Skip to content

Commit 0cdb720

Browse files
data-douserdata-douser
committed
Refactor release workflows to share child workflows
- Rewrite update-codeql.yml to orchestrate via release-tag.yml and release-codeql.yml instead of inline logic and PR creation - Fix release-tag.yml step ordering: update version before installing CodeQL so qlt.conf.json is correct when QLT reads it - Use install-packs.sh in release-tag.yml and release-codeql.yml - Add qlt.conf.json support to update-release-version.sh (jq primary, sed fallback) with --check validation - Add pre-release suffix support (X.Y.Z-alpha, X.Y.Z-rc1) across version validation, workflow descriptions, and script documentation - Add --framework argument guard to install-packs.sh - Fix collect_versions error handling and check_versions error propagation
1 parent b8c3f17 commit 0cdb720

File tree

7 files changed

+231
-115
lines changed

7 files changed

+231
-115
lines changed

‎.github/workflows/release-codeql.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,15 @@ on:
99
required: false
1010
type: boolean
1111
version:
12-
description: 'Release version tag (e.g., vX.Y.Z). Must start with "v".'
12+
description: 'Release version tag (e.g., vX.Y.Z or vX.Y.Z-suffix). Must start with "v".'
1313
required: true
1414
type: string
1515
outputs:
1616
release_name:
17-
description: 'The release name without "v" prefix (e.g., X.Y.Z)'
17+
description: 'The release name without "v" prefix (e.g., X.Y.Z or X.Y.Z-alpha)'
1818
value: ${{ jobs.publish-codeql-packs.outputs.release_name }}
1919
version:
20-
description: 'The full version string with "v" prefix (e.g., vX.Y.Z)'
20+
description: 'The full version string with "v" prefix (e.g., vX.Y.Z or vX.Y.Z-alpha)'
2121
value: ${{ jobs.publish-codeql-packs.outputs.version }}
2222

2323
# Note: This workflow is called exclusively via workflow_call from release.yml.
@@ -79,7 +79,9 @@ jobs:
7979
- name: CodeQL - Install pack dependencies
8080
shell: bash
8181
run: |
82-
qlt query run install-packs
82+
export PATH="$(dirname "$QLT_CODEQL_PATH"):$PATH"
83+
chmod +x ./scripts/install-packs.sh
84+
./scripts/install-packs.sh
8385
8486
- name: CodeQL - Validate version consistency
8587
run: |

‎.github/workflows/release-tag.yml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,18 @@ on:
44
workflow_call:
55
inputs:
66
version:
7-
description: 'Release version (e.g., vX.Y.Z). Must start with "v".'
7+
description: 'Release version (e.g., vX.Y.Z or vX.Y.Z-suffix). Must start with "v".'
88
required: true
99
type: string
1010
outputs:
1111
release_name:
12-
description: 'The release name without "v" prefix (e.g., X.Y.Z)'
12+
description: 'The release name without "v" prefix (e.g., X.Y.Z or X.Y.Z-alpha)'
1313
value: ${{ jobs.create-tag.outputs.release_name }}
1414
tag_sha:
1515
description: 'The commit SHA that the tag points to'
1616
value: ${{ jobs.create-tag.outputs.tag_sha }}
1717
version:
18-
description: 'The full version string with "v" prefix (e.g., vX.Y.Z)'
18+
description: 'The full version string with "v" prefix (e.g., vX.Y.Z or vX.Y.Z-alpha)'
1919
value: ${{ jobs.create-tag.outputs.version }}
2020

