mirror of
https://github.com/github/codeql-action.git
synced 2026-01-06 14:40:10 +08:00
Refactoring: Separate out workflow related functionality
No semantic changes.
This commit is contained in:
Henry Mercer
@@ -2,20 +2,12 @@ import * as fs from "fs";
|
||||
import * as path from "path";
|
||||
|
||||
import test from "ava";
|
||||
import * as yaml from "js-yaml";
|
||||
import * as sinon from "sinon";
|
||||
|
||||
import * as actionsutil from "./actions-util";
|
||||
import { setupActionsVars, setupTests } from "./testing-utils";
|
||||
import { initializeEnvironment, withTmpDir } from "./util";
|
||||
|
||||
function errorCodes(
|
||||
actual: actionsutil.CodedError[],
|
||||
expected: actionsutil.CodedError[]
|
||||
): [string[], string[]] {
|
||||
return [actual.map(({ code }) => code), expected.map(({ code }) => code)];
|
||||
}
|
||||
|
||||
setupTests(test);
|
||||
|
||||
test("getRef() throws on the empty string", async (t) => {
|
||||
@@ -188,536 +180,6 @@ test("computeAutomationID()", async (t) => {
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on is empty", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({ on: {} });
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is an array missing pull_request", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({ on: ["push"] });
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is an array missing push", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({ on: ["pull_request"] });
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(errors, [actionsutil.WorkflowErrors.MissingPushHook])
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is valid", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({
|
||||
on: ["push", "pull_request"],
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is a valid superset", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({
|
||||
on: ["push", "pull_request", "schedule"],
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push should not have a path", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({
|
||||
on: {
|
||||
push: { branches: ["main"], paths: ["test/*"] },
|
||||
pull_request: { branches: ["main"] },
|
||||
},
|
||||
});
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(errors, [actionsutil.WorkflowErrors.PathsSpecified])
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is a correct object", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({
|
||||
on: { push: { branches: ["main"] }, pull_request: { branches: ["main"] } },
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.pull_requests is a string", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({
|
||||
on: { push: { branches: ["main"] }, pull_request: { branches: "*" } },
|
||||
});
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches])
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.pull_requests is a string and correct", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({
|
||||
on: { push: { branches: "*" }, pull_request: { branches: "*" } },
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is correct with empty objects", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors(
|
||||
yaml.load(`
|
||||
on:
|
||||
push:
|
||||
pull_request:
|
||||
`) as actionsutil.Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is mismatched", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({
|
||||
on: {
|
||||
push: { branches: ["main"] },
|
||||
pull_request: { branches: ["feature"] },
|
||||
},
|
||||
});
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches])
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is not mismatched", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({
|
||||
on: {
|
||||
push: { branches: ["main", "feature"] },
|
||||
pull_request: { branches: ["main"] },
|
||||
},
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is mismatched for pull_request", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({
|
||||
on: {
|
||||
push: { branches: ["main"] },
|
||||
pull_request: { branches: ["main", "feature"] },
|
||||
},
|
||||
});
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches])
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() for a range of malformed workflows", (t) => {
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors({
|
||||
on: {
|
||||
push: 1,
|
||||
pull_request: 1,
|
||||
},
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors({
|
||||
on: 1,
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: 1,
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: [1],
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: { 1: 1 },
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: { test: 1 },
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: { test: [1] },
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: { test: { steps: 1 } },
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: { test: { steps: [{ notrun: "git checkout HEAD^2" }] } },
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: { test: [undefined] },
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(1 as any), []));
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors({
|
||||
on: {
|
||||
push: {
|
||||
branches: 1,
|
||||
},
|
||||
pull_request: {
|
||||
branches: 1,
|
||||
},
|
||||
},
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.pull_request for every branch but push specifies branches", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on:
|
||||
push:
|
||||
branches: ["main"]
|
||||
pull_request:
|
||||
`) as actionsutil.Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches])
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.pull_request for wildcard branches", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({
|
||||
on: {
|
||||
push: { branches: ["feature/*"] },
|
||||
pull_request: { branches: "feature/moose" },
|
||||
},
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.pull_request for mismatched wildcard branches", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors({
|
||||
on: {
|
||||
push: { branches: ["feature/moose"] },
|
||||
pull_request: { branches: "feature/*" },
|
||||
},
|
||||
});
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches])
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when HEAD^2 is checked out", (t) => {
|
||||
process.env.GITHUB_JOB = "test";
|
||||
|
||||
