Skip to content

Commit f1e6f50

Browse files
lcarteylcartey
committed
Merge branch 'main' into lcartey/contracts
2 parents 6b8ba85 + ce5b364 commit f1e6f50

File tree

1,577 files changed

+19976
-4283
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,577 files changed

+19976
-4283
lines changed

‎.github/actions/check-permissions/action.yml

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Check current actor permissions
2+
description: |
3+
Checks whether the current actor has the specified permssions
4+
inputs:
5+
minimum-permission:
6+
description: |
7+
The minimum required permission. One of: read, write, admin
8+
required: true
9+
outputs:
10+
has-permission:
11+
description: "Whether the actor had the minimum required permission"
12+
value: ${{ steps.check-permission.outputs.has-permission }}
13+
14+
runs:
15+
using: composite
16+
steps:
17+
- uses: actions/github-script@v7
18+
id: check-permission
19+
env:
20+
INPUT_MINIMUM-PERMISSION: ${{ inputs.minimum-permission }}
21+
with:
22+
script: |
23+
// Valid permissions are none, read, write, admin (legacy base permissions)
24+
const permissionsRanking = ["none", "read", "write", "admin"];
25+
26+
// Note: core.getInput doesn't work by default in a composite action - in this case
27+
// it would try to fetch the input to the github-script instead of the action
28+
// itself. Instead, we set the appropriate magic env var with the actions input.
29+
// See: https://github.com/actions/runner/issues/665
30+
const minimumPermission = core.getInput('minimum-permission');
31+
if (!permissionsRanking.includes(minimumPermission)) {
32+
core.setFailed(`Invalid minimum permission: ${minimumPermission}`);
33+
return;
34+
}
35+
36+
const { data : { permission : actorPermission } } = await github.rest.repos.getCollaboratorPermissionLevel({
37+
owner: context.repo.owner,
38+
repo: context.repo.repo,
39+
username: context.actor
40+
});
41+
42+
// Confirm whether the actor permission is at least the selected permission
43+
const hasPermission = permissionsRanking.indexOf(minimumPermission) <= permissionsRanking.indexOf(actorPermission) ? "1" : "";
44+
core.setOutput('has-permission', hasPermission);
45+
if (!hasPermission) {
46+
core.info(`Current actor (${context.actor}) does not have the minimum required permission '${minimumPermission}' (has '${actorPermission}')`);
47+
} else {
48+
core.info(`Current actor (${context.actor}) has the minimum required permission '${minimumPermission}' (has '${actorPermission}')`);
49+
}

‎.github/dependabot.yml

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
version: 2
2+
updates:
3+
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
# Check for updates to GitHub Actions every week
8+
interval: "weekly"

‎.github/workflows/code-scanning-pack-gen.yml

+33-11
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ on:
88
- main
99
- next
1010
- "rc/**"
11-
1211
push:
1312
branches:
1413
- main
@@ -47,7 +46,7 @@ jobs:
4746

