Skip to content

Commit 725f737

Browse files
author
Alvaro Muñoz
committed
add actions/workflows
1 parent 553ea91 commit 725f737

File tree

3 files changed

+172
-0
lines changed

3 files changed

+172
-0
lines changed

‎.github/scripts/pr-compile.sh

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
4+
PR_NUMBER=${1}
5+
LANGUAGE=${2}
6+
# to stop recompiling all queries if multiple files are modified
7+
LIBRARY_SCANNED=false
8+
9+
echo "[+] Cloning CodeQL"
10+
gh repo clone github/codeql
11+
12+
echo "[+] Compiling all queries in $LANGUAGE"
13+
gh codeql query compile \
14+
--threads=0 --check-only \
15+
--search-path=./codeql --additional-packs=./codeql:./codeql/misc \
16+
"./$LANGUAGE/"
17+
18+
for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
19+
if [[ ! -f "$file" ]]; then
20+
continue
21+
fi
22+
23+
# if the file is a query file .ql or .qll
24+
if [[ "$file" == $LANGUAGE/**.ql ]]; then
25+
echo "[+] Compiling $file (in $LANGUAGE)"
26+
27+
# compile the query
28+
gh codeql query compile \
29+
--threads=0 --check-only \
30+
--warnings=error \
31+
--search-path=./codeql --additional-packs=./codeql:./codeql/misc \
32+
"./$file"
33+
34+
# if lib folder is modified
35+
elif [[ "$file" == $LANGUAGE/lib/* ]] && [[ $LIBRARY_SCANNED == false ]]; then
36+
echo "[+] Libray changed, compiling all queries in $LANGUAGE"
37+
gh codeql query compile \
38+
--threads=0 --check-only \
39+
--warnings=error \
40+
--search-path=./codeql --additional-packs=./codeql:./codeql/misc \
41+
"./$LANGUAGE/"
42+
# set LIBRARY_SCANNED to true to prevent recompiling
43+
LIBRARY_SCANNED=true
44+
45+
fi
46+
done
47+
48+
echo "[+] Complete"

‎.github/scripts/pr-suites-packs.sh

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
4+
PR_NUMBER=${1}
5+
LANGUAGE=${2}
6+
PACK_COMPILED=false
7+
8+
for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
9+
if [[ ! -f "$file" ]]; then
10+
continue
11+
fi
12+
13+
# suite folder
14+
if [[ "$file" == $LANGUAGE/suites/**.qls ]]; then
15+
echo "[+] Compiling Suite: $file"
16+
gh codeql resolve queries \
17+
--search-path=./codeql \
18+
--additional-packs=./codeql:./codeql/misc \
19+
"$file"
20+
21+
# qlpack file and lock file
22+
elif [[ "$file" == $LANGUAGE/qlpack.yml ]] || [[ "$file" == $LANGUAGE/codeql-pack.lock.yml ]]; then
23+
if [[ "$PACK_COMPILED" == true ]]; then
24+
continue
25+
fi
26+
echo "[+] Compiling Pack: $LANGUAGE"
27+
# install deps
28+
gh codeql pack install "$LANGUAGE"
29+
# compile / create pack
30+
gh codeql pack create "$LANGUAGE"
31+
32+
# if the version of the pack is changed, comment in the PR
33+
PUBLISHED_VERSION=$(gh api /orgs/advanced-security/packages/container/codeql-"$LANGUAGE"/versions --jq '.[0].metadata.container.tags[0]')
34+
CURRENT_VERSION=$(grep version "$LANGUAGE"/qlpack.yml | awk '{print $2}')
35+
36+
if [ "$PUBLISHED_VERSION" != "$CURRENT_VERSION" ]; then
37+
echo "[+] New version of pack detected: $PUBLISHED_VERSION (pub) != $CURRENT_VERSION (cur)"
38+
39+
comment="New version of pack \`advanced-security/codeql-$LANGUAGE\` will be created on merge: \`$PUBLISHED_VERSION\`->\`$CURRENT_VERSION\`"
40+
41+
if [[ ! $(gh pr view "$PR_NUMBER" --json comments --jq '.comments.[].body' | grep "$comment") ]]; then
42+
echo "[+] Commenting on PR"
43+
gh pr comment "$PR_NUMBER" \
44+
--body "$comment"
45+
46+
fi
47+
48+
fi
49+
50+
PACK_COMPILED=true
51+
52+
fi
53+
done
54+
55+
echo "[+] Complete"

‎.github/scripts/pr-tests.sh

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
4+
PR_NUMBER=${1}
5+
LANGUAGE=${2}
6+
7+
if [[ ! -d ./${LANGUAGE}/test/ ]]; then
8+
echo "[!] No tests found for $LANGUAGE, skipping"
9+
exit 0
10+
fi
11+
12+
echo "[+] Cloning CodeQL"
13+
gh repo clone github/codeql
14+
15+
echo "[+] Compiling all queries in $LANGUAGE"
16+
gh codeql query compile \
17+
--threads=0 --check-only \
18+
--search-path=./codeql --additional-packs=./codeql:./codeql/misc \
19+
"./$LANGUAGE/"
20+
21+
for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
22+
if [[ ! -f "$file" ]]; then
23+
continue
24+
fi
25+
26+
# if a change in the test folder is detected (only for the current language)
27+
if [[ "$file" == $LANGUAGE/test/** ]]; then
28+
echo "[+] Test $file changed"
29+
TEST_DIR=$(dirname "$file")
30+
# run tests in the folder the change occured in
31+
gh codeql test run \
32+
--additional-packs=./ --additional-packs=./codeql \
33+
"$TEST_DIR"
34+
35+
# if the files is a query file .ql or .qll
36+
elif [[ "$file" == $LANGUAGE/**.ql ]] || [[ "$file" == $LANGUAGE/**.qll ]] ; then
37+
echo "[+] Query $file changed (in $LANGUAGE)"
38+
39+
SRC_DIR=$(realpath --relative-to="./${LANGUAGE}/src" "$file")
40+
TEST_DIR=./${LANGUAGE}/test/${SRC_DIR}
41+
42+
if [[ -d "$TEST_DIR" ]]; then
43+
echo "[+] Running tests for $file -> $TEST_DIR"
44+
gh codeql test run \
45+
--additional-packs=./ --additional-packs=./codeql \
46+
"$TEST_DIR"
47+
48+
else
49+
echo "[!] No tests found at $TEST_DIR"
50+
fi
51+
# if language lib folder is modified
52+
elif [[ "$file" == $LANGUAGE/lib/** ]]; then
53+
echo "[+] Library changed, running all tests in $LANGUAGE"
54+
TEST_DIR=./${LANGUAGE}/test/
55+
56+
if [[ -d "$TEST_DIR" ]]; then
57+
echo "[+] Running tests for $file -> $TEST_DIR"
58+
gh codeql test run \
59+
--additional-packs=./ --additional-packs=./codeql \
60+
"$TEST_DIR"
61+
else
62+
echo "[!] No tests found for $file (in $LANGUAGE)"
63+
fi
64+
65+
fi
66+
67+
done
68+
69+
echo "[+] Complete"

0 commit comments

Comments
 (0)