const errors = actionsutil.getWorkflowErrors({
|
||||
on: ["push", "pull_request"],
|
||||
jobs: { test: { steps: [{ run: "git checkout HEAD^2" }] } },
|
||||
});
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(errors, [actionsutil.WorkflowErrors.CheckoutWrongHead])
|
||||
);
|
||||
});
|
||||
|
||||
test("formatWorkflowErrors() when there is one error", (t) => {
|
||||
const message = actionsutil.formatWorkflowErrors([
|
||||
actionsutil.WorkflowErrors.CheckoutWrongHead,
|
||||
]);
|
||||
t.true(message.startsWith("1 issue was detected with this workflow:"));
|
||||
});
|
||||
|
||||
test("formatWorkflowErrors() when there are multiple errors", (t) => {
|
||||
const message = actionsutil.formatWorkflowErrors([
|
||||
actionsutil.WorkflowErrors.CheckoutWrongHead,
|
||||
actionsutil.WorkflowErrors.PathsSpecified,
|
||||
]);
|
||||
t.true(message.startsWith("2 issues were detected with this workflow:"));
|
||||
});
|
||||
|
||||
test("formatWorkflowCause() with no errors", (t) => {
|
||||
const message = actionsutil.formatWorkflowCause([]);
|
||||
|
||||
t.deepEqual(message, undefined);
|
||||
});
|
||||
|
||||
test("formatWorkflowCause()", (t) => {
|
||||
const message = actionsutil.formatWorkflowCause([
|
||||
actionsutil.WorkflowErrors.CheckoutWrongHead,
|
||||
actionsutil.WorkflowErrors.PathsSpecified,
|
||||
]);
|
||||
|
||||
t.deepEqual(message, "CheckoutWrongHead,PathsSpecified");
|
||||
t.deepEqual(actionsutil.formatWorkflowCause([]), undefined);
|
||||
});
|
||||
|
||||
test("patternIsSuperset()", (t) => {
|
||||
t.false(actionsutil.patternIsSuperset("main-*", "main"));
|
||||
t.true(actionsutil.patternIsSuperset("*", "*"));
|
||||
t.true(actionsutil.patternIsSuperset("*", "main-*"));
|
||||
t.false(actionsutil.patternIsSuperset("main-*", "*"));
|
||||
t.false(actionsutil.patternIsSuperset("main-*", "main"));
|
||||
t.true(actionsutil.patternIsSuperset("main", "main"));
|
||||
t.false(actionsutil.patternIsSuperset("*", "feature/*"));
|
||||
t.true(actionsutil.patternIsSuperset("**", "feature/*"));
|
||||
t.false(actionsutil.patternIsSuperset("feature-*", "**"));
|
||||
t.false(actionsutil.patternIsSuperset("a/**/c", "a/**/d"));
|
||||
t.false(actionsutil.patternIsSuperset("a/**/c", "a/**"));
|
||||
t.true(actionsutil.patternIsSuperset("a/**", "a/**/c"));
|
||||
t.true(actionsutil.patternIsSuperset("a/**/c", "a/main-**/c"));
|
||||
t.false(actionsutil.patternIsSuperset("a/**/b/**/c", "a/**/d/**/c"));
|
||||
t.true(actionsutil.patternIsSuperset("a/**/b/**/c", "a/**/b/c/**/c"));
|
||||
t.true(actionsutil.patternIsSuperset("a/**/b/**/c", "a/**/b/d/**/c"));
|
||||
t.false(actionsutil.patternIsSuperset("a/**/c/d/**/c", "a/**/b/**/c"));
|
||||
t.false(actionsutil.patternIsSuperset("a/main-**/c", "a/**/c"));
|
||||
t.true(
|
||||
actionsutil.patternIsSuperset(
|
||||
"/robin/*/release/*",
|
||||
"/robin/moose/release/goose"
|
||||
)
|
||||
);
|
||||
t.false(
|
||||
actionsutil.patternIsSuperset(
|
||||
"/robin/moose/release/goose",
|
||||
"/robin/*/release/*"
|
||||
)
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when branches contain dots", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors(
|
||||
yaml.load(`
|
||||
on:
|
||||
push:
|
||||
branches: [4.1, master]
|
||||
pull_request:
|
||||
# The branches below must be a subset of the branches above
|
||||
branches: [4.1, master]
|
||||
`) as actionsutil.Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push has a trailing comma", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on:
|
||||
push:
|
||||
branches: [master, ]
|
||||
pull_request:
|
||||
# The branches below must be a subset of the branches above
|
||||
branches: [master]
|
||||
`) as actionsutil.Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() should only report the current job's CheckoutWrongHead", (t) => {
|
||||
process.env.GITHUB_JOB = "test";
|
||||
|
||||
const errors = actionsutil.getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
pull_request:
|
||||
# The branches below must be a subset of the branches above
|
||||
branches: [master]
|
||||
jobs:
|
||||
test:
|
||||
steps:
|
||||
- run: "git checkout HEAD^2"
|
||||
|
||||
test2:
|
||||
steps:
|
||||
- run: "git checkout HEAD^2"
|
||||
|
||||
test3:
|
||||
steps: []
|
||||
`) as actionsutil.Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(errors, [actionsutil.WorkflowErrors.CheckoutWrongHead])
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() should not report a different job's CheckoutWrongHead", (t) => {
|
||||
process.env.GITHUB_JOB = "test3";
|
||||
|
||||
const errors = actionsutil.getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
pull_request:
|
||||
# The branches below must be a subset of the branches above
|
||||
branches: [master]
|
||||
jobs:
|
||||
test:
|
||||
steps:
|
||||
- run: "git checkout HEAD^2"
|
||||
|
||||
test2:
|
||||
steps:
|
||||
- run: "git checkout HEAD^2"
|
||||
|
||||
test3:
|
||||
steps: []
|
||||
`) as actionsutil.Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on is missing", (t) => {
|
||||
const errors = actionsutil.getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
`) as actionsutil.Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() with a different on setup", (t) => {
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on: "workflow_dispatch"
|
||||
`) as actionsutil.Workflow
|
||||
),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on: [workflow_dispatch]
|
||||
`) as actionsutil.Workflow
|
||||
),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on:
|
||||
workflow_dispatch: {}
|
||||
`) as actionsutil.Workflow
|
||||
),
|
||||
[]
|
||||
)
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() should not report an error if PRs are totally unconfigured", (t) => {
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
`) as actionsutil.Workflow
|
||||
),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
actionsutil.getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on: ["push"]
|
||||
`) as actionsutil.Workflow
|
||||
),
|
||||
[]
|
||||
)
|
||||
);
|
||||
});
|
||||
|
||||
test("initializeEnvironment", (t) => {
|
||||
initializeEnvironment("1.2.3");
|
||||
t.deepEqual(process.env.CODEQL_ACTION_VERSION, "1.2.3");
|
||||
|
||||
@@ -5,7 +5,6 @@ import * as path from "path";
|
||||
import * as core from "@actions/core";
|
||||
