Skip to content

Commit d045bf6

Browse files
data-douserdata-douser
authored
Upgrade to CodeQL v2.24.2 and fix release-codeql.yml workflow (#318)
* Upgrade CodeQL CLI dependency to v2.24.2 * Use workspace references for workspace-local qlpacks * Update required codeql/javascript-all version in packs Updates the required minimum version of "codeql/javascript-all" pack dependency to improve consistency across qlpack definitions while better reflecting the actual version of the dependency that actually gets installed for the current CodeQL CLI version. * Support codeql pack publish --allow-prerelease * refactor: convert pack bundle & publish to scripts Move the inline pack publishing and bundling logic from the release-codeql workflow into dedicated scripts: - scripts/publish-packs.sh: Publishes all CodeQL packs to GHCR with pre-release detection, token validation, and dry-run support. - scripts/bundle-packs.sh: Bundles all CodeQL packs into .tar.gz archives with configurable output directory and dry-run support.
1 parent 250c1c9 commit d045bf6

30 files changed

+665
-247
lines changed

‎.github/workflows/release-codeql.yml‎

Lines changed: 3 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -43,19 +43,6 @@ jobs:
4343
release_name: ${{ steps.version.outputs.release_name }}
4444
version: ${{ steps.version.outputs.version }}
4545

46-
env:
47-
PUBLISHABLE_PACKS_LIST: |
48-
javascript/frameworks/cap/src
49-
javascript/frameworks/cap/ext
50-
javascript/frameworks/cap/lib
51-
javascript/frameworks/ui5/src
52-
javascript/frameworks/ui5/ext
53-
javascript/frameworks/ui5/lib
54-
javascript/frameworks/xsjs/src
55-
javascript/frameworks/xsjs/ext
56-
javascript/frameworks/xsjs/lib
57-
javascript/heuristic-models/ext
58-
5946
steps:
6047
- name: CodeQL - Validate and parse version
6148
id: version
@@ -91,9 +78,7 @@ jobs:
9178
9279
- name: CodeQL - Install pack dependencies
9380
shell: bash
94-
run: |
95-
chmod +x ./scripts/install-packs.sh
96-
./scripts/install-packs.sh
81+
run: ./scripts/install-packs.sh
9782

9883
- name: CodeQL - Validate version consistency
9984
run: |
@@ -106,50 +91,14 @@ jobs:
10691
if: inputs.publish_codeql_packs
10792
env:
10893
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
109-
run: |
110-
# Read the shared pack list from the job-level environment variable.
111-
mapfile -t PUBLISHABLE_PACKS <<< "${PUBLISHABLE_PACKS_LIST}"
112-
113-
echo "Publishing CodeQL packs..."
114-
for pack_dir in "${PUBLISHABLE_PACKS[@]}"; do
115-
if [ -d "${pack_dir}" ]; then
116-
pack_name=$(grep -m1 "^name:" "${pack_dir}/qlpack.yml" | awk '{print $2}')
117-
echo "📦 Publishing ${pack_name} from ${pack_dir}..."
118-
echo "${GITHUB_TOKEN}" | codeql pack publish --github-auth-stdin --threads=-1 -- "${pack_dir}"
119-
echo "✅ Published ${pack_name}"
120-
else
121-
echo "⚠️ Skipping: ${pack_dir} not found"
122-
fi
123-
done
94+
run: ./scripts/publish-packs.sh "${{ steps.version.outputs.release_name }}"
12495

12596
- name: CodeQL - Skip pack publishing
12697
if: '!inputs.publish_codeql_packs'
12798
run: echo "⏭️ CodeQL pack publishing disabled via workflow input"
12899

