Merge pull request #3939 from github/github-action/bump-cli

Bump CLI Version to v2.20.5 for integration tests

.github/workflows/build-storybook.yml

@@ -0,0 +1,57 @@
+name: Build Storybook
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: extensions/ql-vscode/.nvmrc
+
+      - name: Install dependencies
+        run: |
+          cd extensions/ql-vscode
+          npm ci
+        shell: bash
+
+      - name: Build Storybook
+        run: |
+          cd extensions/ql-vscode
+          npm run build-storybook
+        shell: bash
+
+      - name: Upload to GitHub Pages
+        id: deployment
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: extensions/ql-vscode/storybook-static
+
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      pages: write
+    needs: build
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/bump-cli.yml

@@ -1,25 +1,12 @@
 name: Bump CLI version
 on:
   workflow_dispatch:
-    inputs:
-      option:
-        description: "Option"
-        required: true
-        default: 'replace'
-        type: choice
-        options:
-          - prepend
-          - replace
-      version:
-        description: |
-          The version to prepend to the supported versions file. This should be in the form: `vA.B.C`.
-        required: false
-        type: string
   pull_request:
     branches: [main]
     paths:
       - .github/actions/create-pr/action.yml
       - .github/workflows/bump-cli.yml
+      - extensions/ql-vscode/scripts/bump-supported-cli-versions.ts
   schedule:
   - cron: 0 0 */14 * * # run every 14 days
 
@@ -34,28 +21,31 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
-          fetch-depth: 1
+          node-version-file: extensions/ql-vscode/.nvmrc
+          cache: 'npm'
+          cache-dependency-path: extensions/ql-vscode/package-lock.json
+      - name: Install dependencies
+        working-directory: extensions/ql-vscode
+        run: |
+          npm ci
+        shell: bash
       - name: Bump CLI
-        if: ${{ inputs.option == 'replace' }}
+        working-directory: extensions/ql-vscode
+        id: bump-cli
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          scripts/replace-cli-version.sh
+          npx vite-node scripts/bump-supported-cli-versions.ts
-      - name: Prepend another version
+        shell: bash
-        if: ${{ inputs.option == 'prepend' }}
-        run: |
-          cat extensions/ql-vscode/supported_cli_versions.json | jq '. |= ["${{ inputs.version }}"] + .' > supported_cli_versions_temp.json
-          mv supported_cli_versions_temp.json extensions/ql-vscode/supported_cli_versions.json
-          echo "LATEST_VERSION=${{ inputs.version }}" >> $GITHUB_ENV
-          echo "PREVIOUS_VERSION=`jq -r '.[1]' extensions/ql-vscode/supported_cli_versions.json`" >> $GITHUB_ENV
       - name: Commit, Push and Open a PR
         uses: ./.github/actions/create-pr
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           base-branch: main
           head-branch: github-action/bump-cli
-          commit-message: Bump CLI version from ${{ env.PREVIOUS_VERSION }} to ${{ env.LATEST_VERSION }} for integration tests
+          commit-message: Bump CLI version from ${{ steps.bump-cli.outputs.PREVIOUS_VERSION }} to ${{ steps.bump-cli.outputs.LATEST_VERSION }} for integration tests
-          title: Bump CLI Version to ${{ env.LATEST_VERSION }} for integration tests
+          title: Bump CLI Version to ${{ steps.bump-cli.outputs.LATEST_VERSION }} for integration tests
           body: >
-            Bumps CLI version from ${{ env.PREVIOUS_VERSION }} to ${{ env.LATEST_VERSION }}
+            Bumps CLI version from ${{ steps.bump-cli.outputs.PREVIOUS_VERSION }} to ${{ steps.bump-cli.outputs.LATEST_VERSION }}

.github/workflows/cli-test.yml

@@ -17,6 +17,8 @@ jobs:
   find-nightly:
     name: Find Nightly Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       url: ${{ steps.get-url.outputs.nightly-url }}
     steps:
@@ -33,6 +35,8 @@ jobs:
   set-matrix:
     name: Set Matrix for cli-test
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -47,6 +51,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     needs: [find-nightly, set-matrix]
     timeout-minutes: 30
+    permissions:
+      contents: read
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest]

.github/workflows/codeql.yml

@@ -11,6 +11,12 @@ on:
 jobs:
   codeql:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        language:
+          - javascript
+          - actions
+      fail-fast: false
 
     permissions:
       contents: read
@@ -24,7 +30,7 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@main
         with:
-            languages: javascript
+            languages: ${{ matrix.language }}
             config-file: ./.github/codeql/codeql-config.yml
             tools: latest
 

.github/workflows/e2e-tests.yml

@@ -1,10 +1,14 @@
 name: Run E2E Playwright tests
 on:
+  workflow_dispatch:
   push:
     branches: [main]
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   e2e-test:
     name: E2E Test

.github/workflows/label-issue.yml

@@ -3,6 +3,9 @@ on:
   issues:
     types: [opened]
 