import * as toolrunner from "@actions/exec/lib/toolrunner";
|
||||
import * as safeWhich from "@chrisgavin/safe-which";
|
||||
import * as yaml from "js-yaml";
|
||||
|
||||
import * as api from "./api-client";
|
||||
import { Config } from "./config-utils";
|
||||
@@ -20,6 +19,7 @@ import {
|
||||
isInTestMode,
|
||||
UserError,
|
||||
} from "./util";
|
||||
import { getWorkflowPath } from "./workflow";
|
||||
|
||||
// eslint-disable-next-line import/no-commonjs
|
||||
const pkg = require("../package.json");
|
||||
@@ -156,288 +156,6 @@ export const determineMergeBaseCommitOid = async function (): Promise<
|
||||
}
|
||||
};
|
||||
|
||||
interface WorkflowJobStep {
|
||||
run: any;
|
||||
}
|
||||
|
||||
interface WorkflowJob {
|
||||
steps?: WorkflowJobStep[];
|
||||
}
|
||||
|
||||
interface WorkflowTrigger {
|
||||
branches?: string[] | string;
|
||||
paths?: string[];
|
||||
}
|
||||
|
||||
// on: {} then push/pull_request are undefined
|
||||
// on:
|
||||
// push:
|
||||
// pull_request:
|
||||
// then push/pull_request are null
|
||||
interface WorkflowTriggers {
|
||||
push?: WorkflowTrigger | null;
|
||||
pull_request?: WorkflowTrigger | null;
|
||||
}
|
||||
|
||||
export interface Workflow {
|
||||
jobs?: { [key: string]: WorkflowJob };
|
||||
on?: string | string[] | WorkflowTriggers;
|
||||
}
|
||||
|
||||
function isObject(o: unknown): o is object {
|
||||
return o !== null && typeof o === "object";
|
||||
}
|
||||
|
||||
const GLOB_PATTERN = new RegExp("(\\*\\*?)");
|
||||
|
||||
function escapeRegExp(string) {
|
||||
return string.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); // $& means the whole matched string
|
||||
}
|
||||
|
||||
function patternToRegExp(value) {
|
||||
return new RegExp(
|
||||
`^${value
|
||||
.toString()
|
||||
.split(GLOB_PATTERN)
|
||||
.reduce(function (arr, cur) {
|
||||
if (cur === "**") {
|
||||
arr.push(".*?");
|
||||
} else if (cur === "*") {
|
||||
arr.push("[^/]*?");
|
||||
} else if (cur) {
|
||||
arr.push(escapeRegExp(cur));
|
||||
}
|
||||
return arr;
|
||||
}, [])
|
||||
.join("")}$`
|
||||
);
|
||||
}
|
||||
|
||||
// this function should return true if patternA is a superset of patternB
|
||||
// e.g: * is a superset of main-* but main-* is not a superset of *.
|
||||
export function patternIsSuperset(patternA: string, patternB: string): boolean {
|
||||
return patternToRegExp(patternA).test(patternB);
|
||||
}
|
||||
|
||||
function branchesToArray(branches?: string | null | string[]): string[] | "**" {
|
||||
if (typeof branches === "string") {
|
||||
return [branches];
|
||||
}
|
||||
if (Array.isArray(branches)) {
|
||||
if (branches.length === 0) {
|
||||
return "**";
|
||||
}
|
||||
return branches;
|
||||
}
|
||||
return "**";
|
||||
}
|
||||
export interface CodedError {
|
||||
message: string;
|
||||
code: string;
|
||||
}
|
||||
|
||||
function toCodedErrors<T>(errors: T): Record<keyof T, CodedError> {
|
||||
return Object.entries(errors).reduce((acc, [key, value]) => {
|
||||
acc[key] = { message: value, code: key };
|
||||
return acc;
|
||||
}, {} as Record<keyof T, CodedError>);
|
||||
}
|
||||
|
||||
// code to send back via status report
|
||||
// message to add as a warning annotation to the run
|
||||
export const WorkflowErrors = toCodedErrors({
|
||||
MismatchedBranches: `Please make sure that every branch in on.pull_request is also in on.push so that Code Scanning can compare pull requests against the state of the base branch.`,
|
||||
MissingPushHook: `Please specify an on.push hook so that Code Scanning can compare pull requests against the state of the base branch.`,
|
||||
PathsSpecified: `Using on.push.paths can prevent Code Scanning annotating new alerts in your pull requests.`,
|
||||
PathsIgnoreSpecified: `Using on.push.paths-ignore can prevent Code Scanning annotating new alerts in your pull requests.`,
|
||||
CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
|
||||
});
|
||||
|
||||
export function getWorkflowErrors(doc: Workflow): CodedError[] {
|
||||
const errors: CodedError[] = [];
|
||||
|
||||
const jobName = process.env.GITHUB_JOB;
|
||||
|
||||
if (jobName) {
|
||||
const job = doc?.jobs?.[jobName];
|
||||
|
||||
const steps = job?.steps;
|
||||
|
||||
if (Array.isArray(steps)) {
|
||||
for (const step of steps) {
|
||||
// this was advice that we used to give in the README
|
||||
// we actually want to run the analysis on the merge commit
|
||||
// to produce results that are more inline with expectations
|
||||
// (i.e: this is what will happen if you merge this PR)
|
||||
// and avoid some race conditions
|
||||
if (step?.run === "git checkout HEAD^2") {
|
||||
errors.push(WorkflowErrors.CheckoutWrongHead);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
let missingPush = false;
|
||||
|
||||
if (doc.on === undefined) {
|
||||
// this is not a valid config
|
||||
} else if (typeof doc.on === "string") {
|
||||
if (doc.on === "pull_request") {
|
||||
missingPush = true;
|
||||
}
|
||||
} else if (Array.isArray(doc.on)) {
|
||||
const hasPush = doc.on.includes("push");
|
||||
const hasPullRequest = doc.on.includes("pull_request");
|
||||
if (hasPullRequest && !hasPush) {
|
||||
missingPush = true;
|
||||
}
|
||||
} else if (isObject(doc.on)) {
|
||||
const hasPush = Object.prototype.hasOwnProperty.call(doc.on, "push");
|
||||
const hasPullRequest = Object.prototype.hasOwnProperty.call(
|
||||
doc.on,
|
||||
"pull_request"
|
||||
);
|
||||
|
||||
if (!hasPush && hasPullRequest) {
|
||||
missingPush = true;
|
||||
}
|
||||
if (hasPush && hasPullRequest) {
|
||||
const paths = doc.on.push?.paths;
|
||||
// if you specify paths or paths-ignore you can end up with commits that have no baseline
|
||||
// if they didn't change any files
|
||||
// currently we cannot go back through the history and find the most recent baseline
|
||||
if (Array.isArray(paths) && paths.length > 0) {
|
||||
errors.push(WorkflowErrors.PathsSpecified);
|
||||
}
|
||||
const pathsIgnore = doc.on.push?.["paths-ignore"];
|
||||
if (Array.isArray(pathsIgnore) && pathsIgnore.length > 0) {
|
||||
errors.push(WorkflowErrors.PathsIgnoreSpecified);
|
||||
}
|
||||
}
|
||||
|
||||
// if doc.on.pull_request is null that means 'all branches'
|
||||
// if doc.on.pull_request is undefined that means 'off'
|
||||
// we only want to check for mismatched branches if pull_request is on.
