Skip to content

Commit 4ce95a3

Browse files
lcarteylcartey
authored
Merge branch 'main' into dependabot/pip/scripts/jinja2-3.1.3
2 parents 2ba43b3 + 373b793 commit 4ce95a3

File tree

660 files changed

+8778
-2330
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

660 files changed

+8778
-2330
lines changed

‎.github/actions/check-permissions/action.yml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Check current actor permissions
2+
description: |
3+
Checks whether the current actor has the specified permssions
4+
inputs:
5+
minimum-permission:
6+
description: |
7+
The minimum required permission. One of: read, write, admin
8+
required: true
9+
outputs:
10+
has-permission:
11+
description: "Whether the actor had the minimum required permission"
12+
value: ${{ steps.check-permission.outputs.has-permission }}
13+
14+
runs:
15+
using: composite
16+
steps:
17+
- uses: actions/github-script@v7
18+
id: check-permission
19+
env:
20+
INPUT_MINIMUM-PERMISSION: ${{ inputs.minimum-permission }}
21+
with:
22+
script: |
23+
// Valid permissions are none, read, write, admin (legacy base permissions)
24+
const permissionsRanking = ["none", "read", "write", "admin"];
25+
26+
// Note: core.getInput doesn't work by default in a composite action - in this case
27+
// it would try to fetch the input to the github-script instead of the action
28+
// itself. Instead, we set the appropriate magic env var with the actions input.
29+
// See: https://github.com/actions/runner/issues/665
30+
const minimumPermission = core.getInput('minimum-permission');
31+
if (!permissionsRanking.includes(minimumPermission)) {
32+
core.setFailed(`Invalid minimum permission: ${minimumPermission}`);
33+
return;
34+
}
35+
36+
const { data : { permission : actorPermission } } = await github.rest.repos.getCollaboratorPermissionLevel({
37+
owner: context.repo.owner,
38+
repo: context.repo.repo,
39+
username: context.actor
40+
});
41+
42+
// Confirm whether the actor permission is at least the selected permission
43+
const hasPermission = permissionsRanking.indexOf(minimumPermission) <= permissionsRanking.indexOf(actorPermission) ? "1" : "";
44+
core.setOutput('has-permission', hasPermission);
45+
if (!hasPermission) {
46+
core.info(`Current actor (${context.actor}) does not have the minimum required permission '${minimumPermission}' (has '${actorPermission}')`);
47+
} else {
48+
core.info(`Current actor (${context.actor}) has the minimum required permission '${minimumPermission}' (has '${actorPermission}')`);
49+
}

‎.github/dependabot.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
version: 2
2+
updates:
3+
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
# Check for updates to GitHub Actions every week
8+
interval: "weekly"

‎.github/workflows/code-scanning-pack-gen.yml

Lines changed: 27 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ on:
88
- main
99
- next
1010
- "rc/**"
11-
1211
push:
1312
branches:
1413
- main
@@ -47,7 +46,7 @@ jobs:
4746

4847
- name: Cache CodeQL
4948
id: cache-codeql
50-
uses: actions/cache@v2.1.3
49+
uses: actions/cache@v4
5150
with:
5251
path: ${{ github.workspace }}/codeql_home
5352
key: codeql-home-${{ matrix.os }}-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library }}
@@ -98,15 +97,36 @@ jobs:
9897
CODEQL_HOME: ${{ github.workspace }}/codeql_home
9998
run: |
10099
PATH=$PATH:$CODEQL_HOME/codeql
101-
102-
codeql query compile --precompile --threads 0 cpp
103-
codeql query compile --precompile --threads 0 c
100+
# Precompile all queries, and use a compilation cache larger than default
101+
# to ensure we cache all the queries for later steps
102+
codeql query compile --precompile --threads 0 --compilation-cache-size=1024 cpp c
104103
105104
cd ..
106-
zip -r codeql-coding-standards/code-scanning-cpp-query-pack.zip codeql-coding-standards/c/ codeql-coding-standards/cpp/ codeql-coding-standards/.codeqlmanifest.json codeql-coding-standards/supported_codeql_configs.json codeql-coding-standards/scripts/configuration codeql-coding-standards/scripts/reports codeql-coding-standards/scripts/shared codeql-coding-standards/scripts/guideline_recategorization codeql-coding-standards/scripts/shared codeql-coding-standards/scripts/schemas
105+
zip -r codeql-coding-standards/code-scanning-cpp-query-pack.zip codeql-coding-standards/c/ codeql-coding-standards/cpp/ codeql-coding-standards/.codeqlmanifest.json codeql-coding-standards/supported_codeql_configs.json codeql-coding-standards/scripts/configuration codeql-coding-standards/scripts/reports codeql-coding-standards/scripts/shared codeql-coding-standards/scripts/guideline_recategorization codeql-coding-standards/schemas
107106
108107
- name: Upload GHAS Query Pack
109-
uses: actions/upload-artifact@v2
108+
uses: actions/upload-artifact@v4
110109
with:
111110
name: code-scanning-cpp-query-pack.zip
112111
path: code-scanning-cpp-query-pack.zip
112+
113+
- name: Create qlpack bundles
114+
env:
115+
CODEQL_HOME: ${{ github.workspace }}/codeql_home
116+
run: |
117+
PATH=$PATH:$CODEQL_HOME/codeql
118+
119+
codeql pack bundle --output=common-cpp-coding-standards.tgz cpp/common/src
120+
codeql pack bundle --output=common-c-coding-standards.tgz c/common/src
121+
codeql pack bundle --output=misra-c-coding-standards.tgz c/misra/src
122+
codeql pack bundle --output=cert-c-coding-standards.tgz c/cert/src
123+
codeql pack bundle --output=cert-cpp-coding-standards.tgz cpp/cert/src
124+
codeql pack bundle --output=autosar-cpp-coding-standards.tgz cpp/autosar/src
125+
codeql pack bundle --output=misra-cpp-coding-standards.tgz cpp/misra/src
126+
codeql pack bundle --output=report-coding-standards.tgz cpp/report/src
127+
128+
- name: Upload qlpack bundles
129+
uses: actions/upload-artifact@v4
130+
with:
131+
name: coding-standards-codeql-packs
132+
path: '*-coding-standards.tgz'

