Skip to content

Commit cdd085a

Browse files
data-douserdata-douser
authored
Merge branch 'main' into dependabot/npm_and_yarn/javascript/frameworks/cap/test/models/cds/entityreference/npm_and_yarn-762198da41
2 parents 5a261a8 + 7ebe6b9 commit cdd085a

File tree

8 files changed

+1261
-107
lines changed

8 files changed

+1261
-107
lines changed

‎.github/workflows/code_scanning.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727

2828
steps:
2929
- name: Checkout repository
30-
uses: actions/checkout@v5
30+
uses: actions/checkout@v6
3131

3232
- name: Prepare local CodeQL model packs
3333
run: |
@@ -92,7 +92,7 @@ jobs:
9292
9393
- name: Upload sarif change
9494
if: steps.validate.outcome != 'success'
95-
uses: actions/upload-artifact@v5
95+
uses: actions/upload-artifact@v6
9696
with:
9797
name: sarif
9898
path: |

‎.github/workflows/release-codeql.yml‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
name: Release CodeQL - Publish and Bundle CodeQL Packs
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
publish_codeql_packs:
7+
default: true
8+
description: 'Publish CodeQL packs to GHCR. Disable for pre-release or re-run scenarios where packs already exist.'
9+
required: false
10+
type: boolean
11+
version:
12+
description: 'Release version tag (e.g., vX.Y.Z or vX.Y.Z-suffix). Must start with "v".'
13+
required: true
14+
type: string
15+
outputs:
16+
release_name:
17+
description: 'The release name without "v" prefix (e.g., X.Y.Z or X.Y.Z-alpha)'
18+
value: ${{ jobs.publish-codeql-packs.outputs.release_name }}
19+
version:
20+
description: 'The full version string with "v" prefix (e.g., vX.Y.Z or vX.Y.Z-alpha)'
21+
value: ${{ jobs.publish-codeql-packs.outputs.version }}
22+
23+
# Note: This workflow is called exclusively via workflow_call from release.yml.
24+
# It does NOT have a workflow_dispatch trigger to keep release.yml as the single
25+
# entry point for all release operations. To re-publish CodeQL packs standalone,
26+
# use workflow_dispatch on release.yml with create_github_release=false.
27+
28+
permissions:
29+
contents: read
30+
31+
jobs:
32+
publish-codeql-packs:
33+
name: Publish and Bundle CodeQL Packs
34+
runs-on: ubuntu-latest
35+
36+
environment: release-codeql
37+
38+
permissions:
39+
contents: read
40+
packages: write
41+
42+
outputs:
43+
release_name: ${{ steps.version.outputs.release_name }}
44+
version: ${{ steps.version.outputs.version }}
45+
46+
env:
47+
PUBLISHABLE_PACKS_LIST: |
48+
javascript/frameworks/cap/src
49+
javascript/frameworks/cap/ext
50+
javascript/frameworks/cap/lib
51+
javascript/frameworks/ui5/src
52+
javascript/frameworks/ui5/ext
53+
javascript/frameworks/ui5/lib
54+
javascript/frameworks/xsjs/src
55+
javascript/frameworks/xsjs/ext
56+
javascript/frameworks/xsjs/lib
57+
javascript/heuristic-models/ext
58+
59+
steps:
60+
- name: CodeQL - Validate and parse version
61+
id: version
62+
run: |
63+
VERSION="${{ inputs.version }}"
64+
if [[ ! "${VERSION}" =~ ^v ]]; then
65+
echo "::error::Version '${VERSION}' must start with 'v'"
66+
exit 1
67+
fi
68+
echo "version=${VERSION}" >> $GITHUB_OUTPUT
69+
echo "release_name=${VERSION#v}" >> $GITHUB_OUTPUT
70+
71+
- name: CodeQL - Checkout tag
72+
uses: actions/checkout@v6
73+
with:
74+
ref: refs/tags/${{ steps.version.outputs.version }}
75+
76+
- name: CodeQL - Install QLT
77+
id: install-qlt
78+
uses: advanced-security/codeql-development-toolkit/.github/actions/install-qlt@main
79+
with:
80+
qlt-version: 'latest'
81+
add-to-path: true
82+
83+
- name: CodeQL - Install CodeQL
84+
shell: bash
85+
run: |
86+
echo "Installing CodeQL"
87+
qlt codeql run install
88+
echo "-----------------------------"
89+
echo "CodeQL Home: $QLT_CODEQL_HOME"
90+
echo "CodeQL Binary: $QLT_CODEQL_PATH"
91+
92+
- name: CodeQL - Install pack dependencies
93+
shell: bash
94+
run: |
95+
export PATH="$(dirname "$QLT_CODEQL_PATH"):$PATH"
96+
chmod +x ./scripts/install-packs.sh
97+
./scripts/install-packs.sh
98+
99+
- name: CodeQL - Validate version consistency
100+
run: |
101+
RELEASE_NAME="${{ steps.version.outputs.release_name }}"
102+