|
||||
if (doc.on.pull_request !== undefined) {
|
||||
const push = branchesToArray(doc.on.push?.branches);
|
||||
|
||||
if (push !== "**") {
|
||||
const pull_request = branchesToArray(doc.on.pull_request?.branches);
|
||||
|
||||
if (pull_request !== "**") {
|
||||
const difference = pull_request.filter(
|
||||
(value) => !push.some((o) => patternIsSuperset(o, value))
|
||||
);
|
||||
if (difference.length > 0) {
|
||||
// there are branches in pull_request that may not have a baseline
|
||||
// because we are not building them on push
|
||||
errors.push(WorkflowErrors.MismatchedBranches);
|
||||
}
|
||||
} else if (push.length > 0) {
|
||||
// push is set up to run on a subset of branches
|
||||
// and you could open a PR against a branch with no baseline
|
||||
errors.push(WorkflowErrors.MismatchedBranches);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (missingPush) {
|
||||
errors.push(WorkflowErrors.MissingPushHook);
|
||||
}
|
||||
|
||||
return errors;
|
||||
}
|
||||
|
||||
export async function validateWorkflow(): Promise<undefined | string> {
|
||||
let workflow: Workflow;
|
||||
try {
|
||||
workflow = await getWorkflow();
|
||||
} catch (e) {
|
||||
return `error: getWorkflow() failed: ${String(e)}`;
|
||||
}
|
||||
let workflowErrors: CodedError[];
|
||||
try {
|
||||
workflowErrors = getWorkflowErrors(workflow);
|
||||
} catch (e) {
|
||||
return `error: getWorkflowErrors() failed: ${String(e)}`;
|
||||
}
|
||||
|
||||
if (workflowErrors.length > 0) {
|
||||
let message: string;
|
||||
try {
|
||||
message = formatWorkflowErrors(workflowErrors);
|
||||
} catch (e) {
|
||||
return `error: formatWorkflowErrors() failed: ${String(e)}`;
|
||||
}
|
||||
core.warning(message);
|
||||
}
|
||||
|
||||
return formatWorkflowCause(workflowErrors);
|
||||
}
|
||||
|
||||
export function formatWorkflowErrors(errors: CodedError[]): string {
|
||||
const issuesWere = errors.length === 1 ? "issue was" : "issues were";
|
||||
|
||||
const errorsList = errors.map((e) => e.message).join(" ");
|
||||
|
||||
return `${errors.length} ${issuesWere} detected with this workflow: ${errorsList}`;
|
||||
}
|
||||
|
||||
export function formatWorkflowCause(errors: CodedError[]): undefined | string {
|
||||
if (errors.length === 0) {
|
||||
return undefined;
|
||||
}
|
||||
return errors.map((e) => e.code).join(",");
|
||||
}
|
||||
|
||||
export async function getWorkflow(): Promise<Workflow> {
|
||||
const relativePath = await getWorkflowPath();
|
||||
const absolutePath = path.join(
|
||||
getRequiredEnvParam("GITHUB_WORKSPACE"),
|
||||
relativePath
|
||||
);
|
||||
|
||||
return yaml.load(fs.readFileSync(absolutePath, "utf-8")) as Workflow;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the path of the currently executing workflow.
|
||||
*/
|
||||
async function getWorkflowPath(): Promise<string> {
|
||||
const repo_nwo = getRequiredEnvParam("GITHUB_REPOSITORY").split("/");
|
||||
const owner = repo_nwo[0];
|
||||
const repo = repo_nwo[1];
|
||||
const run_id = Number(getRequiredEnvParam("GITHUB_RUN_ID"));
|
||||
|
||||
const apiClient = api.getApiClient();
|
||||
const runsResponse = await apiClient.request(
|
||||
"GET /repos/:owner/:repo/actions/runs/:run_id?exclude_pull_requests=true",
|
||||
{
|
||||
owner,
|
||||
repo,
|
||||
run_id,
|
||||
}
|
||||
);
|
||||
const workflowUrl = runsResponse.data.workflow_url;
|
||||
|
||||
const workflowResponse = await apiClient.request(`GET ${workflowUrl}`);
|
||||
|
||||
return workflowResponse.data.path;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the workflow run ID.
|
||||
*/
|
||||
export function getWorkflowRunID(): number {
|
||||
const workflowRunID = parseInt(getRequiredEnvParam("GITHUB_RUN_ID"), 10);
|
||||
if (Number.isNaN(workflowRunID)) {
|
||||
throw new Error("GITHUB_RUN_ID must define a non NaN workflow run ID");
|
||||
}
|
||||
return workflowRunID;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the analysis key parameter for the current job.
|
||||
*
|
||||
|
||||
@@ -10,7 +10,6 @@ import {
|
||||
getTemporaryDirectory,
|
||||
sendStatusReport,
|
||||
StatusReportBase,
|
||||
validateWorkflow,
|
||||
} from "./actions-util";
|
||||
import { getGitHubVersion } from "./api-client";
|
||||
import { CodeQL, CODEQL_VERSION_NEW_TRACING } from "./codeql";
|
||||
@@ -42,6 +41,7 @@ import {
|
||||
initializeEnvironment,
|
||||
isHostedRunner,
|
||||
} from "./util";
|
||||
import { validateWorkflow } from "./workflow";
|
||||
|
||||
// eslint-disable-next-line import/no-commonjs
|
||||
const pkg = require("../package.json");
|
||||
|
||||
@@ -16,6 +16,7 @@ import { parseRepositoryNwo, RepositoryNwo } from "./repository";
|
||||
import * as sharedEnv from "./shared-environment";
|
||||
import * as util from "./util";
|
||||
import { SarifFile, SarifResult, SarifRun } from "./util";
|
||||
import * as workflow from "./workflow";
|
||||
|
||||
// Takes a list of paths to sarif files and combines them together,
|
||||
// returning the contents of the combined sarif file.
