Repository navigation
116 lines (96 loc) · 4.59 KB
/
Copy pathsync-codeql-cli.yml
File metadata and controls
116 lines (96 loc) · 4.59 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
name: Sync CodeQL CLI
# Updates CodeQL CLI docs from github/semmle-code and opens a PR when files change.
# Run it manually about every two weeks to publish upstream changes.
on:
workflow_dispatch:
inputs:
SOURCE_BRANCH:
description: 'Branch to pull the source files from in the semmle-code repo.'
type: string
required: true
default: 'main'
permissions:
contents: write
pull-requests: write
# Cancel older syncs so stale CodeQL CLI data does not open older PRs.
concurrency:
group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
cancel-in-progress: true
jobs:
generate-codeql-files:
if: github.repository == 'github/docs-internal'
runs-on: ubuntu-latest
steps:
- name: Checkout repository code
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Checkout semmle-code repo
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
repository: github/semmle-code
path: semmle-code
ref: ${{ inputs.SOURCE_BRANCH }}
- uses: ./.github/actions/node-npm-setup
- name: Get the semmle-code SHA being synced
id: semmle-code
run: |
cd semmle-code
OPENAPI_COMMIT_SHA=$(git rev-parse HEAD)
echo "OPENAPI_COMMIT_SHA=$OPENAPI_COMMIT_SHA" >> $GITHUB_OUTPUT
echo "Copied files from github/semmle-code repo. Commit SHA: $OPENAPI_COMMIT_SHA"
- name: Install pandoc
run: |
sudo apt-get purge --auto-remove pandoc
wget https://github.com/jgm/pandoc/releases/download/3.0.1/pandoc-3.0.1-1-amd64.deb
sudo dpkg -i pandoc-3.0.1-1-amd64.deb
pandoc -v
rm pandoc-3.0.1-1-amd64.deb
- name: Sync the CodeQL CLI data
run: |
npm run sync-codeql-cli
git status
echo "Deleting the cloned github/semmle-code repo..."
rm -rf semmle-code
- name: Create pull request
env:
GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
run: |
# Exit before branch creation so a no-op sync does not leave an orphan branch.
changes=$(git diff --name-only | wc -l)
untracked=$(git status --untracked-files --short | wc -l)
if [[ $changes -eq 0 ]] && [[ $untracked -eq 0 ]]; then
echo "There are no changes to commit after running 'npm run sync-codeql-cli'. Exiting..."
exit 0
fi
git config --global user.name "docs-bot"
git config --global user.email "77750099+docs-bot@users.noreply.github.com"
branchname=codeql-cli-update-${{ steps.semmle-code.outputs.OPENAPI_COMMIT_SHA }}
git checkout -b $branchname
git add .
git commit -m "Update CodeQL CLI data"
# Force-push reruns over failed attempts; this workflow exclusively owns these branches.
git push --force -u origin $branchname
# Skip PR creation when a prior run already opened one for this branch.
existing_pr=$(gh pr list --repo github/docs-internal --head "$branchname" --json number --jq '.[0].number')
if [[ -n "$existing_pr" ]]; then
echo "Pull request #$existing_pr already exists for branch $branchname. Skipping PR creation."
exit 0
fi
echo "Creating pull request..."
gh pr create \
--title "Update CodeQL CLI manual" \
--body '👋 humans. This PR updates the CodeQL CLI manual Markdown pages with the latest changes in preparation for the next **CodeQL CLI** release.
This will be reviewed and merged by the Code scanning and GHAS focus team as part of the release of CodeQL CLI. (Synced from semmle-code@${{ steps.semmle-code.outputs.OPENAPI_COMMIT_SHA }})
If CI does not pass or other problems arise, contact #technical-content on slack.' \
--repo github/docs-internal \
--label "codeql-cli-pipeline,skip FR board,ready-for-doc-review,workflow-generated"
- uses: ./.github/actions/create-workflow-failure-issue
id: create-failure-issue
if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
with:
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
- uses: ./.github/actions/slack-alert
if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
with:
slack_token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
issue_url: ${{ steps.create-failure-issue.outputs.issue_url }}