129100
- name: CodeQL - Bundle CodeQL packs
130-
run: |
131-
mkdir -p dist-packs
132-
133-
# Bundle all publishable packs
134-
# Read the pack list from the environment into a Bash array.
135-
# Each line in PUBLISHABLE_PACKS_LIST becomes one element.
136-
mapfile -t PUBLISHABLE_PACKS <<< "${PUBLISHABLE_PACKS_LIST}"
137-
138-
echo "Bundling CodeQL packs..."
139-
for pack_dir in "${PUBLISHABLE_PACKS[@]}"; do
140-
if [ -d "${pack_dir}" ]; then
141-
pack_name=$(grep -m1 "^name:" "${pack_dir}/qlpack.yml" | awk '{print $2}')
142-
# Convert pack name to filename: advanced-security/foo -> foo
143-
bundle_name="${pack_name#advanced-security/}"
144-
output="dist-packs/${bundle_name}.tar.gz"
145-
echo "📦 Bundling ${pack_name} -> ${output}..."
146-
codeql pack bundle --threads=-1 --output="${output}" -- "${pack_dir}"
147-
echo "✅ Bundled ${bundle_name}"
148-
fi
149-
done
150-
echo ""
151-
echo "Bundled packs:"
152-
ls -lh dist-packs/
101+
run: ./scripts/bundle-packs.sh --output-dir dist-packs
153102

154103
- name: CodeQL - Upload pack artifacts
155104
uses: actions/upload-artifact@v6

‎javascript/frameworks/cap/ext/qlpack.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
library: true
33
name: advanced-security/javascript-sap-cap-models
4-
version: 2.3.0
4+
version: 2.24.2
55
extensionTargets:
6-
codeql/javascript-all: "^2.4.0"
6+
codeql/javascript-all: "^2.6.22"

‎javascript/frameworks/cap/lib/codeql-pack.lock.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,29 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/concepts:
5-
version: 0.0.15
5+
version: 0.0.16
66
codeql/controlflow:
7-
version: 2.0.25
7+
version: 2.0.26
88
codeql/dataflow:
9-
version: 2.0.25
9+
version: 2.0.26
1010
codeql/javascript-all:
11-
version: 2.6.21
11+
version: 2.6.22
1212
codeql/mad:
13-
version: 1.0.41
13+
version: 1.0.42
1414
codeql/regex:
15-
version: 1.0.41
15+
version: 1.0.42
1616
codeql/ssa:
17-
version: 2.0.17
17+
version: 2.0.18
1818
codeql/threat-models:
19-
version: 1.0.41
19+
version: 1.0.42
2020
codeql/tutorial:
21-
version: 1.0.41
21+
version: 1.0.42
2222
codeql/typetracking:
23-
version: 2.0.25
23+
version: 2.0.26
2424
codeql/util:
25-
version: 2.0.28
25+
version: 2.0.29
2626
codeql/xml:
27-
version: 1.0.41
27+
version: 1.0.42
2828
codeql/yaml:
29-
version: 1.0.41
29+
version: 1.0.42
3030
compiled: false

‎javascript/frameworks/cap/lib/qlpack.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
library: true
33
name: advanced-security/javascript-sap-cap-all
4-
version: 2.3.0
4+
version: 2.24.2
55
suites: codeql-suites
66
extractor: javascript
77
dependencies:
8-
codeql/javascript-all: "^2.4.0"
8+
codeql/javascript-all: "^2.6.22"

‎javascript/frameworks/cap/src/codeql-pack.lock.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,29 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/concepts:
5-
version: 0.0.15
5+
version: 0.0.16
66
codeql/controlflow:
7-
version: 2.0.25
7+
version: 2.0.26
88
codeql/dataflow:
9-
version: 2.0.25
9+
version: 2.0.26
1010
codeql/javascript-all:
11-
version: 2.6.21
11+
version: 2.6.22
1212
codeql/mad:
13-
version: 1.0.41
13+
version: 1.0.42
1414
codeql/regex:
15-
version: 1.0.41
15+
version: 1.0.42
1616
codeql/ssa:
17-
version: 2.0.17
17+
version: 2.0.18
1818
codeql/threat-models:
19-
version: 1.0.41
19+
version: 1.0.42
2020
codeql/tutorial:
21-
version: 1.0.41
21+
version: 1.0.42
2222
codeql/typetracking:
23-
version: 2.0.25
23+
version: 2.0.26
2424
codeql/util:
25-
version: 2.0.28
25+
version: 2.0.29
2626
codeql/xml:
27-
version: 1.0.41
27+
version: 1.0.42
2828
codeql/yaml:
29-
version: 1.0.41
29+
version: 1.0.42
3030
compiled: false