|
||||
@@ -172,7 +173,7 @@ export async function uploadFromActions(
|
||||
await actionsUtil.getAnalysisKey(),
|
||||
actionsUtil.getOptionalInput("category"),
|
||||
util.getRequiredEnvParam("GITHUB_WORKFLOW"),
|
||||
actionsUtil.getWorkflowRunID(),
|
||||
workflow.getWorkflowRunID(),
|
||||
actionsUtil.getRequiredInput("checkout_path"),
|
||||
actionsUtil.getRequiredInput("matrix"),
|
||||
logger
|
||||
|
||||
524
src/workflow.test.ts
Normal file
524
src/workflow.test.ts
Normal file
@@ -0,0 +1,524 @@
|
||||
import test from "ava";
|
||||
import * as yaml from "js-yaml";
|
||||
|
||||
import { setupTests } from "./testing-utils";
|
||||
import {
|
||||
CodedError,
|
||||
formatWorkflowCause,
|
||||
formatWorkflowErrors,
|
||||
getWorkflowErrors,
|
||||
patternIsSuperset,
|
||||
Workflow,
|
||||
WorkflowErrors,
|
||||
} from "./workflow";
|
||||
|
||||
function errorCodes(
|
||||
actual: CodedError[],
|
||||
expected: CodedError[]
|
||||
): [string[], string[]] {
|
||||
return [actual.map(({ code }) => code), expected.map(({ code }) => code)];
|
||||
}
|
||||
|
||||
setupTests(test);
|
||||
|
||||
test("getWorkflowErrors() when on is empty", (t) => {
|
||||
const errors = getWorkflowErrors({ on: {} });
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is an array missing pull_request", (t) => {
|
||||
const errors = getWorkflowErrors({ on: ["push"] });
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is an array missing push", (t) => {
|
||||
const errors = getWorkflowErrors({ on: ["pull_request"] });
|
||||
|
||||
t.deepEqual(...errorCodes(errors, [WorkflowErrors.MissingPushHook]));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is valid", (t) => {
|
||||
const errors = getWorkflowErrors({
|
||||
on: ["push", "pull_request"],
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is a valid superset", (t) => {
|
||||
const errors = getWorkflowErrors({
|
||||
on: ["push", "pull_request", "schedule"],
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push should not have a path", (t) => {
|
||||
const errors = getWorkflowErrors({
|
||||
on: {
|
||||
push: { branches: ["main"], paths: ["test/*"] },
|
||||
pull_request: { branches: ["main"] },
|
||||
},
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, [WorkflowErrors.PathsSpecified]));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is a correct object", (t) => {
|
||||
const errors = getWorkflowErrors({
|
||||
on: { push: { branches: ["main"] }, pull_request: { branches: ["main"] } },
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.pull_requests is a string", (t) => {
|
||||
const errors = getWorkflowErrors({
|
||||
on: { push: { branches: ["main"] }, pull_request: { branches: "*" } },
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, [WorkflowErrors.MismatchedBranches]));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.pull_requests is a string and correct", (t) => {
|
||||
const errors = getWorkflowErrors({
|
||||
on: { push: { branches: "*" }, pull_request: { branches: "*" } },
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is correct with empty objects", (t) => {
|
||||
const errors = getWorkflowErrors(
|
||||
yaml.load(`
|
||||
on:
|
||||
push:
|
||||
pull_request:
|
||||
`) as Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is mismatched", (t) => {
|
||||
const errors = getWorkflowErrors({
|
||||
on: {
|
||||
push: { branches: ["main"] },
|
||||
pull_request: { branches: ["feature"] },
|
||||
},
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, [WorkflowErrors.MismatchedBranches]));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is not mismatched", (t) => {
|
||||
const errors = getWorkflowErrors({
|
||||
on: {
|
||||
push: { branches: ["main", "feature"] },
|
||||
pull_request: { branches: ["main"] },
|
||||
},
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push is mismatched for pull_request", (t) => {
|
||||
const errors = getWorkflowErrors({
|
||||
on: {
|
||||
push: { branches: ["main"] },
|
||||
pull_request: { branches: ["main", "feature"] },
|
||||
},
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, [WorkflowErrors.MismatchedBranches]));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() for a range of malformed workflows", (t) => {
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors({
|
||||
on: {
|
||||
push: 1,
|
||||
pull_request: 1,
|
||||
},
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors({
|
||||
on: 1,
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: 1,
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: [1],
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: { 1: 1 },
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: { test: 1 },
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: { test: [1] },
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: { test: { steps: 1 } },
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: { test: { steps: [{ notrun: "git checkout HEAD^2" }] } },
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors({
|
||||
on: 1,
|
||||
jobs: { test: [undefined] },
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(getWorkflowErrors(1 as any), []));
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors({
|
||||
on: {
|
||||
push: {
|
||||
branches: 1,
|
||||
},
|
||||
pull_request: {
|
||||
branches: 1,
|
||||
},
|
||||
},
|
||||
} as any),
|
||||
[]
|
||||
)
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.pull_request for every branch but push specifies branches", (t) => {
|
||||
const errors = getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on:
|
||||
push:
|
||||
branches: ["main"]
|
||||
pull_request:
|
||||
`) as Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(errors, [WorkflowErrors.MismatchedBranches]));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.pull_request for wildcard branches", (t) => {
|
||||
const errors = getWorkflowErrors({
|
||||
on: {
|
||||
push: { branches: ["feature/*"] },
|
||||
pull_request: { branches: "feature/moose" },
|
||||
},
