Skip to content

Commit ebfa6b1

Browse files
GeekMasherGeekMasher
authored
Merge pull request #103 from GitHubSecurityLab/pincodeqlinpublish
Pin CodeQL in the publish workflow.
2 parents 8fbaefb + 7d70d94 commit ebfa6b1

File tree

1 file changed

+86
-53
lines changed

1 file changed

+86
-53
lines changed

‎.github/workflows/publish.yml

+86-53
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,10 @@ on:
55
branches: [main]
66
workflow_dispatch:
77

8-
jobs:
8+
env:
9+
CODEQL_CLI_VERSION: 2.20.1
910

11+
jobs:
1012
queries:
1113
runs-on: ubuntu-latest
1214

@@ -22,28 +24,36 @@ jobs:
2224
steps:
2325
- uses: actions/checkout@v4
2426

25-
- name: Initialize CodeQL
26-
run: |
27-
VERSION="$(find "${{ runner.tool_cache }}/CodeQL/" -maxdepth 1 -mindepth 1 -type d -print \
28-
| sort \
29-
| tail -n 1 \
30-
| tr -d '\n')"
31-
echo "$VERSION/x64/codeql" >> $GITHUB_PATH
32-
33-
- name: "Check and publish codeql-LANG-queries (src) pack"
27+
- name: Check codeql-LANG-queries (src) pack
28+
id: check_version
3429
env:
3530
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3631
run: |
3732
PUBLISHED_VERSION=$(gh api /orgs/githubsecuritylab/packages/container/codeql-${{ matrix.language }}-queries/versions --jq '.[0].metadata.container.tags[0]')
3833
CURRENT_VERSION=$(grep version ${{ matrix.language }}/src/qlpack.yml | awk '{print $2}')
3934
40-
echo "Published verion: $PUBLISHED_VERSION"
41-
echo "Local verion: $CURRENT_VERSION"
35+
echo "Published version: $PUBLISHED_VERSION"
36+
echo "Local version: $CURRENT_VERSION"
37+
4238
if [ "$PUBLISHED_VERSION" != "$CURRENT_VERSION" ]; then
43-
codeql pack install "${{ matrix.language }}/src"
44-
codeql pack publish "${{ matrix.language }}/src"
39+
echo "publish=true" >> $GITHUB_OUTPUT
4540
fi
4641
42+
- name: Setup CodeQL
43+
if: steps.check_version.outputs.publish == 'true'
44+
uses: ./.github/actions/install-codeql
45+
with:
46+
codeql-cli-version: ${{ env.CODEQL_CLI_VERSION }}
47+
48+
- name: Publish codeql-LANG-queries (src) pack.
49+
if: steps.check_version.outputs.publish == 'true'
50+
env:
51+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
52+
run: |
53+
echo "Publishing codeql-${{ matrix.language }}-queries."
54+
codeql pack install "${{ matrix.language }}/src"
55+
codeql pack publish "${{ matrix.language }}/src"
56+
4757
library:
4858
runs-on: ubuntu-latest
4959

@@ -59,28 +69,36 @@ jobs:
5969
steps:
6070
- uses: actions/checkout@v4
6171

62-
- name: Initialize CodeQL
63-
run: |
64-
VERSION="$(find "${{ runner.tool_cache }}/CodeQL/" -maxdepth 1 -mindepth 1 -type d -print \
65-
| sort \
66-
| tail -n 1 \
67-
| tr -d '\n')"
68-
echo "$VERSION/x64/codeql" >> $GITHUB_PATH
69-
70-
- name: "Check and publish codeql-LANG-libs (lib) pack"
72+
- name: Check codeql-LANG-libs (lib) pack
73+
id: check_version
7174
env:
7275
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
7376
run: |
7477
PUBLISHED_VERSION=$(gh api /orgs/githubsecuritylab/packages/container/codeql-${{ matrix.language }}-libs/versions --jq '.[0].metadata.container.tags[0]')
7578
CURRENT_VERSION=$(grep version ${{ matrix.language }}/lib/qlpack.yml | awk '{print $2}')
7679
77-
echo "Published verion: $PUBLISHED_VERSION"
78-
echo "Local verion: $CURRENT_VERSION"
80+
echo "Published version: $PUBLISHED_VERSION"
81+
echo "Local version: $CURRENT_VERSION"
82+
7983
if [ "$PUBLISHED_VERSION" != "$CURRENT_VERSION" ]; then
80-
codeql pack install "${{ matrix.language }}/lib"
81-
codeql pack publish "${{ matrix.language }}/lib"
84+
echo "publish=true" >> $GITHUB_OUTPUT
8285
fi
8386
87+
- name: Setup CodeQL
88+
if: steps.check_version.outputs.publish == 'true'
89+
uses: ./.github/actions/install-codeql
90+
with:
91+
codeql-cli-version: ${{ env.CODEQL_CLI_VERSION }}
92+
93+
- name: Publish codeql-LANG-libs (lib) pack
94+
if: steps.check_version.outputs.publish == 'true'
95+
env:
96+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
97+
run: |
98+
echo "Publishing codeql-${{ matrix.language }}-libs."
99+
codeql pack install "${{ matrix.language }}/lib"
100+
codeql pack publish "${{ matrix.language }}/lib"
101+
84102
extensions:
85103
runs-on: ubuntu-latest
86104