2121
# Note: This workflow is called exclusively via workflow_call from release.yml.
@@ -73,6 +73,14 @@ jobs:
7373
echo "ℹ️ Tag ${TAG} does not exist yet"
7474
fi
7575
76+
- name: Tag - Update release version
77+
if: steps.check-tag.outputs.tag_exists != 'true'
78+
run: |
79+
TAG_VERSION="${{ steps.version.outputs.release_name }}"
80+
echo "Updating all version-bearing files to '${TAG_VERSION}'..."
81+
chmod +x ./scripts/update-release-version.sh
82+
./scripts/update-release-version.sh "${TAG_VERSION}"
83+
7684
- name: Tag - Install QLT
7785
if: steps.check-tag.outputs.tag_exists != 'true'
7886
id: install-qlt
@@ -91,14 +99,6 @@ jobs:
9199
echo "CodeQL Home: $QLT_CODEQL_HOME"
92100
echo "CodeQL Binary: $QLT_CODEQL_PATH"
93101
94-
- name: Tag - Update release version
95-
if: steps.check-tag.outputs.tag_exists != 'true'
96-
run: |
97-
TAG_VERSION="${{ steps.version.outputs.release_name }}"
98-
echo "Updating all version-bearing files to '${TAG_VERSION}'..."
99-
chmod +x ./scripts/update-release-version.sh
100-
./scripts/update-release-version.sh "${TAG_VERSION}"
101-
102102
- name: Tag - Upgrade CodeQL pack lock files
103103
if: steps.check-tag.outputs.tag_exists != 'true'
104104
shell: bash
@@ -117,7 +117,9 @@ jobs:
117117
if: steps.check-tag.outputs.tag_exists != 'true'
118118
shell: bash
119119
run: |
120-
qlt query run install-packs
120+
export PATH="$(dirname "$QLT_CODEQL_PATH"):$PATH"
121+
chmod +x ./scripts/install-packs.sh
122+
./scripts/install-packs.sh
121123
122124
- name: Tag - Setup Node.js for CDS compilation
123125
if: steps.check-tag.outputs.tag_exists != 'true'

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ on:
1717
required: false
1818
type: boolean
1919
version:
20-
description: 'Release version (e.g., vX.Y.Z). Must start with "v".'
20+
description: 'Release version (e.g., vX.Y.Z or vX.Y.Z-suffix). Must start with "v". Supports pre-release suffixes like -alpha, -beta, -rc1.'
2121
required: true
2222
type: string
2323

‎.github/workflows/update-codeql.yml‎

Lines changed: 117 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -7,117 +7,147 @@ on:
77
- cron: '30 0 * * *'
88

99
permissions:
10-
contents: write
11-
pull-requests: write
10+
contents: read
1211

1312
jobs:
14-
update-codeql:
15-
name: Update CodeQL CLI Dependencies
13+
# ─────────────────────────────────────────────────────────────────────────────
14+
# Step 1: Detect new CodeQL CLI version
15+
#
16+
# Compares the current CodeQL CLI version in qlt.conf.json against the latest
17+
# release from github/codeql-cli-binaries. If a newer version is available,
18+
# downstream jobs orchestrate a full release using the same child workflows
19+
# as release.yml, guarded by environment approval gates.
20+
# ─────────────────────────────────────────────────────────────────────────────
21+
detect-update:
22+
name: Detect CodeQL CLI Update
1623
runs-on: ubuntu-latest
1724

25+
outputs:
26+
current_version: ${{ steps.check-version.outputs.current_version }}
27+
latest_version: ${{ steps.check-version.outputs.latest_version }}
28+
update_needed: ${{ steps.check-version.outputs.update_needed }}
29+
version: ${{ steps.check-version.outputs.version }}
30+
1831
steps:
19-
- name: Update - Checkout repository
32+
- name: Detect - Checkout repository
2033
uses: actions/checkout@v6
2134