+permissions:
+  issues: write
+
 jobs:
   label:
     name: Label issue

.github/workflows/main.yml

@@ -7,6 +7,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
@@ -56,6 +59,9 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/release.yml

@@ -12,6 +12,9 @@ on:
     tags:
       - 'v[0-9]+.[0-9]+.[0-9]+*'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Release
@@ -156,6 +159,8 @@ jobs:
     needs: build
     environment: publish-open-vsx
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       OPEN_VSX_TOKEN: ${{ secrets.OPEN_VSX_TOKEN }}
     steps:

.gitignore

@@ -22,4 +22,7 @@ artifacts/
 
 # E2E Reports
 **/playwright-report/**
-**/test-results/**
+**/test-results/**
+
+# Storybook artifacts
+**/storybook-static/**

extensions/ql-vscode/CHANGELOG.md

@@ -1,8 +1,11 @@
 # CodeQL for Visual Studio Code: Changelog
 
+## [UNRELEASED]
+
 ## 1.17.1 - 23 January 2025
 
 - Remove support for CodeQL CLI versions older than 2.18.4. [#3895](https://github.com/github/vscode-codeql/pull/3895)
+- Fix regex in CodeQL TextMate grammar that was silently failing. [#3903](https://github.com/github/vscode-codeql/pull/3903)
 
 ## 1.17.0 - 20 December 2024
 

extensions/ql-vscode/package.json

@@ -4,7 +4,7 @@
   "description": "CodeQL for Visual Studio Code",
   "author": "GitHub",
   "private": true,
-  "version": "1.17.1",
+  "version": "1.17.2",
   "publisher": "GitHub",
   "license": "MIT",
   "icon": "media/VS-marketplace-CodeQL-icon.png",
@@ -1969,9 +1969,9 @@
   },
   "dependencies": {
     "@floating-ui/react": "^0.27.0",
-    "@octokit/plugin-retry": "^7.1.2",
+    "@octokit/plugin-retry": "^7.1.4",
-    "@octokit/plugin-throttling": "^9.3.2",
+    "@octokit/plugin-throttling": "^9.4.0",
-    "@octokit/rest": "^21.0.2",
+    "@octokit/rest": "^21.1.1",
     "@vscode/codicons": "^0.0.36",
     "@vscode/debugadapter": "^1.59.0",
     "@vscode/debugprotocol": "^1.68.0",
@@ -2012,18 +2012,18 @@
     "@github/markdownlint-github": "^0.6.3",
     "@microsoft/eslint-formatter-sarif": "^3.1.0",
     "@playwright/test": "^1.49.0",
-    "@storybook/addon-a11y": "^8.5.0",
+    "@storybook/addon-a11y": "^8.5.8",
-    "@storybook/addon-actions": "^8.5.0",
+    "@storybook/addon-actions": "^8.5.8",
-    "@storybook/addon-essentials": "^8.5.0",
+    "@storybook/addon-essentials": "^8.5.8",
-    "@storybook/addon-interactions": "^8.5.0",
+    "@storybook/addon-interactions": "^8.5.8",
-    "@storybook/addon-links": "^8.5.0",
+    "@storybook/addon-links": "^8.5.8",
     "@storybook/blocks": "^8.0.2",
-    "@storybook/components": "^8.5.0",
+    "@storybook/components": "^8.5.8",
     "@storybook/csf": "^0.1.13",
-    "@storybook/icons": "^1.3.0",
+    "@storybook/icons": "^1.3.2",
-    "@storybook/manager-api": "^8.5.0",
+    "@storybook/manager-api": "^8.5.8",
-    "@storybook/react": "^8.5.0",
+    "@storybook/react": "^8.5.8",
-    "@storybook/react-vite": "^8.5.0",
+    "@storybook/react-vite": "^8.5.8",
     "@storybook/theming": "^8.2.4",
     "@testing-library/dom": "^10.4.0",
     "@testing-library/jest-dom": "^6.6.3",
@@ -2051,8 +2051,8 @@
     "@types/tmp": "^0.2.6",
     "@types/vscode": "1.90.0",
     "@types/yauzl": "^2.10.3",
-    "@typescript-eslint/eslint-plugin": "^8.19.0",
+    "@typescript-eslint/eslint-plugin": "^8.24.1",
-    "@typescript-eslint/parser": "^8.19.0",
+    "@typescript-eslint/parser": "^8.24.1",
     "@vscode/test-electron": "^2.3.9",
     "@vscode/vsce": "^3.2.1",
     "ansi-colors": "^4.1.1",
@@ -2088,7 +2088,7 @@
     "npm-run-all": "^4.1.5",
     "patch-package": "^8.0.0",
     "prettier": "^3.2.5",
-    "storybook": "^8.5.0",
+    "storybook": "^8.5.8",
     "tar-stream": "^3.1.7",
     "through2": "^4.0.2",
     "ts-jest": "^29.2.5",
@@ -2097,7 +2097,7 @@
     "ts-unused-exports": "^10.1.0",
     "typescript": "^5.6.2",
     "vite": "^6.0.1",
-    "vite-node": "^2.0.5"
+    "vite-node": "^3.0.6"
   },
   "lint-staged": {
     "./**/*.{json,css,scss}": [

