mirror of
https://github.com/github/codeql.git
synced 2026-04-21 06:55:31 +02:00
b58c856756
Repositories can be configured with Default access (restricted) https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token Best practice says that workflows should declare the minimal permissions they require. Without declaring permissions, paranoid forks fail miserably.
67 lines
1.9 KiB
YAML
67 lines
1.9 KiB
YAML
name: Regenerate framework models
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "30 2 * * *"
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- ".github/workflows/mad_regenerate-models.yml"
|
|
- ".github/actions/fetch-codeql/action.yml"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
regenerate-models:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
# placeholder required for each axis, excluded below, replaced by the actual combinations (see include)
|
|
slug: ["placeholder"]
|
|
ref: ["placeholder"]
|
|
include:
|
|
- slug: "apache/commons-io"
|
|
ref: "13258ce2d07aa0e764bbaa8020af4dcd3a02a620"
|
|
exclude:
|
|
- slug: "placeholder"
|
|
ref: "placeholder"
|
|
steps:
|
|
- name: Clone self (github/codeql)
|
|
uses: actions/checkout@v4
|
|
- name: Setup CodeQL binaries
|
|
uses: ./.github/actions/fetch-codeql
|
|
- name: Clone repositories
|
|
uses: actions/checkout@v4
|
|
with:
|
|
path: repos/${{ matrix.ref }}
|
|
ref: ${{ matrix.ref }}
|
|
repository: ${{ matrix.slug }}
|
|
- name: Build database
|
|
env:
|
|
SLUG: ${{ matrix.slug }}
|
|
REF: ${{ matrix.ref }}
|
|
run: |
|
|
mkdir dbs
|
|
cd repos/${REF}
|
|
SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
|
|
codeql database create --language=java ../../dbs/${SHORTNAME}
|
|
- name: Regenerate models in-place
|
|
env:
|
|
SLUG: ${{ matrix.slug }}
|
|
run: |
|
|
SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
|
|
java/ql/src/utils/modelgenerator/RegenerateModels.py "${SLUG}" dbs/${SHORTNAME}
|
|
- name: Stage changes
|
|
run: |
|
|
find java -name "*.model.yml" -print0 | xargs -0 git add
|
|
git status
|
|
git diff --cached > models.patch
|
|
- uses: actions/upload-artifact@v3
|
|
with:
|
|
name: patch
|
|
path: models.patch
|
|
retention-days: 7
|