4847
- name: Cache CodeQL
4948
id: cache-codeql
50-
uses: actions/cache@v2.1.3
49+
uses: actions/cache@v4
5150
with:
5251
path: ${{ github.workspace }}/codeql_home
5352
key: codeql-home-${{ matrix.os }}-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library }}
@@ -69,15 +68,17 @@ jobs:
6968
- name: Determine ref for external help files
7069
id: determine-ref
7170
run: |
72-
if [[ $GITHUB_EVENT_NAME == "pull_request" || $GITHUB_EVENT_NAME == "merge_group" ]]; then
73-
echo "EXTERNAL_HELP_REF=$GITHUB_HEAD_REF" >> "$GITHUB_ENV"
71+
if [[ $GITHUB_EVENT_NAME == "pull_request" ]]; then
72+
EXTERNAL_HELP_REF="${{ github.event.pull_request.base.ref }}"
73+
elif [[ $GITHUB_EVENT_NAME == "merge_group" ]]; then
74+
EXTERNAL_HELP_REF="${{ github.event.merge_group.base_ref }}"
7475
else
75-
echo "EXTERNAL_HELP_REF=$GITHUB_REF" >> "$GITHUB_ENV"
76+
EXTERNAL_HELP_REF="$GITHUB_REF"
7677
fi
78+
echo "EXTERNAL_HELP_REF=$EXTERNAL_HELP_REF" >> "$GITHUB_ENV"
7779
echo "Using ref $EXTERNAL_HELP_REF for external help files."
7880
7981
- name: Checkout external help files
80-
continue-on-error: true
8182
id: checkout-external-help-files
8283
uses: actions/checkout@v4
8384
with:
@@ -98,15 +99,36 @@ jobs:
9899
CODEQL_HOME: ${{ github.workspace }}/codeql_home
99100
run: |
100101
PATH=$PATH:$CODEQL_HOME/codeql
101-
102-
codeql query compile --precompile --threads 0 cpp
103-
codeql query compile --precompile --threads 0 c
102+
# Precompile all queries, and use a compilation cache larger than default
103+
# to ensure we cache all the queries for later steps
104+
codeql query compile --precompile --threads 0 --compilation-cache-size=1024 cpp c
104105
105106
cd ..
106-
zip -r codeql-coding-standards/code-scanning-cpp-query-pack.zip codeql-coding-standards/c/ codeql-coding-standards/cpp/ codeql-coding-standards/.codeqlmanifest.json codeql-coding-standards/supported_codeql_configs.json codeql-coding-standards/scripts/configuration codeql-coding-standards/scripts/reports codeql-coding-standards/scripts/shared codeql-coding-standards/scripts/guideline_recategorization codeql-coding-standards/scripts/shared codeql-coding-standards/scripts/schemas
107+
zip -r codeql-coding-standards/code-scanning-cpp-query-pack.zip codeql-coding-standards/c/ codeql-coding-standards/cpp/ codeql-coding-standards/.codeqlmanifest.json codeql-coding-standards/supported_codeql_configs.json codeql-coding-standards/scripts/configuration codeql-coding-standards/scripts/reports codeql-coding-standards/scripts/shared codeql-coding-standards/scripts/guideline_recategorization codeql-coding-standards/schemas
107108
108109
- name: Upload GHAS Query Pack
109-
uses: actions/upload-artifact@v2
110+
uses: actions/upload-artifact@v4
110111
with:
111112
name: code-scanning-cpp-query-pack.zip
112113
path: code-scanning-cpp-query-pack.zip
114+
115+
- name: Create qlpack bundles
116+
env:
117+
CODEQL_HOME: ${{ github.workspace }}/codeql_home
118+
run: |
119+
PATH=$PATH:$CODEQL_HOME/codeql
120+
121+
codeql pack bundle --output=common-cpp-coding-standards.tgz cpp/common/src
122+
codeql pack bundle --output=common-c-coding-standards.tgz c/common/src
123+
codeql pack bundle --output=misra-c-coding-standards.tgz c/misra/src
124+
codeql pack bundle --output=cert-c-coding-standards.tgz c/cert/src
125+
codeql pack bundle --output=cert-cpp-coding-standards.tgz cpp/cert/src
126+
codeql pack bundle --output=autosar-cpp-coding-standards.tgz cpp/autosar/src
127+
codeql pack bundle --output=misra-cpp-coding-standards.tgz cpp/misra/src
128+
codeql pack bundle --output=report-coding-standards.tgz cpp/report/src
129+
130+
- name: Upload qlpack bundles
131+
uses: actions/upload-artifact@v4
132+
with:
133+
name: coding-standards-codeql-packs
134+
path: '*-coding-standards.tgz'

‎.github/workflows/codeql_unit_tests.yml

+11-4
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ jobs:
4848
uses: actions/checkout@v4
4949

5050
- name: Install Python
51-
uses: actions/setup-python@v4
51+
uses: actions/setup-python@v5
5252
with:
5353
python-version: "3.9"
5454

@@ -57,7 +57,7 @@ jobs:
5757

5858
- name: Cache CodeQL
5959
id: cache-codeql
60-
uses: actions/cache@v3
60+
uses: actions/cache@v4
6161
with:
6262
# A list of files, directories, and wildcard patterns to cache and restore
6363
path: ${{github.workspace}}/codeql_home
@@ -151,7 +151,7 @@ jobs:
151151
file.close()
152152
153153
- name: Upload test results
154-
uses: actions/upload-artifact@v3
154+
uses: actions/upload-artifact@v4
155155
with:
156156
name: ${{ matrix.language }}-test-results-${{ runner.os }}-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library_ident }}
157157
path: |
@@ -160,11 +160,18 @@ jobs:
160160

161161
validate-test-results:
162162
name: Validate test results
163+
if: ${{ always() }}
163164
needs: run-test-suites
164165
runs-on: ubuntu-22.04
165166
steps:
167+
- name: Check if run-test-suites job failed to complete, if so fail
168+
if: ${{ needs.run-test-suites.result == 'failure' }}
169+
uses: actions/github-script@v7
170+
with:
171+
script: |
172+
core.setFailed('Test run job failed')
166173
- name: Collect test results
167-
uses: actions/download-artifact@v3
174+
uses: actions/download-artifact@v4
168175

169176
- name: Validate test results
170177
run: |

‎.github/workflows/dispatch-matrix-check.yml

-39
This file was deleted.