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.pull_request for mismatched wildcard branches", (t) => {
|
||||
const errors = getWorkflowErrors({
|
||||
on: {
|
||||
push: { branches: ["feature/moose"] },
|
||||
pull_request: { branches: "feature/*" },
|
||||
},
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, [WorkflowErrors.MismatchedBranches]));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when HEAD^2 is checked out", (t) => {
|
||||
process.env.GITHUB_JOB = "test";
|
||||
|
||||
const errors = getWorkflowErrors({
|
||||
on: ["push", "pull_request"],
|
||||
jobs: { test: { steps: [{ run: "git checkout HEAD^2" }] } },
|
||||
});
|
||||
|
||||
t.deepEqual(...errorCodes(errors, [WorkflowErrors.CheckoutWrongHead]));
|
||||
});
|
||||
|
||||
test("formatWorkflowErrors() when there is one error", (t) => {
|
||||
const message = formatWorkflowErrors([WorkflowErrors.CheckoutWrongHead]);
|
||||
t.true(message.startsWith("1 issue was detected with this workflow:"));
|
||||
});
|
||||
|
||||
test("formatWorkflowErrors() when there are multiple errors", (t) => {
|
||||
const message = formatWorkflowErrors([
|
||||
WorkflowErrors.CheckoutWrongHead,
|
||||
WorkflowErrors.PathsSpecified,
|
||||
]);
|
||||
t.true(message.startsWith("2 issues were detected with this workflow:"));
|
||||
});
|
||||
|
||||
test("formatWorkflowCause() with no errors", (t) => {
|
||||
const message = formatWorkflowCause([]);
|
||||
|
||||
t.deepEqual(message, undefined);
|
||||
});
|
||||
|
||||
test("formatWorkflowCause()", (t) => {
|
||||
const message = formatWorkflowCause([
|
||||
WorkflowErrors.CheckoutWrongHead,
|
||||
WorkflowErrors.PathsSpecified,
|
||||
]);
|
||||
|
||||
t.deepEqual(message, "CheckoutWrongHead,PathsSpecified");
|
||||
t.deepEqual(formatWorkflowCause([]), undefined);
|
||||
});
|
||||
|
||||
test("patternIsSuperset()", (t) => {
|
||||
t.false(patternIsSuperset("main-*", "main"));
|
||||
t.true(patternIsSuperset("*", "*"));
|
||||
t.true(patternIsSuperset("*", "main-*"));
|
||||
t.false(patternIsSuperset("main-*", "*"));
|
||||
t.false(patternIsSuperset("main-*", "main"));
|
||||
t.true(patternIsSuperset("main", "main"));
|
||||
t.false(patternIsSuperset("*", "feature/*"));
|
||||
t.true(patternIsSuperset("**", "feature/*"));
|
||||
t.false(patternIsSuperset("feature-*", "**"));
|
||||
t.false(patternIsSuperset("a/**/c", "a/**/d"));
|
||||
t.false(patternIsSuperset("a/**/c", "a/**"));
|
||||
t.true(patternIsSuperset("a/**", "a/**/c"));
|
||||
t.true(patternIsSuperset("a/**/c", "a/main-**/c"));
|
||||
t.false(patternIsSuperset("a/**/b/**/c", "a/**/d/**/c"));
|
||||
t.true(patternIsSuperset("a/**/b/**/c", "a/**/b/c/**/c"));
|
||||
t.true(patternIsSuperset("a/**/b/**/c", "a/**/b/d/**/c"));
|
||||
t.false(patternIsSuperset("a/**/c/d/**/c", "a/**/b/**/c"));
|
||||
t.false(patternIsSuperset("a/main-**/c", "a/**/c"));
|
||||
t.true(patternIsSuperset("/robin/*/release/*", "/robin/moose/release/goose"));
|
||||
t.false(
|
||||
patternIsSuperset("/robin/moose/release/goose", "/robin/*/release/*")
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when branches contain dots", (t) => {
|
||||
const errors = getWorkflowErrors(
|
||||
yaml.load(`
|
||||
on:
|
||||
push:
|
||||
branches: [4.1, master]
|
||||
pull_request:
|
||||
# The branches below must be a subset of the branches above
|
||||
branches: [4.1, master]
|
||||
`) as Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on.push has a trailing comma", (t) => {
|
||||
const errors = getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on:
|
||||
push:
|
||||
branches: [master, ]
|
||||
pull_request:
|
||||
# The branches below must be a subset of the branches above
|
||||
branches: [master]
|
||||
`) as Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() should only report the current job's CheckoutWrongHead", (t) => {
|
||||
process.env.GITHUB_JOB = "test";
|
||||
|
||||
const errors = getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
pull_request:
|
||||
# The branches below must be a subset of the branches above
|
||||
branches: [master]
|
||||
jobs:
|
||||
test:
|
||||
steps:
|
||||
- run: "git checkout HEAD^2"
|
||||
|
||||
test2:
|
||||
steps:
|
||||
- run: "git checkout HEAD^2"
|
||||
|
||||
test3:
|
||||
steps: []
|
||||
`) as Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(errors, [WorkflowErrors.CheckoutWrongHead]));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() should not report a different job's CheckoutWrongHead", (t) => {
|
||||
process.env.GITHUB_JOB = "test3";
|
||||
|
||||
const errors = getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
pull_request:
|
||||
# The branches below must be a subset of the branches above
|
||||
branches: [master]
|
||||
jobs:
|
||||
test:
|
||||
steps:
|
||||
- run: "git checkout HEAD^2"
|
||||
|
||||
test2:
|
||||
steps:
|
||||
- run: "git checkout HEAD^2"
|
||||
|
||||
test3:
|
||||
steps: []
|
||||
`) as Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() when on is missing", (t) => {
|
||||
const errors = getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
`) as Workflow
|
||||
);
|
||||
|
||||
t.deepEqual(...errorCodes(errors, []));
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() with a different on setup", (t) => {
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on: "workflow_dispatch"
|
||||
`) as Workflow
|
||||
),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on: [workflow_dispatch]
|
||||
`) as Workflow
|
||||
),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on:
|
||||
workflow_dispatch: {}
|
||||
`) as Workflow
|
||||
),
|
||||
[]
|
||||
)
|
||||
);
|
||||
});
|
||||
|
||||
test("getWorkflowErrors() should not report an error if PRs are totally unconfigured", (t) => {
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
`) as Workflow
|
||||
),
|
||||
[]
|
||||
)
|
||||
);
|
||||
|
||||
t.deepEqual(
|
||||
...errorCodes(
|
||||
getWorkflowErrors(
|
||||
yaml.load(`
|
||||
name: "CodeQL"
|
||||
on: ["push"]
|
||||
`) as Workflow
|
||||
),
|
||||
[]
|
||||
)
|
||||
);
|
||||
});
|
||||
290
src/workflow.ts
Normal file
