Skip to content

Commit 3f9ca22

Browse files
data-douserdata-douser
committed
Refactor release mgmt workflows to use environments
New workflows: - release.yml: orchestrates tag creation, CodeQL pack publish, and GitHub Release creation (supports tag push and workflow_dispatch) - release-tag.yml: validates, version-bumps, tests, and tags releases - release-codeql.yml: publishes and bundles CodeQL packs to GHCR New scripts: - scripts/update-release-version.sh: deterministic version updates across all 15 qlpack.yml files with --check and --dry-run modes - scripts/install-packs.sh: installs CodeQL pack dependencies with optional --framework filtering Modified: - update-codeql.yml: reformatted indentation, added job summary step, preserved current_version output for summary reporting
1 parent adc55bb commit 3f9ca22

6 files changed

Lines changed: 1137 additions & 105 deletions

File tree

‎.github/workflows/release-codeql.yml‎

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
name: Release CodeQL - Publish and Bundle CodeQL Packs
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
publish_codeql_packs:
7+
default: true
8+
description: 'Publish CodeQL packs to GHCR. Disable for pre-release or re-run scenarios where packs already exist.'
9+
required: false
10+
type: boolean
11+
version:
12+
description: 'Release version tag (e.g., vX.Y.Z). Must start with "v".'
13+
required: true
14+
type: string
15+
outputs:
16+
release_name:
17+
description: 'The release name without "v" prefix (e.g., X.Y.Z)'
18+
value: ${{ jobs.publish-codeql-packs.outputs.release_name }}
19+
version:
20+
description: 'The full version string with "v" prefix (e.g., vX.Y.Z)'
21+
value: ${{ jobs.publish-codeql-packs.outputs.version }}
22+
23+
# Note: This workflow is called exclusively via workflow_call from release.yml.
24+
# It does NOT have a workflow_dispatch trigger to keep release.yml as the single
25+
# entry point for all release operations. To re-publish CodeQL packs standalone,
26+
# use workflow_dispatch on release.yml with create_github_release=false.
27+
28+
permissions:
29+
contents: read
30+
31+
jobs:
32+
publish-codeql-packs:
33+
name: Publish and Bundle CodeQL Packs
34+
runs-on: ubuntu-latest
35+
36+
environment: release-codeql
37+
38+
permissions:
39+
contents: read
40+
packages: write
41+
42+
outputs:
43+
release_name: ${{ steps.version.outputs.release_name }}
44+
version: ${{ steps.version.outputs.version }}
45+
46+
steps:
47+
- name: CodeQL - Validate and parse version
48+
id: version
49+
run: |
50+
VERSION="${{ inputs.version }}"
51+
if [[ ! "${VERSION}" =~ ^v ]]; then
52+
echo "::error::Version '${VERSION}' must start with 'v'"
53+
exit 1
54+
fi
55+
echo "version=${VERSION}" >> $GITHUB_OUTPUT
56+
echo "release_name=${VERSION#v}" >> $GITHUB_OUTPUT
57+
58+
- name: CodeQL - Checkout tag
59+
uses: actions/checkout@v6
60+
with:
61+
ref: refs/tags/${{ steps.version.outputs.version }}
62+
63+
- name: CodeQL - Install QLT
64+
id: install-qlt
65+
uses: advanced-security/codeql-development-toolkit/.github/actions/install-qlt@main
66+
with:
67+
qlt-version: 'latest'
68+
add-to-path: true
69+
70+
- name: CodeQL - Install CodeQL
71+
shell: bash
72+
run: |
73+
echo "Installing CodeQL"
74+
qlt codeql run install
75+
echo "-----------------------------"
76+
echo "CodeQL Home: $QLT_CODEQL_HOME"
77+
echo "CodeQL Binary: $QLT_CODEQL_PATH"
78+
79+
- name: CodeQL - Install pack dependencies
80+
shell: bash
81+
run: |
82+
qlt query run install-packs
83+
84+
- name: CodeQL - Validate version consistency
85+
run: |
86+
RELEASE_NAME="${{ steps.version.outputs.release_name }}"
87+
echo "Validating all version-bearing files match ${RELEASE_NAME}..."
88+
chmod +x ./scripts/update-release-version.sh
89+
./scripts/update-release-version.sh --check "${RELEASE_NAME}"
90+
91+
- name: CodeQL - Publish CodeQL packs
92+
if: inputs.publish_codeql_packs
93+
env:
94+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
95+
run: |
96+
# Publishable packs: queries, models (ext), and libraries (lib)
97+
PUBLISHABLE_PACKS=(
98+
"javascript/frameworks/cap/src"
99+
"javascript/frameworks/cap/ext"
100+