‎.github/workflows/codeql_unit_tests.yml

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ jobs:
4848
uses: actions/checkout@v4
4949

5050
- name: Install Python
51-
uses: actions/setup-python@v4
51+
uses: actions/setup-python@v5
5252
with:
5353
python-version: "3.9"
5454

@@ -57,7 +57,7 @@ jobs:
5757

5858
- name: Cache CodeQL
5959
id: cache-codeql
60-
uses: actions/cache@v3
60+
uses: actions/cache@v4
6161
with:
6262
# A list of files, directories, and wildcard patterns to cache and restore
6363
path: ${{github.workspace}}/codeql_home
@@ -151,7 +151,7 @@ jobs:
151151
file.close()
152152
153153
- name: Upload test results
154-
uses: actions/upload-artifact@v3
154+
uses: actions/upload-artifact@v4
155155
with:
156156
name: ${{ matrix.language }}-test-results-${{ runner.os }}-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library_ident }}
157157
path: |
@@ -160,11 +160,18 @@ jobs:
160160

161161
validate-test-results:
162162
name: Validate test results
163+
if: ${{ always() }}
163164
needs: run-test-suites
164165
runs-on: ubuntu-22.04
165166
steps:
167+
- name: Check if run-test-suites job failed to complete, if so fail
168+
if: ${{ needs.run-test-suites.result == 'failure' }}
169+
uses: actions/github-script@v3
170+
with:
171+
script: |
172+
core.setFailed('Test run job failed')
166173
- name: Collect test results
167-
uses: actions/download-artifact@v3
174+
uses: actions/download-artifact@v4
168175

169176
- name: Validate test results
170177
run: |

‎.github/workflows/dispatch-matrix-check.yml

Lines changed: 0 additions & 39 deletions
This file was deleted.

‎.github/workflows/dispatch-matrix-test-on-comment.yml

Lines changed: 29 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3,42 +3,45 @@ name: 🤖 Run Matrix Check (On Comment)
33
on:
44
issue_comment:
55
types: [created]
6-
branches:
7-
- main
8-
- "rc/**"
9-
- next
10-
116

127
jobs:
138
dispatch-matrix-check:
149
runs-on: ubuntu-22.04
1510
steps:
11+
- name: Checkout repository
12+
uses: actions/checkout@v4
1613

17-
- name: Test Variables
18-
shell: pwsh
19-
run: |
20-
Write-Host "Running as: ${{github.actor}}"
21-
22-
$actor = "${{github.actor}}"
23-
24-
$acl = @("jsinglet","mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "kraiouchkine")
25-
26-
if(-not ($actor -in $acl)){
27-
throw "Refusing to run workflow for user not in acl."
28-
}
29-
14+
- name: Check permission
15+
id: check-write-permission
16+
uses: ./.github/actions/check-permissions
17+
with:
18+
minimum-permission: "write"
3019