‎javascript/frameworks/cap/src/qlpack.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
---
22
library: false
33
name: advanced-security/javascript-sap-cap-queries
4-
version: 2.3.0
4+
version: 2.24.2
55
suites: codeql-suites
66
extractor: javascript
77
dependencies:
8-
codeql/javascript-all: "^2.4.0"
9-
advanced-security/javascript-sap-cap-all: "^2.3.0"
8+
codeql/javascript-all: "^2.6.22"
9+
advanced-security/javascript-sap-cap-all: "${workspace}"
1010
default-suite-file: codeql-suites/javascript-code-scanning.qls

‎javascript/frameworks/cap/test/codeql-pack.lock.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,29 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/concepts:
5-
version: 0.0.15
5+
version: 0.0.16
66
codeql/controlflow:
7-
version: 2.0.25
7+
version: 2.0.26
88
codeql/dataflow:
9-
version: 2.0.25
9+
version: 2.0.26
1010
codeql/javascript-all:
11-
version: 2.6.21
11+
version: 2.6.22
1212
codeql/mad:
13-
version: 1.0.41
13+
version: 1.0.42
1414
codeql/regex:
15-
version: 1.0.41
15+
version: 1.0.42
1616
codeql/ssa:
17-
version: 2.0.17
17+
version: 2.0.18
1818
codeql/threat-models:
19-
version: 1.0.41
19+
version: 1.0.42
2020
codeql/tutorial:
21-
version: 1.0.41
21+
version: 1.0.42
2222
codeql/typetracking:
23-
version: 2.0.25
23+
version: 2.0.26
2424
codeql/util:
25-
version: 2.0.28
25+
version: 2.0.29
2626
codeql/xml:
27-
version: 1.0.41
27+
version: 1.0.42
2828
codeql/yaml:
29-
version: 1.0.41
29+
version: 1.0.42
3030
compiled: false

‎javascript/frameworks/cap/test/qlpack.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
name: advanced-security/javascript-sap-cap-queries-tests
3-
version: 2.3.0
3+
version: 2.24.2
44
extractor: javascript
55
dependencies:
6-
codeql/javascript-all: "^2.4.0"
7-
advanced-security/javascript-sap-cap-queries: "^2.3.0"
8-
advanced-security/javascript-sap-cap-models: "^2.3.0"
9-
advanced-security/javascript-sap-cap-all: "^2.3.0"
6+
codeql/javascript-all: "^2.6.22"
7+
advanced-security/javascript-sap-cap-queries: "${workspace}"
8+
advanced-security/javascript-sap-cap-models: "${workspace}"
9+
advanced-security/javascript-sap-cap-all: "${workspace}"

‎javascript/frameworks/ui5-webcomponents/test/codeql-pack.lock.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,29 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/concepts:
5-
version: 0.0.15
5+
version: 0.0.16
66
codeql/controlflow:
7-
version: 2.0.25
7+
version: 2.0.26
88
codeql/dataflow:
9-
version: 2.0.25
9+
version: 2.0.26
1010
codeql/javascript-all:
11-
version: 2.6.21
11+
version: 2.6.22
1212
codeql/mad:
13-
version: 1.0.41
13+
version: 1.0.42
1414
codeql/regex:
15-
version: 1.0.41
15+
version: 1.0.42
1616
codeql/ssa:
17-
version: 2.0.17
17+
version: 2.0.18
1818
codeql/threat-models:
19-
version: 1.0.41
19+
version: 1.0.42
2020
codeql/tutorial:
21-
version: 1.0.41
21+
version: 1.0.42
2222
codeql/typetracking:
23-
version: 2.0.25
23+
version: 2.0.26
2424
codeql/util:
25-
version: 2.0.28
25+
version: 2.0.29
2626
codeql/xml:
27-
version: 1.0.41
27+
version: 1.0.42
2828
codeql/yaml:
29-
version: 1.0.41
29+
version: 1.0.42
3030
compiled: false

‎javascript/frameworks/ui5-webcomponents/test/qlpack.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: advanced-security/javascript-sap-ui5-webcomponents-for-react-test
2-
version: 2.3.0
2+
version: 2.24.2
33
extractor: javascript
44
dependencies:
5-
codeql/javascript-all: "^2.4.0"
6-
advanced-security/javascript-sap-ui5-all: "^2.3.0"
5+
codeql/javascript-all: "^2.6.22"
6+
advanced-security/javascript-sap-ui5-all: "${workspace}"

0 commit comments

Comments
 (0)