"javascript/frameworks/cap/lib"
101+
"javascript/frameworks/ui5/src"
102+
"javascript/frameworks/ui5/ext"
103+
"javascript/frameworks/ui5/lib"
104+
"javascript/frameworks/xsjs/src"
105+
"javascript/frameworks/xsjs/ext"
106+
"javascript/frameworks/xsjs/lib"
107+
"javascript/heuristic-models/ext"
108+
)
109+
110+
echo "Publishing CodeQL packs..."
111+
for pack_dir in "${PUBLISHABLE_PACKS[@]}"; do
112+
if [ -d "${pack_dir}" ]; then
113+
pack_name=$(grep -m1 "^name:" "${pack_dir}/qlpack.yml" | awk '{print $2}')
114+
echo "📦 Publishing ${pack_name} from ${pack_dir}..."
115+
$QLT_CODEQL_PATH pack publish --threads=-1 -- "${pack_dir}"
116+
echo "✅ Published ${pack_name}"
117+
else
118+
echo "⚠️ Skipping: ${pack_dir} not found"
119+
fi
120+
done
121+
122+
- name: CodeQL - Skip pack publishing
123+
if: '!inputs.publish_codeql_packs'
124+
run: echo "⏭️ CodeQL pack publishing disabled via workflow input"
125+
126+
- name: CodeQL - Bundle CodeQL packs
127+
run: |
128+
mkdir -p dist-packs
129+
130+
# Bundle all publishable packs
131+
PUBLISHABLE_PACKS=(
132+
"javascript/frameworks/cap/src"
133+
"javascript/frameworks/cap/ext"
134+
"javascript/frameworks/cap/lib"
135+
"javascript/frameworks/ui5/src"
136+
"javascript/frameworks/ui5/ext"
137+
"javascript/frameworks/ui5/lib"
138+
"javascript/frameworks/xsjs/src"
139+
"javascript/frameworks/xsjs/ext"
140+
"javascript/frameworks/xsjs/lib"
141+
"javascript/heuristic-models/ext"
142+
)
143+
144+
echo "Bundling CodeQL packs..."
145+
for pack_dir in "${PUBLISHABLE_PACKS[@]}"; do
146+
if [ -d "${pack_dir}" ]; then
147+
pack_name=$(grep -m1 "^name:" "${pack_dir}/qlpack.yml" | awk '{print $2}')
148+
# Convert pack name to filename: advanced-security/foo -> foo
149+
bundle_name="${pack_name#advanced-security/}"
150+
output="dist-packs/${bundle_name}.tar.gz"
151+
echo "📦 Bundling ${pack_name} -> ${output}..."
152+
$QLT_CODEQL_PATH pack bundle --threads=-1 --output="${output}" -- "${pack_dir}"
153+
echo "✅ Bundled ${bundle_name}"
154+
fi
155+
done
156+
echo ""
157+
echo "Bundled packs:"
158+
ls -lh dist-packs/
159+
160+
- name: CodeQL - Upload pack artifacts
161+
uses: actions/upload-artifact@v6
162+
with:
163+
name: codeql-pack-bundles-${{ steps.version.outputs.version }}
164+
path: dist-packs/*.tar.gz
165+
166+
- name: CodeQL - Summary
167+
run: |
168+
VERSION="${{ steps.version.outputs.version }}"
169+
RELEASE_NAME="${{ steps.version.outputs.release_name }}"
170+
echo "## CodeQL Packs Summary" >> $GITHUB_STEP_SUMMARY
171+
echo "" >> $GITHUB_STEP_SUMMARY
172+
if [ "${{ inputs.publish_codeql_packs }}" == "true" ]; then
173+
echo "✅ Published CodeQL packs to GHCR" >> $GITHUB_STEP_SUMMARY
174+
else
175+
echo "⏭️ CodeQL pack publishing was disabled" >> $GITHUB_STEP_SUMMARY
176+
fi
177+
echo "✅ Bundled CodeQL packs as artifacts" >> $GITHUB_STEP_SUMMARY
178+
echo "" >> $GITHUB_STEP_SUMMARY
179+
echo "### CodeQL Packs" >> $GITHUB_STEP_SUMMARY
180+
echo "| Pack | Version |" >> $GITHUB_STEP_SUMMARY
181+
echo "| ---- | ------- |" >> $GITHUB_STEP_SUMMARY
182+
echo "| \`advanced-security/javascript-sap-cap-queries\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
183+
echo "| \`advanced-security/javascript-sap-cap-models\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
184+
echo "| \`advanced-security/javascript-sap-cap-all\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
185+
echo "| \`advanced-security/javascript-sap-ui5-queries\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
186+
echo "| \`advanced-security/javascript-sap-ui5-models\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
187+
echo "| \`advanced-security/javascript-sap-ui5-all\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
188+
echo "| \`advanced-security/javascript-sap-xsjs-queries\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
189+
echo "| \`advanced-security/javascript-sap-xsjs-models\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
190+
echo "| \`advanced-security/javascript-sap-xsjs-all\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
191+
echo "| \`advanced-security/javascript-heuristic-models\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)