22-
- name: Update - Check latest CodeQL CLI version
35+
- name: Detect - Check latest CodeQL CLI version
2336
id: check-version
2437
env:
2538
GH_TOKEN: ${{ github.token }}
2639
run: |
2740
echo "Checking latest CodeQL CLI version..."
28-
current_version=$(jq .CodeQLCLI qlt.conf.json -r)
29-
latest_version=$(gh release list --repo github/codeql-cli-binaries --json 'tagName,isLatest' --jq '.[] | select(.isLatest == true) | .tagName')
30-
echo "Current CodeQL CLI version: $current_version"
31-
echo "Latest CodeQL CLI version: $latest_version"
41+
current_version=$(jq -r .CodeQLCLI qlt.conf.json)
42+
latest_tag=$(gh release list --repo github/codeql-cli-binaries --json 'tagName,isLatest' --jq '.[] | select(.isLatest == true) | .tagName')
43+
latest_clean="${latest_tag#v}"
3244
33-
# Remove 'v' prefix if present for comparison with current version
34-
latest_clean=$(echo "$latest_version" | sed 's/^v//')
45+
echo "Current CodeQL CLI version: ${current_version}"
46+
echo "Latest CodeQL CLI version: ${latest_clean}"
3547
36-
if [ "$latest_clean" != "$current_version" ]; then
37-
echo "Updating CodeQL CLI from $current_version to $latest_clean"
48+
if [ "${latest_clean}" != "${current_version}" ]; then
49+
echo "✅ Update available: ${current_version} → ${latest_clean}"
3850
echo "update_needed=true" >> $GITHUB_OUTPUT
39-
echo "current_version=$current_version" >> $GITHUB_OUTPUT
40-
echo "latest_version=$latest_clean" >> $GITHUB_OUTPUT
41-
echo "latest_version_tag=$latest_version" >> $GITHUB_OUTPUT
42-
43-
# Update qlt.conf.json with all properties
44-
echo "Updating qlt.conf.json with all properties for version $latest_clean"
45-
jq --arg cli_version "$latest_clean" \
46-
--arg std_lib "codeql-cli/$latest_version" \
47-
--arg bundle "codeql-bundle-$latest_version" \
48-
'.CodeQLCLI = $cli_version | .CodeQLStandardLibrary = $std_lib | .CodeQLCLIBundle = $bundle' \
49-
qlt.conf.json > qlt.conf.json.tmp && mv qlt.conf.json.tmp qlt.conf.json
50-
51-
echo "Updated qlt.conf.json contents:"
52-
cat qlt.conf.json
51+
echo "current_version=${current_version}" >> $GITHUB_OUTPUT
52+
echo "latest_version=${latest_clean}" >> $GITHUB_OUTPUT
53+
echo "version=v${latest_clean}" >> $GITHUB_OUTPUT
5354
else
54-
echo "CodeQL CLI is already up-to-date at version $current_version."
55+
echo "ℹ️ CodeQL CLI is already up-to-date at version ${current_version}"
5556
echo "update_needed=false" >> $GITHUB_OUTPUT
5657
fi
5758
58-
- name: Update - Install QLT
59-
if: steps.check-version.outputs.update_needed == 'true'
60-
id: install-qlt
61-
uses: advanced-security/codeql-development-toolkit/.github/actions/install-qlt@main
62-
with:
63-
qlt-version: 'latest'
64-
add-to-path: true
65-
66-
- name: Update - Install CodeQL
67-
if: steps.check-version.outputs.update_needed == 'true'
68-
shell: bash
69-
run: |
70-
echo "Installing CodeQL"
71-
qlt codeql run install
72-
echo "-----------------------------"
73-
echo "CodeQL Home: $QLT_CODEQL_HOME"
74-
echo "CodeQL Binary: $QLT_CODEQL_PATH"
75-
76-
- name: Update - Upgrade CodeQL pack lock files
77-
if: steps.check-version.outputs.update_needed == 'true'
78-
shell: bash
79-
run: |
80-
echo "Upgrading CodeQL pack lock files..."
81-
find . -name "qlpack.yml" -type f | sort | while read -r qlpack_file; do
82-
pack_dir=$(dirname "$qlpack_file")
83-
