
52+
exit 1
53+
fi
54+
55+
latest_clean="${latest_tag#v}"
56+
57+
if [ -z "${latest_tag}" ]; then
58+
echo "❌ ERROR: Failed to determine latest CodeQL CLI release. 'gh release list' returned no results or no release is marked as latest." >&2
59+
echo "update_needed=false" >> $GITHUB_OUTPUT
60+
exit 1
61+
fi
62+
echo "Current CodeQL CLI version: ${current_version}"
63+
echo "Latest CodeQL CLI version: ${latest_clean}"
64+
65+
if [ "${latest_clean}" != "${current_version}" ]; then
66+
echo "✅ Update available: ${current_version} → ${latest_clean}"
67+
echo "update_needed=true" >> $GITHUB_OUTPUT
68+
echo "current_version=${current_version}" >> $GITHUB_OUTPUT
69+
echo "latest_version=${latest_clean}" >> $GITHUB_OUTPUT
70+
echo "version=v${latest_clean}" >> $GITHUB_OUTPUT
71+
else
72+
echo "ℹ️ CodeQL CLI is already up-to-date at version ${current_version}"
73+
echo "update_needed=false" >> $GITHUB_OUTPUT
74+
fi
75+
76+
- name: Detect - Summary
77+
run: |
78+
echo "## CodeQL CLI Update Check" >> $GITHUB_STEP_SUMMARY
79+
echo "" >> $GITHUB_STEP_SUMMARY
80+
if [ "${{ steps.check-version.outputs.update_needed }}" == "true" ]; then
81+
echo "✅ Update available: ${{ steps.check-version.outputs.current_version }} → ${{ steps.check-version.outputs.latest_version }}" >> $GITHUB_STEP_SUMMARY
82+
echo "" >> $GITHUB_STEP_SUMMARY
83+
echo "Initiating update pipeline for \`${{ steps.check-version.outputs.version }}\`..." >> $GITHUB_STEP_SUMMARY
84+
else
85+
echo "ℹ️ CodeQL CLI is already up-to-date. No changes needed." >> $GITHUB_STEP_SUMMARY
86+
fi
87+
88+
# ─────────────────────────────────────────────────────────────────────────────
89+
# Step 2: Update version, build, test, and create PR
90+
#
91+
# Updates all version-bearing files, installs dependencies, runs the full
92+
# build-and-test suite, and creates a pull request with the changes.
93+
# ─────────────────────────────────────────────────────────────────────────────
94+
create-pr:
95+
name: Create Update Pull Request
96+
needs: detect-update
97+
if: needs.detect-update.outputs.update_needed == 'true'
98+
runs-on: ubuntu-latest
99+
100+
permissions:
101+
contents: write
102+
pull-requests: write
103+
104+
steps:
105+
- name: Update - Checkout repository
106+
uses: actions/checkout@v6
107+
108+
- name: Update - Update .codeql-version
109+
run: |
110+
printf "v%s\n" "${{ needs.detect-update.outputs.latest_version }}" > .codeql-version
111+
echo "Updated .codeql-version to ${{ needs.detect-update.outputs.version }}"
112+
113+
- name: Update - Setup CodeQL environment
114+
uses: ./.github/actions/setup-codeql-environment
115+
with:
116+
add-to-path: true
117+
install-language-runtimes: false
118+
119+
- name: Update - Setup Node.js
120+
uses: actions/setup-node@v6
121+
with:
122+
cache: 'npm'
123+
node-version-file: '.node-version'
124+
125+
- name: Update - Update version in all files
126+
run: |
127+
LATEST="${{ needs.detect-update.outputs.latest_version }}"
128+
echo "Updating all version-bearing files to ${LATEST}..."
129+
./server/scripts/update-release-version.sh "${LATEST}"
130+
131+
- name: Update - Install dependencies
132+
run: npm install --include=optional
133+
134+
- name: Update - Install CodeQL pack dependencies
135+
run: server/scripts/install-packs.sh
136+
137+
- name: Update - Build and test
138+
run: npm run build-and-test
139+
140+
- name: Update - Create Pull Request
141+
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
142+
with:
143+
title: 'Upgrade CodeQL CLI dependency to ${{ needs.detect-update.outputs.version }}'
144+
body: |
145+
This PR upgrades the CodeQL CLI version to ${{ needs.detect-update.outputs.version }}.
146+
147+
**Changes made:**
148+
- Updated `.codeql-version` to `${{ needs.detect-update.outputs.version }}`
149+
- Updated all version-bearing files (package.json, codeql-pack.yml) to `${{ needs.detect-update.outputs.latest_version }}`
150+
- Regenerated `package-lock.json`
151+
- Installed CodeQL pack dependencies
152+
- Build and tests passed ✅
153+
commit-message: 'Upgrade CodeQL CLI dependency to ${{ needs.detect-update.outputs.version }}'
154+
delete-branch: true
155+
branch: 'codeql/upgrade-to-${{ needs.detect-update.outputs.version }}'
156+
157+
- name: Update - Summary
158+
run: |
159+
VERSION="${{ needs.detect-update.outputs.version }}"
160+
CURRENT="${{ needs.detect-update.outputs.current_version }}"
161+
LATEST="${{ needs.detect-update.outputs.latest_version }}"
162+
echo "## CodeQL CLI Update Summary" >> $GITHUB_STEP_SUMMARY
163+
echo "" >> $GITHUB_STEP_SUMMARY
164+
echo "Triggered by CodeQL CLI update: ${CURRENT} → ${LATEST}" >> $GITHUB_STEP_SUMMARY
165+
echo "" >> $GITHUB_STEP_SUMMARY
166+
echo "| Property | Old Value | New Value |" >> $GITHUB_STEP_SUMMARY
167+
echo "| -------- | --------- | --------- |" >> $GITHUB_STEP_SUMMARY
168+
echo "| .codeql-version | v${CURRENT} | ${VERSION} |" >> $GITHUB_STEP_SUMMARY
169+
echo "| package.json versions | ${CURRENT} | ${LATEST} |" >> $GITHUB_STEP_SUMMARY
170+
echo "| codeql-pack.yml versions | ${CURRENT} | ${LATEST} |" >> $GITHUB_STEP_SUMMARY
171+
echo "" >> $GITHUB_STEP_SUMMARY
172+
echo "A pull request has been created with these changes." >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)