290
src/workflow.ts
Normal file
@@ -0,0 +1,290 @@
|
||||
import * as fs from "fs";
|
||||
import * as path from "path";
|
||||
|
||||
import * as core from "@actions/core";
|
||||
import * as yaml from "js-yaml";
|
||||
|
||||
import * as api from "./api-client";
|
||||
import { getRequiredEnvParam } from "./util";
|
||||
|
||||
interface WorkflowJobStep {
|
||||
run: any;
|
||||
}
|
||||
|
||||
interface WorkflowJob {
|
||||
steps?: WorkflowJobStep[];
|
||||
}
|
||||
|
||||
interface WorkflowTrigger {
|
||||
branches?: string[] | string;
|
||||
paths?: string[];
|
||||
}
|
||||
|
||||
// on: {} then push/pull_request are undefined
|
||||
// on:
|
||||
// push:
|
||||
// pull_request:
|
||||
// then push/pull_request are null
|
||||
interface WorkflowTriggers {
|
||||
push?: WorkflowTrigger | null;
|
||||
pull_request?: WorkflowTrigger | null;
|
||||
}
|
||||
|
||||
export interface Workflow {
|
||||
jobs?: { [key: string]: WorkflowJob };
|
||||
on?: string | string[] | WorkflowTriggers;
|
||||
}
|
||||
|
||||
function isObject(o: unknown): o is object {
|
||||
return o !== null && typeof o === "object";
|
||||
}
|
||||
|
||||
const GLOB_PATTERN = new RegExp("(\\*\\*?)");
|
||||
|
||||
function escapeRegExp(string) {
|
||||
return string.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); // $& means the whole matched string
|
||||
}
|
||||
|
||||
function patternToRegExp(value) {
|
||||
return new RegExp(
|
||||
`^${value
|
||||
.toString()
|
||||
.split(GLOB_PATTERN)
|
||||
.reduce(function (arr, cur) {
|
||||
if (cur === "**") {
|
||||
arr.push(".*?");
|
||||
} else if (cur === "*") {
|
||||
arr.push("[^/]*?");
|
||||
} else if (cur) {
|
||||
arr.push(escapeRegExp(cur));
|
||||
}
|
||||
return arr;
|
||||
}, [])
|
||||
.join("")}$`
|
||||
);
|
||||
}
|
||||
|
||||
// this function should return true if patternA is a superset of patternB
|
||||
// e.g: * is a superset of main-* but main-* is not a superset of *.
|
||||
export function patternIsSuperset(patternA: string, patternB: string): boolean {
|
||||
return patternToRegExp(patternA).test(patternB);
|
||||
}
|
||||
|
||||
function branchesToArray(branches?: string | null | string[]): string[] | "**" {
|
||||
if (typeof branches === "string") {
|
||||
return [branches];
|
||||
}
|
||||
if (Array.isArray(branches)) {
|
||||
if (branches.length === 0) {
|
||||
return "**";
|
||||
}
|
||||
return branches;
|
||||
}
|
||||
return "**";
|
||||
}
|
||||
export interface CodedError {
|
||||
message: string;
|
||||
code: string;
|
||||
}
|
||||
|
||||
function toCodedErrors<T>(errors: T): Record<keyof T, CodedError> {
|
||||
return Object.entries(errors).reduce((acc, [key, value]) => {
|
||||
acc[key] = { message: value, code: key };
|
||||
return acc;
|
||||
}, {} as Record<keyof T, CodedError>);
|
||||
}
|
||||
|
||||
// code to send back via status report
|
||||
// message to add as a warning annotation to the run
|
||||
export const WorkflowErrors = toCodedErrors({
|
||||
MismatchedBranches: `Please make sure that every branch in on.pull_request is also in on.push so that Code Scanning can compare pull requests against the state of the base branch.`,
|
||||
MissingPushHook: `Please specify an on.push hook so that Code Scanning can compare pull requests against the state of the base branch.`,
|
||||
PathsSpecified: `Using on.push.paths can prevent Code Scanning annotating new alerts in your pull requests.`,
|
||||
PathsIgnoreSpecified: `Using on.push.paths-ignore can prevent Code Scanning annotating new alerts in your pull requests.`,
|
||||
CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
|
||||
});
|
||||
|
||||
export function getWorkflowErrors(doc: Workflow): CodedError[] {
|
||||
const errors: CodedError[] = [];
|
||||
|
||||
const jobName = process.env.GITHUB_JOB;
|
||||
|
||||
if (jobName) {
|
||||
const job = doc?.jobs?.[jobName];
|
||||
|
||||
const steps = job?.steps;
|
||||
|
||||
if (Array.isArray(steps)) {
|
||||
for (const step of steps) {
|
||||
// this was advice that we used to give in the README
|
||||
// we actually want to run the analysis on the merge commit
|
||||
// to produce results that are more inline with expectations
|
||||
// (i.e: this is what will happen if you merge this PR)
|
||||
// and avoid some race conditions
|
||||
if (step?.run === "git checkout HEAD^2") {
|
||||
errors.push(WorkflowErrors.CheckoutWrongHead);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
let missingPush = false;
|
||||
|
||||
if (doc.on === undefined) {
|
||||
// this is not a valid config
|
||||
} else if (typeof doc.on === "string") {
|
||||
if (doc.on === "pull_request") {
|
||||
missingPush = true;
|
||||
}
|
||||
} else if (Array.isArray(doc.on)) {
|
||||
const hasPush = doc.on.includes("push");
|
||||
const hasPullRequest = doc.on.includes("pull_request");
|
||||
if (hasPullRequest && !hasPush) {
|
||||
missingPush = true;
|
||||
}
|
||||
} else if (isObject(doc.on)) {
|
||||
const hasPush = Object.prototype.hasOwnProperty.call(doc.on, "push");
|
||||
const hasPullRequest = Object.prototype.hasOwnProperty.call(
|
||||
doc.on,
|
||||
"pull_request"
|
||||
);
|
||||
|
||||
if (!hasPush && hasPullRequest) {
|
||||
missingPush = true;
|
||||
}
|
||||
if (hasPush && hasPullRequest) {
|
||||
const paths = doc.on.push?.paths;
|
||||
// if you specify paths or paths-ignore you can end up with commits that have no baseline
|
||||
// if they didn't change any files
|
||||
// currently we cannot go back through the history and find the most recent baseline
|
||||
if (Array.isArray(paths) && paths.length > 0) {
|
||||
errors.push(WorkflowErrors.PathsSpecified);
|
||||
}
|
||||
const pathsIgnore = doc.on.push?.["paths-ignore"];
|
||||
if (Array.isArray(pathsIgnore) && pathsIgnore.length > 0) {
|
||||
errors.push(WorkflowErrors.PathsIgnoreSpecified);
|
||||
}
|
||||
}
|
||||
|
||||
// if doc.on.pull_request is null that means 'all branches'
|
||||
// if doc.on.pull_request is undefined that means 'off'
|
||||
// we only want to check for mismatched branches if pull_request is on.