31-
- name: Dispatch Matrix Testing Job
32-
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') }}
33-
uses: peter-evans/repository-dispatch@v2
20+
- name: Generate token
21+
id: generate-token
22+
uses: actions/create-github-app-token@v1
3423
with:
35-
token: ${{ secrets.RELEASE_ENGINEERING_TOKEN }}
36-
repository: github/codeql-coding-standards-release-engineering
37-
event-type: matrix-test
38-
client-payload: '{"pr": "${{ github.event.issue.number }}"}'
24+
app-id: ${{ vars.AUTOMATION_APP_ID }}
25+
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
26+
owner: ${{ github.repository_owner }}
27+
repositories: "codeql-coding-standards-release-engineering"
28+
29+
- name: Invoke matrix testing job
30+
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') && steps.check-write-permission.outputs.has-permission }}
31+
env:
32+
ISSUE_NR: ${{ github.event.issue.number }}
33+
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
34+
run: |
35+
jq -n \
36+
--arg issue_nr "$ISSUE_NR" \
37+
'{"issue-nr": $issue_nr}' \
38+
| \
39+
gh workflow run pr-compiler-validation.yml \
40+
--json \
41+
-R github/codeql-coding-standards-release-engineering
3942
4043
- uses: actions/github-script@v6
41-
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') }}
44+
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') && steps.check-write-permission.outputs.has-permission }}
4245
with:
4346
script: |
4447
github.rest.issues.createComment({

‎.github/workflows/dispatch-release-performance-check.yml

Lines changed: 30 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3,46 +3,50 @@ name: 🏁 Run Release Performance Check
33
on:
44
issue_comment:
55
types: [created]
6-
branches:
7-
- main
8-
- "rc/**"
9-
- next
106

117
jobs:
128
dispatch-matrix-check:
139
runs-on: ubuntu-22.04
1410
steps:
11+
- name: Checkout repository
12+
uses: actions/checkout@v4
1513

16-
- name: Test Variables
17-
shell: pwsh
18-
run: |
19-
Write-Host "Running as: ${{github.actor}}"
20-
21-
$actor = "${{github.actor}}"
22-
23-
$acl = @("jsinglet","mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "kraiouchkine")
24-
25-
if(-not ($actor -in $acl)){
26-
throw "Refusing to run workflow for user not in acl."
27-
}
28-
29-
- name: Dispatch Performance Testing Job
30-
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') }}
31-
uses: peter-evans/repository-dispatch@v2
14+
- name: Check permission
15+
id: check-write-permission
16+
uses: ./.github/actions/check-permissions
3217
with:
33-
token: ${{ secrets.RELEASE_ENGINEERING_TOKEN }}
34-
repository: github/codeql-coding-standards-release-engineering
35-
event-type: performance-test
36-
client-payload: '{"pr": "${{ github.event.issue.number }}"}'
18+
minimum-permission: "write"
3719

20+
- name: Generate token
21+
id: generate-token
22+
uses: actions/create-github-app-token@v1
23+
with:
24+
app-id: ${{ vars.AUTOMATION_APP_ID }}
25+
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
26+
owner: ${{ github.repository_owner }}
27+
repositories: "codeql-coding-standards-release-engineering"
28+
29+
- name: Invoke performance test
30+
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') && steps.check-write-permission.outputs.has-permission }}
31+
env:
32+
ISSUE_NR: ${{ github.event.issue.number }}
33+
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
34+
run: |
35+
jq -n \
36+
--arg issue_nr "$ISSUE_NR" \
37+
'{"issue-nr": $issue_nr}' \
38+
| \
39+
gh workflow run pr-performance-testing.yml \
40+
--json \
41+
-R github/codeql-coding-standards-release-engineering
3842
3943
- uses: actions/github-script@v6
40-
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') }}
44+
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') && steps.check-write-permission.outputs.has-permission }}
4145
with:
4246
script: |
4347
github.rest.issues.createComment({
4448
issue_number: context.issue.number,
4549
owner: context.repo.owner,
4650
repo: context.repo.repo,
4751
body: '🏁 Beep Boop! Performance testing for this PR has been initiated. Please check back later for results. Note that the query package generation step must complete before testing will start so it might be a minute. <br><br> :bulb: If you do not hear back from me please check my status! **I will report even if I fail!**'
48-
})
52+
})

‎.github/workflows/extra-rule-validation.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
runs-on: ubuntu-22.04
2222
steps:
2323
- name: Checkout
24-
uses: actions/checkout@v2
24+
uses: actions/checkout@v4
2525

2626
- name: Check Rules
2727
shell: pwsh
@@ -33,7 +33,7 @@ jobs:
3333
runs-on: ubuntu-22.04
3434
steps:
3535
- name: Checkout
36-
uses: actions/checkout@v2
36+
uses: actions/checkout@v4
3737

3838
- name: Ensure CPP Shared Rules Have Valid Structure
3939
shell: pwsh
@@ -44,13 +44,13 @@ jobs:
4444
run: scripts/util/Test-SharedImplementationsHaveTestCases.ps1 -Language c -CIMode
4545

4646

47-
- uses: actions/upload-artifact@v3
47+
- uses: actions/upload-artifact@v4
4848
if: failure()
4949
with:
5050
name: missing-test-report.csv
5151
path: MissingTestReport*.csv
5252

53-
- uses: actions/upload-artifact@v3
53+
- uses: actions/upload-artifact@v4
5454
if: failure()
5555
with:
5656
name: test-report.csv

0 commit comments

Comments
 (0)