echo "Upgrading pack in directory: $pack_dir"
84-
cd "$pack_dir"
85-
$QLT_CODEQL_PATH pack upgrade
86-
cd - > /dev/null
87-
done
88-
echo "Finished upgrading all CodeQL pack lock files"
89-
90-
- name: Update - Create Pull Request
91-
if: steps.check-version.outputs.update_needed == 'true'
92-
uses: peter-evans/create-pull-request@v8
93-
with:
94-
title: "Upgrade CodeQL CLI dependency to ${{ steps.check-version.outputs.latest_version_tag }}"
95-
body: |
96-
This PR upgrades the CodeQL CLI version to ${{ steps.check-version.outputs.latest_version_tag }}.
97-
98-
**Changes made:**
99-
- Updated `CodeQLCLI` to `${{ steps.check-version.outputs.latest_version }}`
100-
- Updated `CodeQLStandardLibrary` to `codeql-cli/${{ steps.check-version.outputs.latest_version_tag }}`
101-
- Updated `CodeQLCLIBundle` to `codeql-bundle-${{ steps.check-version.outputs.latest_version_tag }}`
102-
- Upgraded all CodeQL pack lock files using `codeql pack upgrade`
103-
commit-message: "Upgrade CodeQL CLI dependency to ${{ steps.check-version.outputs.latest_version_tag }}"
104-
delete-branch: true
105-
branch: "codeql/upgrade-to-${{ steps.check-version.outputs.latest_version_tag }}"
106-
107-
- name: Update - Summary
59+
- name: Detect - Summary
10860
run: |
10961
echo "## CodeQL CLI Update Check" >> $GITHUB_STEP_SUMMARY
11062
echo "" >> $GITHUB_STEP_SUMMARY
11163
if [ "${{ steps.check-version.outputs.update_needed }}" == "true" ]; then
11264
echo "✅ Update available: ${{ steps.check-version.outputs.current_version }} → ${{ steps.check-version.outputs.latest_version }}" >> $GITHUB_STEP_SUMMARY
11365
echo "" >> $GITHUB_STEP_SUMMARY
114-
echo "| Property | Old Value | New Value |" >> $GITHUB_STEP_SUMMARY
115-
echo "| -------- | --------- | --------- |" >> $GITHUB_STEP_SUMMARY
116-
echo "| CodeQLCLI | ${{ steps.check-version.outputs.current_version }} | ${{ steps.check-version.outputs.latest_version }} |" >> $GITHUB_STEP_SUMMARY
117-
echo "| CodeQLStandardLibrary | — | codeql-cli/${{ steps.check-version.outputs.latest_version_tag }} |" >> $GITHUB_STEP_SUMMARY
118-
echo "| CodeQLCLIBundle | — | codeql-bundle-${{ steps.check-version.outputs.latest_version_tag }} |" >> $GITHUB_STEP_SUMMARY
119-
echo "" >> $GITHUB_STEP_SUMMARY
120-
echo "A pull request has been created with these changes." >> $GITHUB_STEP_SUMMARY
66+
echo "Initiating release pipeline for \`v${{ steps.check-version.outputs.latest_version }}\`..." >> $GITHUB_STEP_SUMMARY
12167
else
122-
echo "ℹ️ CodeQL CLI is already up-to-date. No changes needed." >> $GITHUB_STEP_SUMMARY
68+
echo "ℹ️ CodeQL CLI is already up-to-date. No release needed." >> $GITHUB_STEP_SUMMARY
12369
fi
70+
71+
# ─────────────────────────────────────────────────────────────────────────────
72+
# Step 2: Create release tag
73+
#
74+
# Calls the same release-tag workflow used by release.yml. This ensures the
75+
# version update, CodeQL installation, pack lock upgrade, unit tests, and tag
76+
# creation all follow the same validated process.
77+
#
78+
# The release-tag environment approval gate provides human-in-the-loop review
79+
# before any changes are committed.
80+
# ─────────────────────────────────────────────────────────────────────────────
81+
ensure-tag:
82+
name: Ensure Release Tag
83+
needs: detect-update
84+
if: needs.detect-update.outputs.update_needed == 'true'
