164 Commits

Author SHA1 Message Date
Edoardo Pirovano
554f1b3765 Address further PR comment 2021-07-26 15:19:47 +01:00
Edoardo Pirovano
934fb86c58 Address PR comments from @robertbrignull 2021-07-26 14:47:03 +01:00
Edoardo Pirovano
e145aa414e Enable dependabot automatic updates 2021-07-26 11:14:19 +01:00
Mario Campos
06c6845442 Add analyze step to 'source-root' input test case
Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com>
2021-07-02 14:50:52 -05:00
Mario Campos
b9217ca238 Test presence of database instead of results of analysis
This is for PR #607, 'source-root' input test case.
2021-07-02 08:07:06 -05:00
Mario Campos
2c0da4bcc7 Remove build.sh step from 'source-root' test
As this test is using only JS, it's not necessary to compile or analyze the other languages.
2021-07-01 18:43:10 -05:00
Mario Campos
12f1cff212 Rename CodeQL action paths in 'source-root' test to reflect repo paths 2021-07-01 18:39:37 -05:00
Mario Campos
2ca807cf16 Merge branch 'source-root-input' of github.com:mario-campos/codeql-action into source-root-input 2021-07-01 18:37:07 -05:00
Mario Campos
1c69fae407 Avoid moving repo files out of \$GITHUB_WORKSPACE in 'source-root' test
Moving the files into ../action was causing the job to fail because it couldn't find the test directory anymore. According to @adityasharad, these 'mv's should
not be necessary. Removing these means changing the path to the actions.

I'm also removing the 'config-file' input to keep the test minimal. I think this will mean that CodeQL will use the default query suite, so I hope that this doesn't change the results.
2021-07-01 18:34:34 -05:00
Mario Campos
67d6f7929f Delete 'packaing' from source-root test job name
The test is not related to packaging.

Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com>
2021-07-01 18:31:50 -05:00
Mario Campos
028f98f5ea Use different config file for testing 'source-root' input
This config file 'ought to have some queries good for testing!
2021-07-01 16:12:15 -05:00
Mario Campos
c78fb87659 Add test case for 'source-root' input to 'init' Action 2021-07-01 15:26:04 -05:00
Andrew Eisenberg
0792832682 Remove a TODO and use defautl tools option 2021-06-30 12:43:20 -07:00
Edoardo Pirovano
d9050f49a3 Merge branch 'main' into local-bundle 2021-06-28 23:53:41 +01:00
Edoardo Pirovano
a7dac5c3db Address PR comment. 2021-06-28 23:52:53 +01:00
Edoardo Pirovano
93214eca2e Merge branch 'main' into split-create-analysis 2021-06-28 18:25:01 +01:00
Edoardo Pirovano
8f4c2c76ad Allow local instead of downloaded CodeQL 2021-06-28 18:11:13 +01:00
Edoardo Pirovano
954700187b Run tests against nightly CLI bundles 2021-06-28 17:47:10 +01:00
Andrew Eisenberg
a6891153f0 Allow to be run on workflow_dispatch 2021-06-28 09:17:32 -07:00
Edoardo Pirovano
ef852c006a Support splitting of DB creation and query execution 2021-06-28 17:14:22 +01:00
Andrew Eisenberg
4087f37d90 Add extra integration test for packaging
Also, update the options and inputs documentation.
2021-06-25 10:07:51 -07:00
Andrew Eisenberg
6e577cfca3 Add new packs input to init action
This input allows users to specify which packs to run. It works in
unison with the packs block of the config file and it is similar to
how `queries` works. They both use `+` in the same way.

Note that the `#TODO` in the pr check is still around, but the CLI
is available. I will remove the TODO in the next commit.
2021-06-23 16:08:35 -07:00
Andrew Eisenberg
629f582c03 Update changelog template
The changelog for an empty version will now be:

```
No user facing changes.
```

And this will appear in the final changelog when there is an actual release.
The benefits are that users will see regular release cycles and know
how old versions are even if there's no changes for a particular version

