Skip to content

Commit 783315c

Browse files
data-douserdata-douser
committed
Add nightly CodeQL CLI update workflow
Detect new CodeQL CLI releases and create a PR with updated version files, rebuilt dependencies, and passing build/tests.
1 parent c2761af commit 783315c

File tree

1 file changed

+159
-0
lines changed

1 file changed

+159
-0
lines changed

‎.github/workflows/update-codeql.yml‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
name: Update CodeQL CLI Dependencies
2+
3+
on:
4+
workflow_dispatch:
5+
# Nightly check for new CodeQL CLI releases
6+
schedule:
7+
- cron: '30 5 * * *'
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
# ─────────────────────────────────────────────────────────────────────────────
14+
# Step 1: Detect new CodeQL CLI version
15+
#
16+
# Compares the current CodeQL CLI version in .codeql-version against the
17+
# latest release from github/codeql-cli-binaries. If a newer version is
18+
# available, downstream jobs orchestrate the update and PR creation.
19+
# ─────────────────────────────────────────────────────────────────────────────
20+
detect-update:
21+
name: Detect CodeQL CLI Update
22+
runs-on: ubuntu-latest
23+
24+
outputs:
25+
current_version: ${{ steps.check-version.outputs.current_version }}
26+
latest_version: ${{ steps.check-version.outputs.latest_version }}
27+
update_needed: ${{ steps.check-version.outputs.update_needed }}
28+
version: ${{ steps.check-version.outputs.version }}
29+
30+
steps:
31+
- name: Detect - Checkout repository
32+
uses: actions/checkout@v6
33+
34+
- name: Detect - Check latest CodeQL CLI version
35+
id: check-version
36+
env:
37+
GH_TOKEN: ${{ github.token }}
38+
run: |
39+
echo "Checking latest CodeQL CLI version..."
40+
41+
# Read current version from .codeql-version (stores vX.Y.Z)
42+
current_version_raw=$(cat .codeql-version | tr -d '[:space:]')
43+
current_version="${current_version_raw#v}"
44+
45+
# Get latest release from codeql-cli-binaries
46+
latest_tag=$(gh release list --repo github/codeql-cli-binaries --json 'tagName,isLatest' --jq '.[] | select(.isLatest == true) | .tagName')
47+
latest_clean="${latest_tag#v}"
48+
49+
echo "Current CodeQL CLI version: ${current_version}"
50+
echo "Latest CodeQL CLI version: ${latest_clean}"
51+
52+
if [ "${latest_clean}" != "${current_version}" ]; then
53+
echo "✅ Update available: ${current_version} → ${latest_clean}"
54+
echo "update_needed=true" >> $GITHUB_OUTPUT
55+
echo "current_version=${current_version}" >> $GITHUB_OUTPUT
56+
echo "latest_version=${latest_clean}" >> $GITHUB_OUTPUT
57+
echo "version=v${latest_clean}" >> $GITHUB_OUTPUT
58+
else
59+
echo "ℹ️ CodeQL CLI is already up-to-date at version ${current_version}"
60+
echo "update_needed=false" >> $GITHUB_OUTPUT
61+
fi
62+
63+
- name: Detect - Summary
64+
run: |
65+
echo "## CodeQL CLI Update Check" >> $GITHUB_STEP_SUMMARY
66+
echo "" >> $GITHUB_STEP_SUMMARY
67+
if [ "${{ steps.check-version.outputs.update_needed }}" == "true" ]; then
68+
echo "✅ Update available: ${{ steps.check-version.outputs.current_version }} → ${{ steps.check-version.outputs.latest_version }}" >> $GITHUB_STEP_SUMMARY
69+
echo "" >> $GITHUB_STEP_SUMMARY
70+
echo "Initiating update pipeline for \`${{ steps.check-version.outputs.version }}\`..." >> $GITHUB_STEP_SUMMARY
71+
else
72+
echo "ℹ️ CodeQL CLI is already up-to-date. No changes needed." >> $GITHUB_STEP_SUMMARY
73+
fi
74+
75+
# ─────────────────────────────────────────────────────────────────────────────
76+
# Step 2: Update version, build, test, and create PR
77+