@@ -96,28 +114,36 @@ jobs:
96114
steps:
97115
- uses: actions/checkout@v4
98116

99-
- name: Initialize CodeQL
100-
run: |
101-
VERSION="$(find "${{ runner.tool_cache }}/CodeQL/" -maxdepth 1 -mindepth 1 -type d -print \
102-
| sort \
103-
| tail -n 1 \
104-
| tr -d '\n')"
105-
echo "$VERSION/x64/codeql" >> $GITHUB_PATH
106-
107-
- name: Check and publish codeql-LANG-extensions (ext) pack
117+
- name: Check codeql-LANG-extensions (ext) pack
118+
id: check_version
108119
env:
109120
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
110121
run: |
111122
PUBLISHED_VERSION=$(gh api /orgs/githubsecuritylab/packages/container/codeql-${{ matrix.language }}-extensions/versions --jq '.[0].metadata.container.tags[0]')
112123
CURRENT_VERSION=$(grep version ${{ matrix.language }}/ext/qlpack.yml | awk '{print $2}')
113124
114-
echo "Published verion: $PUBLISHED_VERSION"
115-
echo "Local verion: $CURRENT_VERSION"
125+
echo "Published version: $PUBLISHED_VERSION"
126+
echo "Local version: $CURRENT_VERSION"
116127
if [ "$PUBLISHED_VERSION" != "$CURRENT_VERSION" ]; then
117-
codeql pack install "${{ matrix.language }}/ext"
118-
codeql pack publish "${{ matrix.language }}/ext"
128+
echo "publish=true" >> $GITHUB_OUTPUT
119129
fi
120130
131+
- name: Setup CodeQL
132+
if: steps.check_version.outputs.publish == 'true'
133+
uses: ./.github/actions/install-codeql
134+
with:
135+
codeql-cli-version: ${{ env.CODEQL_CLI_VERSION }}
136+
137+
- name: Publish codeql-LANG-extensions (ext) pack
138+
if: steps.check_version.outputs.publish == 'true'
139+
env:
140+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
141+
run: |
142+
echo "Publishing codeql-${{ matrix.language }}-extensions."
143+
codeql pack install "${{ matrix.language }}/ext"
144+
codeql pack publish "${{ matrix.language }}/ext"
145+
146+
121147
library_sources_extensions:
122148
runs-on: ubuntu-latest
123149

@@ -133,24 +159,31 @@ jobs:
133159
steps:
134160
- uses: actions/checkout@v4
135161

136-
- name: Initialize CodeQL
137-
run: |
138-
VERSION="$(find "${{ runner.tool_cache }}/CodeQL/" -maxdepth 1 -mindepth 1 -type d -print \
139-
| sort \
140-
| tail -n 1 \
141-
| tr -d '\n')"
142-
echo "$VERSION/x64/codeql" >> $GITHUB_PATH
143-
144-
- name: Check and publish codeql-LANG-library-sources (ext-library-sources) pack
162+
- name: Check codeql-LANG-library-sources (ext-library-sources) pack
163+
id: check_version
145164
env:
146165
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
147166
run: |
148167
PUBLISHED_VERSION=$(gh api /orgs/githubsecuritylab/packages/container/codeql-${{ matrix.language }}-library-sources/versions --jq '.[0].metadata.container.tags[0]')
149168
CURRENT_VERSION=$(grep version ${{ matrix.language }}/ext-library-sources/qlpack.yml | awk '{print $2}')
150169
151-
echo "Published verion: $PUBLISHED_VERSION"
152-
echo "Local verion: $CURRENT_VERSION"
170+
echo "Published version: $PUBLISHED_VERSION"
171+
echo "Local version: $CURRENT_VERSION"
153172
if [ "$PUBLISHED_VERSION" != "$CURRENT_VERSION" ]; then
154-
codeql pack install "${{ matrix.language }}/ext-library-sources"
155-
codeql pack publish "${{ matrix.language }}/ext-library-sources"
173+
echo "publish=true" >> $GITHUB_OUTPUT
156174
fi
175+
176+
- name: Setup CodeQL
177+
if: steps.check_version.outputs.publish == 'true'
178+
uses: ./.github/actions/install-codeql
179+
with:
180+
codeql-cli-version: ${{ env.CODEQL_CLI_VERSION }}
181+
182+
- name: Publish codeql-LANG-library-sources (ext-library-sources) pack
183+
if: steps.check_version.outputs.publish == 'true'
184+
env:
185+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
186+
run: |
187+
echo "Publishing codeql-${{ matrix.language }}-library-sources."
188+
codeql pack install "${{ matrix.language }}/ext-library-sources"
189+
codeql pack publish "${{ matrix.language }}/ext-library-sources"

0 commit comments

Comments
 (0)