If we find that we are going months without any user facing changes, but
we have non-visible changes, then we can rethink this strategy.
But I think this is nicer than having empty sections for a version.
2021-06-22 14:25:06 -07:00
Andrew Eisenberg
efea9238bc Fix custom version of CLI to use for package testing
This can be removed when 2.5.6 is released.
2021-06-16 14:56:52 -07:00
Andrew Eisenberg
6a1c0700c3 Avoid running mergeback workflow on PR
This was causing the workflow to run and create tags after merging
main into a branch.
2021-06-09 14:38:09 -07:00
Andrew Eisenberg
a2e96a4c78 Add pack download to its own log group
Also, make the baseline count message less awkward sounding.
2021-06-09 14:13:05 -07:00
Andrew Eisenberg
db01c78de0 Remove unneeded action input in PR check 2021-06-09 13:10:57 -07:00
Andrew Eisenberg
82388fd94a Merge remote-tracking branch 'upstream/main' into aeisenberg/pack-run 2021-06-09 12:43:17 -07:00
Andrew Eisenberg
d42f654f7a Add an integration test for packaging
Uses two pre-existing packages to run some simple queries on a javascript
database.
2021-06-08 12:34:07 -07:00
Andrew Eisenberg
74764ac0eb Remove quotes around $DRAFT argument
gh will complain if there is an empty `""`, which is the case if
`$DRAFT` is unset.
2021-06-07 13:53:47 -07:00
Edoardo Pirovano
ddb83a462d Cleanup CodeQL DBs and output their location for later steps 2021-06-04 18:54:15 +01:00
Edoardo Pirovano
0cbd4b56d3 Add some dependencies for uploading artifacts 2021-06-02 10:32:48 +01:00
Andrew Eisenberg
f0e82b7d63 1.0.1 2021-05-31 10:56:52 -07:00
Andrew Eisenberg
981b5cb012 Fix the mergeback workflow
We need to tag and mergeback if the tag does _not_ already exist.
2021-05-31 10:08:10 -07:00
Andrew Eisenberg
8b0110800e Merge branch 'main' into aeisenberg/update-changelog-on-release 2021-05-27 13:12:26 -07:00
Andrew Eisenberg
ea89b06c41 Add bump runner version whenever action is versioned
Ensures that the runner version is bumped along with the action version.
2021-05-27 12:31:58 -07:00
Aditya Sharad
a55e7e1f67 Actions: Run enterprise versions workflow only on the parent repo
Don't run the cron workflow on forks, since they lack the necessary secrets.
2021-05-25 17:48:14 -07:00
Andrew Eisenberg
800a951427 Add release and mergeback workflows
This commit ensures that the changelog is updated before a release with
the correct date and version.

Also, after a release, a mergeback PR is created to ensure that the
changelog update and version bump is available in main.
2021-05-21 11:04:38 -07:00
Edoardo Pirovano
79c79f1be5 Add configuration option to set CodeQL DB location 2021-05-18 00:13:36 +01:00
Edoardo Pirovano
a5506d82e4 Output environment file for Windows 2021-05-10 20:43:49 +01:00
Robert
3c96019556 fix windows hopefully 2021-05-10 16:24:52 +01:00
Robert
f742f910aa put matrix vars in env vars for whitespace safety 2021-05-10 16:19:38 +01:00
Robert
603c47cb50 make matrix run all cases 2021-05-07 10:21:05 +01:00
Chris Gavin
e305db89c2 Fix the token permissions for private copies of the CodeQL Action, and for runs that are not from pull requests. 2021-04-30 13:47:54 +01:00
Chris Gavin
643bc6e3ed Remove spurious blank line. 2021-04-22 17:26:26 +01:00
Chris Gavin
7e85b5d66a Restrict Actions token permissions in CodeQL workflow. 2021-04-22 17:07:03 +01:00
Aditya Sharad
64b50fa2a6 Code scanning: Compare the default and latest CodeQL tools bundles
Create a prerequisite job that runs the init step twice, with `tools: null` and `tools: latest`.
Use the outputs of these steps to compare the two CodeQL versions.
Pass the list of distinct tool versions for the analysis job to matrix over.
This lets us test the analysis against both versions, while avoiding duplication
when they are actually the same version.
2021-04-09 14:51:18 -07:00
Aditya Sharad
51b1d7d81f PR checks: Compare the default and latest CodeQL tools bundles
Create a prerequisite job that runs the init step twice, with `tools: null` and `tools: latest`.
Use the outputs of these steps to compare the two CodeQL versions.
Pass the list of distinct tool versions for the integration tests to use in their matrix strategy.
This avoids redundant test jobs when the default and latest bundles are actually the same version of CodeQL.

`~` is accepted by JSON but not by the Actions context language, so we use `null` to indicate the default version.
2021-04-09 13:38:30 -07:00
Aditya Sharad
f9a19da7bf PR checks: Run integration tests against both tools: null and tools: latest
Always test against both the default and latest CodeQL bundle.

This improves test coverage shortly after a CodeQL bundle release, where the latest bundle
may not yet be built into the Actions VM image as the default bundle.

It also saves a manual step during bundle release testing,
since we no longer need to temporarily change the PR checks to `tools: latest`.

There is some redundancy when the latest bundle is the same as the default bundle on the VM image,
but this can be considered a test for the `tools: latest` configuration.
2021-04-08 13:39:01 -07:00
Simon Engledew
324d987bc6 Check if this mitigates the go 1.16 issue 2021-03-01 13:01:56 +00:00