FilesExpand file tree

main

/

microsoft-codeql-pack-publish.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

152 lines (141 loc) · 5.48 KB

main

/

microsoft-codeql-pack-publish.yml

Copy path

Top

File metadata and controls

• Code
• Blame

152 lines (141 loc) · 5.48 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

name: Microsoft CodeQL Pack Publish

on:

workflow_dispatch:

jobs:

check-branch:

runs-on: ubuntu-latest

steps:

- name: Fail if not on main branch

run: |

if [ "$GITHUB_REF" != "refs/heads/main" ]; then

echo "This workflow can only run on the 'main' branch."

exit 1

fi

codeqlversion:

needs: check-branch

runs-on: ubuntu-latest

outputs:

codeql_version: ${{ steps.set_codeql_version.outputs.codeql_version }}

steps:

- name: Checkout repository

uses: actions/checkout@v4

with:

fetch-depth: 0

- name: Set CodeQL Version

id: set_codeql_version

run: |

git fetch

git fetch --tags

CURRENT_COMMIT=$(git rev-list -1 HEAD)

CURRENT_TAG=$(git describe --tags --abbrev=0 --match 'codeql-cli/v*' $CURRENT_COMMIT)

CODEQL_VERSION="${CURRENT_TAG#codeql-cli/}"

echo "CODEQL_VERSION=$CODEQL_VERSION" >> $GITHUB_OUTPUT

publishlibs:

environment: secure-publish

needs: codeqlversion

runs-on: ubuntu-latest

strategy:

matrix:

language: ['powershell']

steps:

- name: Checkout repository

uses: actions/checkout@v4

- name: Install CodeQL

shell: bash

run: |

gh extension install github/gh-codeql

gh codeql download "${{ needs.codeqlversion.outputs.codeql_version }}"

gh codeql set-version "${{ needs.codeqlversion.outputs.codeql_version }}"

env:

GITHUB_TOKEN: ${{ github.token }}

- name: Publish OS Microsoft CodeQL Lib Pack

shell: bash

run: |

# Download latest qlpack

gh codeql pack download "microsoft/$LANGUAGE-all"

PACK_DIR="$HOME/.codeql/packages/microsoft/$LANGUAGE-all"

VERSION_COUNT=$(ls -d "$PACK_DIR"/*/ | wc -l)

[[ "$VERSION_COUNT" -ne 1 ]] && { echo "Expected exactly one version in $PACK_DIR, but found $VERSION_COUNT. Exiting."; exit 1; }

# Increment version

CURRENT_VERSION=$(ls -v "$PACK_DIR" | tail -n 1)

MAJOR=$(echo "$CURRENT_VERSION" | cut -d. -f1)

MINOR=$(echo "$CURRENT_VERSION" | cut -d. -f2)

PATCH=$(echo "$CURRENT_VERSION" | cut -d. -f3)

NEXT_VERSION="$MAJOR.$MINOR.$((PATCH + 1))"

# Extract dependencies from the existing qlpack.yml before deleting

DEPENDENCIES=$(yq 'select(has("dependencies")) | .dependencies | {"dependencies": .}' "$LANGUAGE/ql/lib/qlpack.yml" 2>/dev/null)

DATAEXTENSIONS=$(yq 'select(has("dataExtensions")) | .dataExtensions | {"dataExtensions": .}' "$LANGUAGE/ql/lib/qlpack.yml" 2>/dev/null)

rm -f "$LANGUAGE/ql/lib/qlpack.yml" "$LANGUAGE/ql/lib/qlpack.lock"

# Create new qlpack.yml with modified content

cat <<EOF > "$LANGUAGE/ql/lib/qlpack.yml"

name: microsoft/$LANGUAGE-all

version: $NEXT_VERSION

extractor: $LANGUAGE

groups:

- $LANGUAGE

- microsoft-all

dbscheme: semmlecode.$LANGUAGE.dbscheme

extractor: $LANGUAGE

library: true

upgrades: upgrades

$DEPENDENCIES

$DATAEXTENSIONS

warnOnImplicitThis: true

EOF

# Publish pack

cat "$LANGUAGE/ql/lib/qlpack.yml"

gh codeql pack publish "$LANGUAGE/ql/lib"

env:

LANGUAGE: ${{ matrix.language }}

GITHUB_TOKEN: ${{ secrets.PACKAGE_PUBLISH }}

publish:

environment: secure-publish

needs: codeqlversion

runs-on: ubuntu-latest

strategy:

matrix:

language: ['csharp', 'cpp', 'java', 'javascript', 'python', 'ruby', 'go', 'rust', 'swift', 'powershell', 'iac']

steps:

- name: Checkout repository

uses: actions/checkout@v4

- name: Install CodeQL

shell: bash

run: |

gh extension install github/gh-codeql

gh codeql download "${{ needs.codeqlversion.outputs.codeql_version }}"

gh codeql set-version "${{ needs.codeqlversion.outputs.codeql_version }}"

env:

GITHUB_TOKEN: ${{ github.token }}

- name: Publish OS Microsoft CodeQL Pack

shell: bash

run: |

# Download latest qlpack

gh codeql pack download "microsoft/$LANGUAGE-queries"

PACK_DIR="$HOME/.codeql/packages/microsoft/$LANGUAGE-queries"

VERSION_COUNT=$(ls -d "$PACK_DIR"/*/ | wc -l)

[[ "$VERSION_COUNT" -ne 1 ]] && { echo "Expected exactly one version in $PACK_DIR, but found $VERSION_COUNT. Exiting."; exit 1; }

# Increment version

CURRENT_VERSION=$(ls -v "$PACK_DIR" | tail -n 1)

MAJOR=$(echo "$CURRENT_VERSION" | cut -d. -f1)

MINOR=$(echo "$CURRENT_VERSION" | cut -d. -f2)

PATCH=$(echo "$CURRENT_VERSION" | cut -d. -f3)

NEXT_VERSION="$MAJOR.$MINOR.$((PATCH + 1))"

# Extract dependencies from the existing qlpack.yml before deleting

DEPENDENCIES=$(yq 'select(has("dependencies")) | .dependencies | {"dependencies": .}' "$LANGUAGE/ql/src/qlpack.yml" 2>/dev/null)

rm -f "$LANGUAGE/ql/src/qlpack.yml" "$LANGUAGE/ql/src/qlpack.lock"

# Create new qlpack.yml with modified content

cat <<EOF > "$LANGUAGE/ql/src/qlpack.yml"

name: microsoft/$LANGUAGE-queries

version: $NEXT_VERSION

extractor: $LANGUAGE

groups:

- $LANGUAGE

- queries

$DEPENDENCIES

EOF

# Publish pack

cat "$LANGUAGE/ql/src/qlpack.yml"

gh codeql pack publish "$LANGUAGE/ql/src"

env:

LANGUAGE: ${{ matrix.language }}

GITHUB_TOKEN: ${{ secrets.PACKAGE_PUBLISH }}