GeezerVison is showing github.com — docs/.github/workflows/sync-codeql-cli.yml at main · github/docs

Expand file tree

sync-codeql-cli.yml

Copy path

View runs

More file actions

Latest commit

History

126 lines (106 loc) · 5.18 KB

sync-codeql-cli.yml

Copy path

File metadata and controls

126 lines (106 loc) · 5.18 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

name: Sync CodeQL CLI

# Updates CodeQL CLI docs from github/semmle-code and opens a PR when files change.

# Run it manually about every two weeks to publish upstream changes.

on:

workflow_dispatch:

inputs:

SOURCE_BRANCH:

description: 'Branch to pull the source files from in the semmle-code repo.'

type: string

required: true

default: 'main'

permissions:

contents: write

pull-requests: write

# Cancel older syncs so stale CodeQL CLI data does not open older PRs.

concurrency:

group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'

cancel-in-progress: true

jobs:

generate-codeql-files:

if: github.repository == 'github/docs-internal'

runs-on: ubuntu-latest

steps:

- name: Checkout repository code

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

with:

# 'Create pull request' pushes with the PAT, so no token stays in .git/config.

persist-credentials: false

- name: Checkout semmle-code repo

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

with:

token: ${{ secrets.DOCS_BOT_PAT_BASE }}

repository: github/semmle-code

path: semmle-code

ref: ${{ inputs.SOURCE_BRANCH }}

- uses: ./.github/actions/node-npm-setup

- name: Get the semmle-code SHA being synced

id: semmle-code

run: |

cd semmle-code

OPENAPI_COMMIT_SHA=$(git rev-parse HEAD)

echo "OPENAPI_COMMIT_SHA=$OPENAPI_COMMIT_SHA" >> $GITHUB_OUTPUT

echo "Copied files from github/semmle-code repo. Commit SHA: $OPENAPI_COMMIT_SHA"

- name: Install pandoc

run: |

sudo apt-get purge --auto-remove pandoc

wget https://github.com/jgm/pandoc/releases/download/3.0.1/pandoc-3.0.1-1-amd64.deb

sudo dpkg -i pandoc-3.0.1-1-amd64.deb

pandoc -v

rm pandoc-3.0.1-1-amd64.deb

- name: Sync the CodeQL CLI data

run: |

npm run sync-codeql-cli

git status

echo "Deleting the cloned github/semmle-code repo..."

rm -rf semmle-code

- name: Create pull request

env:

GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}

# A PAT push triggers CI on the PR; GITHUB_TOKEN events do not start workflows.

GIT_CONFIG_COUNT: 1

GIT_CONFIG_KEY_0: url.https://x-access-token:${{ secrets.DOCS_BOT_PAT_BASE }}@github.com/.insteadOf

GIT_CONFIG_VALUE_0: https://github.com/

run: |

# Exit before branch creation so a no-op sync does not leave an orphan branch.

changes=$(git diff --name-only | wc -l)

untracked=$(git status --untracked-files --short | wc -l)

if [[ $changes -eq 0 ]] && [[ $untracked -eq 0 ]]; then

echo "There are no changes to commit after running 'npm run sync-codeql-cli'. Exiting..."

exit 0

git config --global user.name "docs-bot"

git config --global user.email "[email protected]"

branchname=codeql-cli-update-${{ steps.semmle-code.outputs.OPENAPI_COMMIT_SHA }}

labels="codeql-cli-pipeline,skip FR board,ready-for-doc-review,workflow-generated"

git checkout -b $branchname

git add .

git commit -m "Update CodeQL CLI data"

# Force-push reruns over failed attempts; this workflow exclusively owns these branches.

git push --force -u origin $branchname

# Skip PR creation when a prior run already opened one for this branch.

existing_pr=$(gh pr list --repo github/docs-internal --head "$branchname" --json number --jq '.[0].number')

if [[ -n "$existing_pr" ]]; then

echo "Pull request #$existing_pr already exists for branch $branchname. Skipping PR creation."

# The prior run may have failed before it applied labels.

gh pr edit "$existing_pr" --repo github/docs-internal --add-label "$labels"

exit 0

echo "Creating pull request..."

gh pr create \

--title "Update CodeQL CLI manual" \

--body '👋 humans. This PR updates the CodeQL CLI manual Markdown pages with the latest changes in preparation for the next **CodeQL CLI** release.

This will be reviewed and merged by the Code scanning and GHAS focus team as part of the release of CodeQL CLI. (Synced from semmle-code@${{ steps.semmle-code.outputs.OPENAPI_COMMIT_SHA }})

If CI does not pass or other problems arise, contact #technical-content on slack.' \

--repo github/docs-internal \

--label "$labels"

- uses: ./.github/actions/create-workflow-failure-issue

id: create-failure-issue

if: ${{ failure() && github.event_name != 'workflow_dispatch' }}

with:

token: ${{ secrets.DOCS_BOT_PAT_BASE }}

- uses: ./.github/actions/slack-alert

if: ${{ failure() && github.event_name != 'workflow_dispatch' }}

with:

slack_token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}

issue_url: ${{ steps.create-failure-issue.outputs.issue_url }}