|
||||
if (doc.on.pull_request !== undefined) {
|
||||
const push = branchesToArray(doc.on.push?.branches);
|
||||
|
||||
if (push !== "**") {
|
||||
const pull_request = branchesToArray(doc.on.pull_request?.branches);
|
||||
|
||||
if (pull_request !== "**") {
|
||||
const difference = pull_request.filter(
|
||||
(value) => !push.some((o) => patternIsSuperset(o, value))
|
||||
);
|
||||
if (difference.length > 0) {
|
||||
// there are branches in pull_request that may not have a baseline
|
||||
// because we are not building them on push
|
||||
errors.push(WorkflowErrors.MismatchedBranches);
|
||||
}
|
||||
} else if (push.length > 0) {
|
||||
// push is set up to run on a subset of branches
|
||||
// and you could open a PR against a branch with no baseline
|
||||
errors.push(WorkflowErrors.MismatchedBranches);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (missingPush) {
|
||||
errors.push(WorkflowErrors.MissingPushHook);
|
||||
}
|
||||
|
||||
return errors;
|
||||
}
|
||||
|
||||
export async function validateWorkflow(): Promise<undefined | string> {
|
||||
let workflow: Workflow;
|
||||
try {
|
||||
workflow = await getWorkflow();
|
||||
} catch (e) {
|
||||
return `error: getWorkflow() failed: ${String(e)}`;
|
||||
}
|
||||
let workflowErrors: CodedError[];
|
||||
try {
|
||||
workflowErrors = getWorkflowErrors(workflow);
|
||||
} catch (e) {
|
||||
return `error: getWorkflowErrors() failed: ${String(e)}`;
|
||||
}
|
||||
|
||||
if (workflowErrors.length > 0) {
|
||||
let message: string;
|
||||
try {
|
||||
message = formatWorkflowErrors(workflowErrors);
|
||||
} catch (e) {
|
||||
return `error: formatWorkflowErrors() failed: ${String(e)}`;
|
||||
}
|
||||
core.warning(message);
|
||||
}
|
||||
|
||||
return formatWorkflowCause(workflowErrors);
|
||||
}
|
||||
|
||||
export function formatWorkflowErrors(errors: CodedError[]): string {
|
||||
const issuesWere = errors.length === 1 ? "issue was" : "issues were";
|
||||
|
||||
const errorsList = errors.map((e) => e.message).join(" ");
|
||||
|
||||
return `${errors.length} ${issuesWere} detected with this workflow: ${errorsList}`;
|
||||
}
|
||||
|
||||
export function formatWorkflowCause(errors: CodedError[]): undefined | string {
|
||||
if (errors.length === 0) {
|
||||
return undefined;
|
||||
}
|
||||
return errors.map((e) => e.code).join(",");
|
||||
}
|
||||
|
||||
export async function getWorkflow(): Promise<Workflow> {
|
||||
const relativePath = await getWorkflowPath();
|
||||
const absolutePath = path.join(
|
||||
getRequiredEnvParam("GITHUB_WORKSPACE"),
|
||||
relativePath
|
||||
);
|
||||
|
||||
return yaml.load(fs.readFileSync(absolutePath, "utf-8")) as Workflow;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the path of the currently executing workflow.
|
||||
*/
|
||||
export async function getWorkflowPath(): Promise<string> {
|
||||
const repo_nwo = getRequiredEnvParam("GITHUB_REPOSITORY").split("/");
|
||||
const owner = repo_nwo[0];
|
||||
const repo = repo_nwo[1];
|
||||
const run_id = Number(getRequiredEnvParam("GITHUB_RUN_ID"));
|
||||
|
||||
const apiClient = api.getApiClient();
|
||||
const runsResponse = await apiClient.request(
|
||||
"GET /repos/:owner/:repo/actions/runs/:run_id?exclude_pull_requests=true",
|
||||
{
|
||||
owner,
|
||||
repo,
|
||||
run_id,
|
||||
}
|
||||
);
|
||||
const workflowUrl = runsResponse.data.workflow_url;
|
||||
|
||||
const workflowResponse = await apiClient.request(`GET ${workflowUrl}`);
|
||||
|
||||
return workflowResponse.data.path;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the workflow run ID.
|
||||
*/
|
||||
export function getWorkflowRunID(): number {
|
||||
const workflowRunID = parseInt(getRequiredEnvParam("GITHUB_RUN_ID"), 10);
|
||||
if (Number.isNaN(workflowRunID)) {
|
||||
throw new Error("GITHUB_RUN_ID must define a non NaN workflow run ID");
|
||||
}
|
||||
return workflowRunID;
|
||||
}
|
||||
Reference in New Issue
Block a user