Skip to content

Commit 938c702

Browse files
rachmarirachmari
authored
add CodeQL CLI automation workflow (#35603)
1 parent a1b7254 commit 938c702

1 file changed

Lines changed: 120 additions & 0 deletions

File tree

‎.github/workflows/sync-codeql-cli.yml‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
name: Sync CodeQl CLI
2+
3+
# **What it does**: This workflow is run manually approximately every two weeks.
4+
# When run, this workflow syncs the CodeQL CLI automated pipeline with the semmle-code
5+
# repository, and creates a pull request if there are updates.
6+
# **Why we have it**: So we can automate CodeQL CLI documentation.
7+
# **Who does it impact**: Anyone making CodeQL CLI changes in `github/semmle-code`, and wanting to get them published on the docs site.
8+
9+
on:
10+
workflow_dispatch:
11+
inputs:
12+
SOURCE_BRANCH:
13+
description: 'Branch to pull the source files from in the semmle-code repo.'
14+
type: string
15+
required: true
16+
default: 'main'
17+
18+
permissions:
19+
contents: write
20+
pull-requests: write
21+
22+
# This allows a subsequently queued workflow run to interrupt previous runs
23+
concurrency:
24+
group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
25+
cancel-in-progress: true
26+
27+
jobs:
28+
generate-decorated-files:
29+
if: github.repository == 'github/docs-internal'
30+
runs-on: ubuntu-latest
31+
steps:
32+
- if: ${{ env.FREEZE == 'true' }}
33+
run: |
34+
echo 'The repo is currently frozen! Exiting this workflow.'
35+
exit 1 # prevents further steps from running
36+
37+
- name: Checkout repository code
38+
uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
39+
40+
# Check out a nested repository inside of previous checkout
41+
- name: Checkout semmle-code repo
42+
uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
43+
with:
44+
# By default, only the most recent commit of the `main` branch
45+
# will be checked out
46+
repository: github/semmle-code
47+
path: semmle-code
48+
ref: ${{ github.event.inputs.SOURCE_BRANCH }}
49+
50+
- uses: ./.github/actions/node-npm-setup
51+
52+
- name: Get the semmle-code SHA being synced
53+
id: semmle-code
54+
run: |
55+
cd semmle-code
56+
OPENAPI_COMMIT_SHA=$(git rev-parse HEAD)
57+
echo "OPENAPI_COMMIT_SHA=$OPENAPI_COMMIT_SHA" >> $GITHUB_OUTPUT
58+
echo "Copied files from github/semmle-code repo. Commit SHA: $OPENAPI_COMMIT_SHA"
59+
60+
- name: Install pandoc
61+
run: |
62+
# Remove all previous pandoc versions
63+
sudo apt-get purge --auto-remove pandoc
64+
# Download pandoc
65+
wget https://github.com/jgm/pandoc/releases/download/3.0.1/pandoc-3.0.1-1-amd64.deb
66+
# Install pandoc
67+
sudo dpkg -i pandoc-3.0.1-1-amd64.deb
68+
# Output the pandoc version installed
69+
pandoc -v
70+
71+
- name: Sync the CodeQL CLI data
72+
run: |
73+
src/codeql-cli/scripts/sync.js
74+
git status
75+
echo "Deleting the cloned github/semmle-code repo..."
76+
rm -rf semmle-code
77+
78+
- name: Create pull request
79+
env:
80+
# Needed for gh
81+
GITHUB_TOKEN: ${{ secrets.DOCUBOT_REPO_PAT }}
82+
run: |
83+
# If nothing to commit, exit now. It's fine. No orphans.
84+
changes=$(git diff --name-only | wc -l)
85+
if [[ $changes -eq 0 ]]; then
86+
echo "There are no changes to commit after running src/rest/scripts/update-files.js. Exiting..."
87+
exit 0
88+
fi
89+
90+
git config --global user.name "docubot"
91+
git config --global user.email "[email protected]"
92+
93+
branchname=codeql-cli-update-${{ steps.semmle-code.outputs.OPENAPI_COMMIT_SHA }}
94+
95+
branchCheckout=$(git checkout -b $branchname)
96+
if [[! $? -eq 0 ]]; then
97+
echo "Branch $branchname already exists in `github/docs-internal`. Exiting..."
98+
exit 0
99+
fi
100+
git add .
101+
git commit -m "Update CodeQL CLI data"
102+
git push origin $branchname
103+
104+
echo "Creating pull request..."
105+
gh pr create \
106+
--title "Update CodeQL CLI manual" \
107+
--body '👋 humans. This PR updates the CodeQL CLI manual Markdown pages with the latest changes. (Synced from semmle-code@${{ steps.semmle-code.outputs.OPENAPI_COMMIT_SHA }})
108+
109+
If CI does not pass or other problems arise, contact #docs-engineering on slack.' \
110+
--repo github/docs-internal \
111+
--label codeql-cli-pipeline
112+
113+
- name: Send Slack notification if workflow fails
114+
uses: someimportantcompany/github-actions-slack-message@1d367080235edfa53df415bd8e0bbab480f29bad
115+
if: ${{ failure() && env.FREEZE != 'true' }}
116+
with:
117+
channel: ${{ secrets.DOCS_ALERTS_SLACK_CHANNEL_ID }}
118+
bot-token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
119+
color: failure
120+
text: The last Sync CodeQL CLI run for ${{github.repository}} failed. See https://github.com/${{github.repository}}/actions/workflows/sync-codeql-cli.yml

0 commit comments

Comments
 (0)