codeql-action/.github/workflows/debug-artifacts-failure-safe.yml at main · github/codeql-action · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
# Checks logs, SARIF, and database bundle debug artifacts exist
# when the analyze step fails.
name: PR Check - Debug artifacts after failure
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
on:
  push:
    branches:
      - main
      - releases/v*
  pull_request:
  merge_group:
    types: [checks_requested]
  schedule:
    - cron: "0 5 * * *"
  workflow_dispatch:

concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
  group: ${{ github.workflow }}-${{ github.ref }}

defaults:
  run:
    shell: bash

jobs:
  upload-artifacts:
    if: github.triggering_actor != 'dependabot[bot]'
    strategy:
      fail-fast: false
      matrix:
        version:
          - stable-v2.20.7
          - default
          - linked
          - nightly-latest
    name: Upload debug artifacts after failure in analyze
    continue-on-error: true
    env:
      CODEQL_ACTION_TEST_MODE: true
    permissions:
      contents: read
      # We currently need `security-events: read` to access feature flags.
      security-events: read
    timeout-minutes: 45

    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
    # We could install that older version on the newer runners, or use the older runner.
    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}

    steps:
      - name: Dump GitHub event
        run: cat "${GITHUB_EVENT_PATH}"
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
        with:
          version: ${{ matrix.version }}
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ^1.13.1
      - name: Install .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: "9.x"
      - name: Assert best-effort artifact scan completed
        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
      - uses: ./../action/init
        with:
          languages: cpp,csharp,go,java,javascript,python
          tools: ${{ steps.prepare-test.outputs.tools-url }}
          debug: true
          debug-artifact-name: my-debug-artifacts
          debug-database-name: my-db
      - name: Build code
        run: ./build.sh
      - uses: ./../action/analyze
        id: analysis
        env:
          # Forces a failure in this step.
          CODEQL_ACTION_EXTRA_OPTIONS: '{ "database": { "finalize": ["--invalid-option"] } }'
        with:
          expect-error: true
  download-and-check-artifacts:
    name: Download and check debug artifacts after failure in analyze
    if: github.triggering_actor != 'dependabot[bot]'
    needs: upload-artifacts
    timeout-minutes: 45
    permissions:
      contents: read
    runs-on: ubuntu-26.04
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
      - name: Check expected artifacts exist
        run: |
          VERSIONS="stable-v2.20.7 default linked nightly-latest"
          LANGUAGES="cpp csharp go java javascript python"
          for version in $VERSIONS; do
            echo "Artifacts from version $version:"
            pushd "./my-debug-artifacts-${version//./}"
            for language in $LANGUAGES; do
              echo "- Checking $language"
              if [[ ! -f "my-db-$language-partial.zip" ]] ; then
                echo "Missing a partial database bundle for $language"
                exit 1
              fi
              if [[ ! -d "log" ]] ; then
                echo "Missing database initialization logs"
                exit 1
              fi
              if [[ ! "$language" == "go" ]] && [[ ! -d "$language/log" ]] ; then
                echo "Missing logs for $language"
                exit 1
              fi
            done
            popd
          done
        env:
          GO111MODULE: auto