85+
permissions:
86+
contents: write
87+
uses: ./.github/workflows/release-tag.yml
88+
with:
89+
version: ${{ needs.detect-update.outputs.version }}
90+
91+
# ─────────────────────────────────────────────────────────────────────────────
92+
# Step 3: Publish and bundle CodeQL packs
93+
#
94+
# Calls the same release-codeql workflow used by release.yml. Publishes packs
95+
# to GHCR and bundles them as artifacts for the GitHub Release.
96+
# ─────────────────────────────────────────────────────────────────────────────
97+
publish-codeql:
98+
name: Publish CodeQL Packs
99+
needs: [detect-update, ensure-tag]
100+
if: needs.detect-update.outputs.update_needed == 'true'
101+
permissions:
102+
contents: read
103+
packages: write
104+
uses: ./.github/workflows/release-codeql.yml
105+
with:
106+
publish_codeql_packs: true
107+
version: ${{ needs.detect-update.outputs.version }}
108+
109+
# ─────────────────────────────────────────────────────────────────────────────
110+
# Step 4: Create GitHub Release
111+
#
112+
# Downloads the CodeQL pack bundles and creates the GitHub Release with
113+
# auto-generated release notes and attached pack artifacts.
114+
# ─────────────────────────────────────────────────────────────────────────────
115+
create-release:
116+
name: Create GitHub Release
117+
needs: [detect-update, ensure-tag, publish-codeql]
118+
if: >-
119+
always() && !failure() && !cancelled()
120+
&& needs.detect-update.outputs.update_needed == 'true'
121+
runs-on: ubuntu-latest
122+
123+
permissions:
124+
contents: write
125+
126+
steps:
127+
- name: Release - Download CodeQL pack artifacts
128+
uses: actions/download-artifact@v7
129+
with:
130+
name: codeql-pack-bundles-${{ needs.detect-update.outputs.version }}
131+
path: dist-packs
132+
133+
- name: Release - Create GitHub Release
134+
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
135+
with:
136+
files: |
137+
dist-packs/*.tar.gz
138+
generate_release_notes: true
139+
tag_name: ${{ needs.detect-update.outputs.version }}
140+
141+
- name: Release - Summary
142+
run: |
143+
VERSION="${{ needs.detect-update.outputs.version }}"
144+
RELEASE_NAME="${{ needs.detect-update.outputs.latest_version }}"
145+
echo "## Automated Release Summary" >> $GITHUB_STEP_SUMMARY
146+
echo "" >> $GITHUB_STEP_SUMMARY
147+
echo "Triggered by CodeQL CLI update: ${{ needs.detect-update.outputs.current_version }} → ${RELEASE_NAME}" >> $GITHUB_STEP_SUMMARY
148+
echo "" >> $GITHUB_STEP_SUMMARY
149+
echo "| Step | Status |" >> $GITHUB_STEP_SUMMARY
150+
echo "| ---- | ------ |" >> $GITHUB_STEP_SUMMARY
151+
echo "| Tag | ✅ ${VERSION} |" >> $GITHUB_STEP_SUMMARY
152+
echo "| CodeQL pack publish | ✅ Published to GHCR |" >> $GITHUB_STEP_SUMMARY
153+
echo "| GitHub Release | ✅ Created |" >> $GITHUB_STEP_SUMMARY

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,3 +77,6 @@ dbs
7777
.codeql/
7878
*.qlx
7979

80+
# workspace customization file
81+
codeql-sap-js.code-workspace
82+

‎scripts/install-packs.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,11 @@ EOF
3535
while [[ $# -gt 0 ]]; do
3636
case $1 in
3737
--framework)
38+
if [[ $# -lt 2 || "${2-}" == -* ]]; then
39+
echo "Error: --framework requires a value" >&2
40+
usage >&2
41+
exit 1
42+
fi
3843
FRAMEWORK="$2"
3944
shift 2
4045
;;

0 commit comments

Comments
 (0)