codeql-action/.github/workflows/__export-file-baseline-information.yml at main · github/codeql-action · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
# Warning: This file is generated automatically, and should not be modified.
# Instead, please modify the template in the pr-checks directory and run:
#     pr-checks/sync.sh
# to regenerate this file.

name: PR Check - Export file baseline information
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  GO111MODULE: auto
on:
  push:
    branches:
      - main
      - releases/v*
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
      - ready_for_review
  merge_group:
    types:
      - checks_requested
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
    inputs:
      dotnet-version:
        type: string
        description: The version of .NET to install
        required: false
        default: 9.x
      go-version:
        type: string
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
  workflow_call:
    inputs:
      dotnet-version:
        type: string
        description: The version of .NET to install
        required: false
        default: 9.x
      go-version:
        type: string
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
defaults:
  run:
    shell: bash
concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
jobs:
  export-file-baseline-information:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            version: nightly-latest
          - os: macos-latest
            version: nightly-latest
          - os: windows-latest
            version: nightly-latest
    name: Export file baseline information
    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
    timeout-minutes: 45
    runs-on: ${{ matrix.os }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v6
      - name: Install .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
      - name: Install Go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
        with:
          version: ${{ matrix.version }}
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - uses: ./../action/init
        id: init
        with:
          languages: javascript
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
        run: ./build.sh
      - uses: ./../action/analyze
        with:
          output: '${{ runner.temp }}/results'
      - name: Upload SARIF
        uses: actions/upload-artifact@v7
        with:
          name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: '${{ runner.temp }}/results/javascript.sarif'
          retention-days: 7
      - name: Check results
        run: |
          cd "$RUNNER_TEMP/results"
          expected_baseline_languages="c csharp go java kotlin javascript python ruby"
          if [[ $RUNNER_OS == "macOS" ]]; then
            expected_baseline_languages+=" swift"
          fi

          for lang in ${expected_baseline_languages}; do
            rule_name="cli/expected-extracted-files/${lang}"
            found_notification=$(jq --arg rule_name "${rule_name}" '[.runs[0].tool.driver.notifications |
              select(. != null) | flatten | .[].id] | any(. == $rule_name)' javascript.sarif)
            if [[ "${found_notification}" != "true" ]]; then
              echo "Expected SARIF output to contain notification '${rule_name}', but found no such notification."
              exit 1
            else
              echo "Found notification '${rule_name}'."
            fi
          done
    env:
      CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS: false
      CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
      CODEQL_ACTION_TEST_MODE: true