#
78+
# Updates all version-bearing files, installs dependencies, runs the full
79+
# build-and-test suite, and creates a pull request with the changes.
80+
# ─────────────────────────────────────────────────────────────────────────────
81+
create-pr:
82+
name: Create Update Pull Request
83+
needs: detect-update
84+
if: needs.detect-update.outputs.update_needed == 'true'
85+
runs-on: ubuntu-latest
86+
87+
permissions:
88+
contents: write
89+
pull-requests: write
90+
91+
steps:
92+
- name: Update - Checkout repository
93+
uses: actions/checkout@v6
94+
95+
- name: Update - Update .codeql-version
96+
run: |
97+
printf "v%s\n" "${{ needs.detect-update.outputs.latest_version }}" > .codeql-version
98+
echo "Updated .codeql-version to ${{ needs.detect-update.outputs.version }}"
99+
100+
- name: Update - Setup CodeQL environment
101+
uses: ./.github/actions/setup-codeql-environment
102+
with:
103+
add-to-path: true
104+
install-language-runtimes: false
105+
106+
- name: Update - Setup Node.js
107+
uses: actions/setup-node@v6
108+
with:
109+
cache: 'npm'
110+
node-version-file: '.node-version'
111+
112+
- name: Update - Update version in all files
113+
run: |
114+
LATEST="${{ needs.detect-update.outputs.latest_version }}"
115+
echo "Updating all version-bearing files to ${LATEST}..."
116+
./server/scripts/update-release-version.sh --skip-cli-validation "${LATEST}"
117+
118+
- name: Update - Install dependencies
119+
run: npm install --include=optional
120+
121+
- name: Update - Install CodeQL pack dependencies
122+
run: server/scripts/install-packs.sh
123+
124+
- name: Update - Build and test
125+
run: npm run build-and-test
126+
127+
- name: Update - Create Pull Request
128+
uses: peter-evans/create-pull-request@v8
129+
with:
130+
title: 'Upgrade CodeQL CLI dependency to ${{ needs.detect-update.outputs.version }}'
131+
body: |
132+
This PR upgrades the CodeQL CLI version to ${{ needs.detect-update.outputs.version }}.
133+
134+
**Changes made:**
135+
- Updated `.codeql-version` to `${{ needs.detect-update.outputs.version }}`
136+
- Updated all version-bearing files (package.json, codeql-pack.yml) to `${{ needs.detect-update.outputs.latest_version }}`
137+
- Regenerated `package-lock.json`
138+
- Installed CodeQL pack dependencies
139+
- Build and tests passed ✅
140+
commit-message: 'Upgrade CodeQL CLI dependency to ${{ needs.detect-update.outputs.version }}'
141+
delete-branch: true
142+
branch: 'codeql/upgrade-to-${{ needs.detect-update.outputs.version }}'
143+
144+
- name: Update - Summary
145+
run: |
146+
VERSION="${{ needs.detect-update.outputs.version }}"
147+
CURRENT="${{ needs.detect-update.outputs.current_version }}"
148+
LATEST="${{ needs.detect-update.outputs.latest_version }}"
149+
echo "## CodeQL CLI Update Summary" >> $GITHUB_STEP_SUMMARY
150+
echo "" >> $GITHUB_STEP_SUMMARY
151+
echo "Triggered by CodeQL CLI update: ${CURRENT} → ${LATEST}" >> $GITHUB_STEP_SUMMARY
152+
echo "" >> $GITHUB_STEP_SUMMARY
153+
echo "| Property | Old Value | New Value |" >> $GITHUB_STEP_SUMMARY
154+
echo "| -------- | --------- | --------- |" >> $GITHUB_STEP_SUMMARY
155+
echo "| .codeql-version | v${CURRENT} | ${VERSION} |" >> $GITHUB_STEP_SUMMARY
156+
echo "| package.json versions | ${CURRENT} | ${LATEST} |" >> $GITHUB_STEP_SUMMARY
157+
echo "| codeql-pack.yml versions | ${CURRENT} | ${LATEST} |" >> $GITHUB_STEP_SUMMARY
158+
echo "" >> $GITHUB_STEP_SUMMARY
159+
echo "A pull request has been created with these changes." >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)