FilesExpand file tree

main

/

ql-for-ql-build.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

203 lines (189 loc) · 6.75 KB

main

/

ql-for-ql-build.yml

Copy path

Top

File metadata and controls

• Code
• Blame

203 lines (189 loc) · 6.75 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

name: Run QL for QL

on:

push:

branches: [main]

pull_request:

branches: [main]

env:

CARGO_TERM_COLOR: always

jobs:

queries:

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@v3

- name: Find codeql

id: find-codeql

uses: github/codeql-action/init@aa93aea877e5fb8841bcb1193f672abf6e9f2980

with:

languages: javascript # does not matter

tools: latest

- name: Get CodeQL version

id: get-codeql-version

run: |

echo "::set-output name=version::$("${CODEQL}" --version | head -n 1 | rev | cut -d " " -f 1 | rev)"

shell: bash

env:

CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}

- name: Cache queries

id: cache-queries

uses: actions/cache@v3

with:

path: ${{ runner.temp }}/query-pack.zip

key: queries-${{ hashFiles('ql/**/*.ql*') }}-${{ hashFiles('ql/**/qlpack.yml') }}-${{ hashFiles('ql/ql/src/ql.dbscheme*') }}-${{ steps.get-codeql-version.outputs.version }}

- name: Build query pack

if: steps.cache-queries.outputs.cache-hit != 'true'

run: |

cd ql/ql/src

"${CODEQL}" pack create

cd .codeql/pack/codeql/ql/0.0.0

zip "${PACKZIP}" -r .

env:

CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}

PACKZIP: ${{ runner.temp }}/query-pack.zip

- name: Upload query pack

uses: actions/upload-artifact@v3

with:

name: query-pack-zip

path: ${{ runner.temp }}/query-pack.zip

extractors:

strategy:

fail-fast: false

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@v3

- name: Cache entire extractor

id: cache-extractor

uses: actions/cache@v3

with:

path: |

ql/target/release/ql-autobuilder

ql/target/release/ql-autobuilder.exe

ql/target/release/ql-extractor

ql/target/release/ql-extractor.exe

key: ${{ runner.os }}-extractor-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('ql/**/*.rs') }}

- name: Cache cargo

if: steps.cache-extractor.outputs.cache-hit != 'true'

uses: actions/cache@v3

with:

path: |

~/.cargo/registry

~/.cargo/git

ql/target

key: ${{ runner.os }}-rust-cargo-${{ hashFiles('ql/**/Cargo.lock') }}

- name: Check formatting

if: steps.cache-extractor.outputs.cache-hit != 'true'

run: cd ql; cargo fmt --all -- --check

- name: Build

if: steps.cache-extractor.outputs.cache-hit != 'true'

run: cd ql; cargo build --verbose

- name: Run tests

if: steps.cache-extractor.outputs.cache-hit != 'true'

run: cd ql; cargo test --verbose

- name: Release build

if: steps.cache-extractor.outputs.cache-hit != 'true'

run: cd ql; cargo build --release

- name: Generate dbscheme

if: steps.cache-extractor.outputs.cache-hit != 'true'

run: ql/target/release/ql-generator --dbscheme ql/ql/src/ql.dbscheme --library ql/ql/src/codeql_ql/ast/internal/TreeSitter.qll

- uses: actions/upload-artifact@v3

with:

name: extractor-ubuntu-latest

path: |

ql/target/release/ql-autobuilder

ql/target/release/ql-autobuilder.exe

ql/target/release/ql-extractor

ql/target/release/ql-extractor.exe

retention-days: 1

package:

runs-on: ubuntu-latest

needs:

- extractors

- queries

steps:

- uses: actions/checkout@v3

- uses: actions/download-artifact@v3

with:

name: query-pack-zip

path: query-pack-zip

- uses: actions/download-artifact@v3

with:

name: extractor-ubuntu-latest

path: linux64

- run: |

unzip query-pack-zip/*.zip -d pack

cp -r ql/codeql-extractor.yml ql/tools ql/ql/src/ql.dbscheme.stats pack/

mkdir -p pack/tools/linux64

if [[ -f linux64/ql-autobuilder ]]; then

cp linux64/ql-autobuilder pack/tools/linux64/autobuilder

chmod +x pack/tools/linux64/autobuilder

fi

if [[ -f linux64/ql-extractor ]]; then

cp linux64/ql-extractor pack/tools/linux64/extractor

chmod +x pack/tools/linux64/extractor

fi

cd pack

zip -rq ../codeql-ql.zip .

- uses: actions/upload-artifact@v3

with:

name: codeql-ql-pack

path: codeql-ql.zip

retention-days: 1

analyze:

runs-on: ubuntu-latest

strategy:

matrix:

folder: [cpp, csharp, java, javascript, python, ql, ruby, swift]

needs:

- package

steps:

- name: Download pack

uses: actions/download-artifact@v3

with:

name: codeql-ql-pack

path: ${{ runner.temp }}/codeql-ql-pack-artifact

- name: Prepare pack

run: |

unzip "${PACK_ARTIFACT}/*.zip" -d "${PACK}"

env:

PACK_ARTIFACT: ${{ runner.temp }}/codeql-ql-pack-artifact

PACK: ${{ runner.temp }}/pack

- name: Hack codeql-action options

run: |

JSON=$(jq -nc --arg pack "${PACK}" '.database."run-queries"=["--search-path", $pack] | .resolve.queries=["--search-path", $pack] | .resolve.extractor=["--search-path", $pack] | .database.init=["--search-path", $pack]')

echo "CODEQL_ACTION_EXTRA_OPTIONS=${JSON}" >> ${GITHUB_ENV}

env:

PACK: ${{ runner.temp }}/pack

- name: Checkout repository

uses: actions/checkout@v3

- name: Create CodeQL config file

run: |

echo "paths:" > ${CONF}

echo " - ${FOLDER}" >> ${CONF}

echo "paths-ignore:" >> ${CONF}

echo " - ql/ql/test" >> ${CONF}

echo "disable-default-queries: true" >> ${CONF}

echo "packs:" >> ${CONF}

echo " - codeql/ql" >> ${CONF}

echo "Config file: "

cat ${CONF}

env:

CONF: ./ql-for-ql-config.yml

FOLDER: ${{ matrix.folder }}

- name: Initialize CodeQL

uses: github/codeql-action/init@aa93aea877e5fb8841bcb1193f672abf6e9f2980

with:

languages: ql

db-location: ${{ runner.temp }}/db

config-file: ./ql-for-ql-config.yml

tools: latest

- name: Perform CodeQL Analysis

uses: github/codeql-action/analyze@aa93aea877e5fb8841bcb1193f672abf6e9f2980

with:

category: "ql-for-ql-${{ matrix.folder }}"

- name: Copy sarif file to CWD

run: cp ../results/ql.sarif ./${{ matrix.folder }}.sarif

- name: Sarif as artifact

uses: actions/upload-artifact@v3

with:

name: ${{ matrix.folder }}.sarif

path: ${{ matrix.folder }}.sarif