check-submodule-pointers.yml

name: Check submodule pointers

on:
  workflow_dispatch:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '42 12 * * *'

jobs:
  check-submodules:
    runs-on: ubuntu-latest
    if: github.repository == 'github/vscode-codeql-starter'
    steps:
      - uses: actions/checkout@v2

      - name: Compare submodule pointers to lgtm.com branch
        env: 
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
            CODEQL_ACTUAL_SHA="$(git rev-parse @:./ql)"
            CODEQL_EXPECTED_SHA="$(gh api repos/github/codeql/git/ref/heads/lgtm.com --jq '.object.sha')"
            echo "The ql submodule currently points to $CODEQL_ACTUAL_SHA. The tip of the lgtm.com branch of github/codeql is $CODEQL_EXPECTED_SHA."
            if [ "$CODEQL_EXPECTED_SHA" != "$CODEQL_ACTUAL_SHA" ]; then 
              echo "::error:: The ql submodule is out of date with the lgtm.com branch of github/codeql. Expected $CODEQL_EXPECTED_SHA, found $CODEQL_ACTUAL_SHA."
              exit 1
            fi

            CODEQL_GO_ACTUAL_SHA="$(git rev-parse @:./codeql-go)"
            CODEQL_GO_EXPECTED_SHA="$(gh api repos/github/codeql-go/git/ref/heads/lgtm.com --jq '.object.sha')"
            echo "The codeql-go submodule currently points to $CODEQL_GO_ACTUAL_SHA. The tip of the lgtm.com branch of github/codeql-go is $CODEQL_GO_EXPECTED_SHA."
            if [ "$CODEQL_GO_EXPECTED_SHA" != "$CODEQL_GO_ACTUAL_SHA" ]; then 
              echo "::error:: The codeql-go submodule is out of date with the lgtm.com branch of github/codeql-go. Expected $CODEQL_GO_EXPECTED_SHA, found $CODEQL_GO_ACTUAL_SHA."
              exit 1
            fi