mirror of
https://github.com/github/codeql.git
synced 2026-01-06 11:10:23 +01:00
b58c856756
Repositories can be configured with Default access (restricted) https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token Best practice says that workflows should declare the minimal permissions they require. Without declaring permissions, paranoid forks fail miserably.
74 lines
2.3 KiB
YAML
74 lines
2.3 KiB
YAML
name: "Ruby: Run QL Tests"
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- "ruby/**"
|
|
- "shared/**"
|
|
- .github/workflows/ruby-build.yml
|
|
- .github/actions/fetch-codeql/action.yml
|
|
- codeql-workspace.yml
|
|
branches:
|
|
- main
|
|
- "rc/*"
|
|
pull_request:
|
|
paths:
|
|
- "ruby/**"
|
|
- "shared/**"
|
|
- .github/workflows/ruby-qltest.yml
|
|
- .github/actions/fetch-codeql/action.yml
|
|
- codeql-workspace.yml
|
|
branches:
|
|
- main
|
|
- "rc/*"
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
defaults:
|
|
run:
|
|
working-directory: ruby
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
qlupgrade:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: ./.github/actions/fetch-codeql
|
|
- name: Check DB upgrade scripts
|
|
run: |
|
|
echo >empty.trap
|
|
codeql dataset import -S ql/lib/upgrades/initial/ruby.dbscheme testdb empty.trap
|
|
codeql dataset upgrade testdb --additional-packs ql/lib
|
|
diff -q testdb/ruby.dbscheme ql/lib/ruby.dbscheme
|
|
- name: Check DB downgrade scripts
|
|
run: |
|
|
echo >empty.trap
|
|
rm -rf testdb; codeql dataset import -S ql/lib/ruby.dbscheme testdb empty.trap
|
|
codeql resolve upgrades --format=lines --allow-downgrades --additional-packs downgrades \
|
|
--dbscheme=ql/lib/ruby.dbscheme --target-dbscheme=downgrades/initial/ruby.dbscheme |
|
|
xargs codeql execute upgrades testdb
|
|
diff -q testdb/ruby.dbscheme downgrades/initial/ruby.dbscheme
|
|
qltest:
|
|
if: github.repository_owner == 'github'
|
|
runs-on: ubuntu-latest-xl
|
|
strategy:
|
|
fail-fast: false
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: ./.github/actions/fetch-codeql
|
|
- uses: ./ruby/actions/create-extractor-pack
|
|
- name: Cache compilation cache
|
|
id: query-cache
|
|
uses: ./.github/actions/cache-query-compilation
|
|
with:
|
|
key: ruby-qltest
|
|
- name: Run QL tests
|
|
run: |
|
|
codeql test run --threads=0 --ram 50000 --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|