mirror of
https://github.com/github/codeql.git
synced 2026-01-06 03:00:24 +01:00
b58c856756
Repositories can be configured with Default access (restricted) https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token Best practice says that workflows should declare the minimal permissions they require. Without declaring permissions, paranoid forks fail miserably.
77 lines
2.1 KiB
YAML
77 lines
2.1 KiB
YAML
name: "Ruby: Collect database stats"
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- "rc/*"
|
|
paths:
|
|
- ruby/ql/lib/ruby.dbscheme
|
|
- .github/workflows/ruby-dataset-measure.yml
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
- "rc/*"
|
|
paths:
|
|
- ruby/ql/lib/ruby.dbscheme
|
|
- .github/workflows/ruby-dataset-measure.yml
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
measure:
|
|
env:
|
|
CODEQL_THREADS: 4 # TODO: remove this once it's set by the CLI
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
repo: [rails/rails, discourse/discourse, spree/spree, ruby/ruby]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: ./.github/actions/fetch-codeql
|
|
|
|
- uses: ./ruby/actions/create-extractor-pack
|
|
|
|
- name: Checkout ${{ matrix.repo }}
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: ${{ matrix.repo }}
|
|
path: ${{ github.workspace }}/repo
|
|
- name: Create database
|
|
run: |
|
|
codeql database create \
|
|
--search-path "${{ github.workspace }}/ruby/extractor-pack" \
|
|
--threads 4 \
|
|
--language ruby --source-root "${{ github.workspace }}/repo" \
|
|
"${{ runner.temp }}/database"
|
|
- name: Measure database
|
|
run: |
|
|
mkdir -p "stats/${{ matrix.repo }}"
|
|
codeql dataset measure --threads 4 --output "stats/${{ matrix.repo }}/stats.xml" "${{ runner.temp }}/database/db-ruby"
|
|
- uses: actions/upload-artifact@v3
|
|
with:
|
|
name: measurements
|
|
path: stats
|
|
retention-days: 1
|
|
|
|
merge:
|
|
runs-on: ubuntu-latest
|
|
needs: measure
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/download-artifact@v3
|
|
with:
|
|
name: measurements
|
|
path: stats
|
|
- run: |
|
|
python -m pip install --user lxml
|
|
find stats -name 'stats.xml' | sort | xargs python ruby/scripts/merge_stats.py --output ruby/ql/lib/ruby.dbscheme.stats --normalise ruby_tokeninfo
|
|
- uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ruby.dbscheme.stats
|
|
path: ruby/ql/lib/ruby.dbscheme.stats
|