echo "Validating all version-bearing files match ${RELEASE_NAME}..."
103+
chmod +x ./scripts/update-release-version.sh
104+
./scripts/update-release-version.sh --check "${RELEASE_NAME}"
105+
106+
- name: CodeQL - Publish CodeQL packs
107+
if: inputs.publish_codeql_packs
108+
env:
109+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
110+
run: |
111+
# Read the shared pack list from the job-level environment variable.
112+
mapfile -t PUBLISHABLE_PACKS <<< "${PUBLISHABLE_PACKS_LIST}"
113+
114+
echo "Publishing CodeQL packs..."
115+
for pack_dir in "${PUBLISHABLE_PACKS[@]}"; do
116+
if [ -d "${pack_dir}" ]; then
117+
pack_name=$(grep -m1 "^name:" "${pack_dir}/qlpack.yml" | awk '{print $2}')
118+
echo "📦 Publishing ${pack_name} from ${pack_dir}..."
119+
$QLT_CODEQL_PATH pack publish --threads=-1 -- "${pack_dir}"
120+
echo "✅ Published ${pack_name}"
121+
else
122+
echo "⚠️ Skipping: ${pack_dir} not found"
123+
fi
124+
done
125+
126+
- name: CodeQL - Skip pack publishing
127+
if: '!inputs.publish_codeql_packs'
128+
run: echo "⏭️ CodeQL pack publishing disabled via workflow input"
129+
130+
- name: CodeQL - Bundle CodeQL packs
131+
run: |
132+
mkdir -p dist-packs
133+
134+
# Bundle all publishable packs
135+
# Read the pack list from the environment into a Bash array.
136+
# Each line in PUBLISHABLE_PACKS_LIST becomes one element.
137+
mapfile -t PUBLISHABLE_PACKS <<< "${PUBLISHABLE_PACKS_LIST}"
138+
139+
echo "Bundling CodeQL packs..."
140+
for pack_dir in "${PUBLISHABLE_PACKS[@]}"; do
141+
if [ -d "${pack_dir}" ]; then
142+
pack_name=$(grep -m1 "^name:" "${pack_dir}/qlpack.yml" | awk '{print $2}')
143+
# Convert pack name to filename: advanced-security/foo -> foo
144+
bundle_name="${pack_name#advanced-security/}"
145+
output="dist-packs/${bundle_name}.tar.gz"
146+
echo "📦 Bundling ${pack_name} -> ${output}..."
147+
$QLT_CODEQL_PATH pack bundle --threads=-1 --output="${output}" -- "${pack_dir}"
148+
echo "✅ Bundled ${bundle_name}"
149+
fi
150+
done
151+
echo ""
152+
echo "Bundled packs:"
153+
ls -lh dist-packs/
154+
155+
- name: CodeQL - Upload pack artifacts
156+
uses: actions/upload-artifact@v6
157+
with:
158+
name: codeql-pack-bundles-${{ steps.version.outputs.version }}
159+
path: dist-packs/*.tar.gz
160+
161+
- name: CodeQL - Summary
162+
run: |
163+
VERSION="${{ steps.version.outputs.version }}"
164+
RELEASE_NAME="${{ steps.version.outputs.release_name }}"
165+
echo "## CodeQL Packs Summary" >> $GITHUB_STEP_SUMMARY
166+
echo "" >> $GITHUB_STEP_SUMMARY
167+
if [ "${{ inputs.publish_codeql_packs }}" == "true" ]; then
168+
echo "✅ Published CodeQL packs to GHCR" >> $GITHUB_STEP_SUMMARY
169+
else
170+
echo "⏭️ CodeQL pack publishing was disabled" >> $GITHUB_STEP_SUMMARY
171+
fi
172+
echo "✅ Bundled CodeQL packs as artifacts" >> $GITHUB_STEP_SUMMARY
173+
echo "" >> $GITHUB_STEP_SUMMARY
174+
echo "### CodeQL Packs" >> $GITHUB_STEP_SUMMARY
175+
echo "| Pack | Version |" >> $GITHUB_STEP_SUMMARY
176+
echo "| ---- | ------- |" >> $GITHUB_STEP_SUMMARY
177+
echo "| \`advanced-security/javascript-sap-cap-queries\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
178+
echo "| \`advanced-security/javascript-sap-cap-models\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
179+
echo "| \`advanced-security/javascript-sap-cap-all\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
180+
echo "| \`advanced-security/javascript-sap-ui5-queries\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
181+
echo "| \`advanced-security/javascript-sap-ui5-models\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
182+
echo "| \`advanced-security/javascript-sap-ui5-all\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
183+
echo "| \`advanced-security/javascript-sap-xsjs-queries\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
184+
echo "| \`advanced-security/javascript-sap-xsjs-models\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
185+
echo "| \`advanced-security/javascript-sap-xsjs-all\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
186+
echo "| \`advanced-security/javascript-heuristic-models\` | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)