‎.github/workflows/dispatch-matrix-test-on-comment.yml

+31-28
Original file line numberDiff line numberDiff line change
@@ -3,42 +3,45 @@ name: 🤖 Run Matrix Check (On Comment)
33
on:
44
issue_comment:
55
types: [created]
6-
branches:
7-
- main
8-
- "rc/**"
9-
- next
10-
116

127
jobs:
138
dispatch-matrix-check:
149
runs-on: ubuntu-22.04
1510
steps:
11+
- name: Checkout repository
12+
uses: actions/checkout@v4
1613

17-
- name: Test Variables
18-
shell: pwsh
19-
run: |
20-
Write-Host "Running as: ${{github.actor}}"
21-
22-
$actor = "${{github.actor}}"
23-
24-
$acl = @("jsinglet","mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "kraiouchkine")
25-
26-
if(-not ($actor -in $acl)){
27-
throw "Refusing to run workflow for user not in acl."
28-
}
29-
30-
31-
- name: Dispatch Matrix Testing Job
32-
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') }}
33-
uses: peter-evans/repository-dispatch@v2
14+
- name: Check permission
15+
id: check-write-permission
16+
uses: ./.github/actions/check-permissions
3417
with:
35-
token: ${{ secrets.RELEASE_ENGINEERING_TOKEN }}
36-
repository: github/codeql-coding-standards-release-engineering
37-
event-type: matrix-test
38-
client-payload: '{"pr": "${{ github.event.issue.number }}"}'
18+
minimum-permission: "write"
3919

40-
- uses: actions/github-script@v6
41-
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') }}
20+
- name: Generate token
21+
id: generate-token
22+
uses: actions/create-github-app-token@v1
23+
with:
24+
app-id: ${{ vars.AUTOMATION_APP_ID }}
25+
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
26+
owner: ${{ github.repository_owner }}
27+
repositories: "codeql-coding-standards-release-engineering"
28+
29+
- name: Invoke matrix testing job
30+
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') && steps.check-write-permission.outputs.has-permission }}
31+
env:
32+
ISSUE_NR: ${{ github.event.issue.number }}
33+
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
34+
run: |
35+
jq -n \
36+
--arg issue_nr "$ISSUE_NR" \
37+
'{"issue-nr": $issue_nr}' \
38+
| \
39+
gh workflow run pr-compiler-validation.yml \
40+
--json \
41+
-R github/codeql-coding-standards-release-engineering
42+
43+
- uses: actions/github-script@v7
44+
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') && steps.check-write-permission.outputs.has-permission }}
4245
with:
4346
script: |
4447
github.rest.issues.createComment({

‎.github/workflows/dispatch-release-performance-check.yml

+32-28
Original file line numberDiff line numberDiff line change
@@ -3,46 +3,50 @@ name: 🏁 Run Release Performance Check
33
on:
44
issue_comment:
55
types: [created]
6-
branches:
7-
- main
8-
- "rc/**"
9-
- next
106

117
jobs:
128
dispatch-matrix-check:
139
runs-on: ubuntu-22.04
1410
steps:
11+
- name: Checkout repository
12+
uses: actions/checkout@v4
1513

16-
- name: Test Variables
17-
shell: pwsh
18-
run: |
19-
Write-Host "Running as: ${{github.actor}}"
20-
21-
$actor = "${{github.actor}}"
22-
23-
$acl = @("jsinglet","mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "kraiouchkine")
24-
25-
if(-not ($actor -in $acl)){
26-
throw "Refusing to run workflow for user not in acl."
27-
}
28-
29-
- name: Dispatch Performance Testing Job
30-
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') }}
31-
uses: peter-evans/repository-dispatch@v2
14+
- name: Check permission
15+
id: check-write-permission
16+
uses: ./.github/actions/check-permissions
3217
with:
33-
token: ${{ secrets.RELEASE_ENGINEERING_TOKEN }}
34-
repository: github/codeql-coding-standards-release-engineering
35-
event-type: performance-test
36-
client-payload: '{"pr": "${{ github.event.issue.number }}"}'
37-
18+
minimum-permission: "write"
3819

39-
- uses: actions/github-script@v6
40-
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') }}
20+
- name: Generate token
21+
id: generate-token
22+
uses: actions/create-github-app-token@v1
23+
with:
24+
app-id: ${{ vars.AUTOMATION_APP_ID }}
25+
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
26+
owner: ${{ github.repository_owner }}
27+
repositories: "codeql-coding-standards-release-engineering"
28+
29+
- name: Invoke performance test
30+
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') && steps.check-write-permission.outputs.has-permission }}
31+
env:
32+
ISSUE_NR: ${{ github.event.issue.number }}
33+
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
34+
run: |
35+
jq -n \
36+
--arg issue_nr "$ISSUE_NR" \
37+
'{"issue-nr": $issue_nr}' \
38+
| \
39+
gh workflow run pr-performance-testing.yml \
40+
--json \
41+
-R github/codeql-coding-standards-release-engineering
42+
43+
- uses: actions/github-script@v7
44+
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') && steps.check-write-permission.outputs.has-permission }}
4145
with:
4246
script: |
4347
github.rest.issues.createComment({
4448
issue_number: context.issue.number,
4549
owner: context.repo.owner,
4650
repo: context.repo.repo,
4751
body: '🏁 Beep Boop! Performance testing for this PR has been initiated. Please check back later for results. Note that the query package generation step must complete before testing will start so it might be a minute. <br><br> :bulb: If you do not hear back from me please check my status! **I will report even if I fail!**'
48-
})
52+
})

0 commit comments

Comments
 (0)