extensions/ql-vscode/scripts/bump-supported-cli-versions.ts

@@ -0,0 +1,95 @@
+import { spawnSync } from "child_process";
+import { resolve } from "path";
+import { appendFile, outputJson, readJson } from "fs-extra";
+import { SemVer } from "semver";
+
+const supportedCliVersionsPath = resolve(
+  __dirname,
+  "..",
+  "supported_cli_versions.json",
+);
+
+async function bumpSupportedCliVersions() {
+  const existingVersions = (await readJson(
+    supportedCliVersionsPath,
+  )) as string[];
+
+  const release = runGhJSON<Release>([
+    "release",
+    "view",
+    "--json",
+    "id,name",
+    "--repo",
+    "github/codeql-cli-binaries",
+  ]);
+
+  // There are two cases:
+  // - Replace the version if it's the same major and minor version
+  // - Prepend the version if it's a new major or minor version
+
+  const latestSupportedVersion = new SemVer(existingVersions[0]);
+  const latestReleaseVersion = new SemVer(release.name);
+
+  if (latestSupportedVersion.compare(latestReleaseVersion) === 0) {
+    console.log("No need to update supported CLI versions");
+    return;
+  }
+
+  if (process.env.GITHUB_OUTPUT) {
+    await appendFile(
+      process.env.GITHUB_OUTPUT,
+      `PREVIOUS_VERSION=${existingVersions[0]}\n`,
+      {
+        encoding: "utf-8",
+      },
+    );
+  }
+
+  if (
+    latestSupportedVersion.major === latestReleaseVersion.major &&
+    latestSupportedVersion.minor === latestReleaseVersion.minor
+  ) {
+    existingVersions[0] = release.name;
+    console.log(`Replaced latest supported CLI version with ${release.name}`);
+  } else {
+    existingVersions.unshift(release.name);
+    console.log(`Added latest supported CLI version ${release.name}`);
+  }
+
+  await outputJson(supportedCliVersionsPath, existingVersions, {
+    spaces: 2,
+    finalEOL: true,
+  });
+
+  if (process.env.GITHUB_OUTPUT) {
+    await appendFile(
+      process.env.GITHUB_OUTPUT,
+      `LATEST_VERSION=${existingVersions[0]}\n`,
+      {
+        encoding: "utf-8",
+      },
+    );
+  }
+}
+
+bumpSupportedCliVersions().catch((e: unknown) => {
+  console.error(e);
+  process.exit(2);
+});
+
+function runGh(args: readonly string[]): string {
+  const gh = spawnSync("gh", args);
+  if (gh.status !== 0) {
+    throw new Error(`Failed to run gh ${args.join(" ")}: ${gh.stderr}`);
+  }
+  return gh.stdout.toString("utf-8");
+}
+
+function runGhJSON<T>(args: readonly string[]): T {
+  return JSON.parse(runGh(args));
+}
+
+type Release = {
+  id: string;
+  name: string;
+};

extensions/ql-vscode/src/view/compare-performance/ComparePerformance.tsx

@@ -798,7 +798,7 @@ function PredicateRow(props: PredicateRowProps) {
                     </>
                   }
                 />
-                {abbreviateRASteps(first?.steps ?? second!.steps).map(
+                {abbreviateRASteps(first?.steps ?? second?.steps ?? []).map(
                   (step, index) => (
                     <PipelineStep
                       key={index}

extensions/ql-vscode/supported_cli_versions.json

@@ -1,5 +1,5 @@
 [
-  "v2.20.2",
+  "v2.20.5",
   "v2.19.4",
   "v2.18.4",
   "nightly"

extensions/ql-vscode/syntaxes/ql.tmLanguage.yml

@@ -1065,7 +1065,7 @@ repository:
     beginPattern: '#as'
     # Ends after the first identifier we encounter.
     # REVIEW: Make similar to import-as-clause.
-    end: '(?<=(?#id-character)(?#end-of-id))'
+    end: '(?<=(?#id-character))(?#end-of-id)'
     match: meta.block.select-as-clause.ql
     patterns:
     - include: '#non-context-sensitive'

extensions/ql-vscode/test/e2e/docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM codercom/code-server:4.96.2
+FROM codercom/code-server:4.97.2
 
 USER root
 

extensions/ql-vscode/test/factories/model-editor/extension-pack.ts

@@ -1,5 +1,4 @@
 import type { ExtensionPack } from "../../../src/model-editor/shared/extension-pack";
-import { join } from "path";
 
 export function createMockExtensionPack({
   path = "/path/to/extension-pack",
@@ -7,7 +6,7 @@ export function createMockExtensionPack({
 }: Partial<ExtensionPack> = {}): ExtensionPack {
   return {
     path,
-    yamlPath: join(path, "codeql-pack.yml"),
+    yamlPath: `${path}/codeql-pack.yml`,
     name: "sql2o",
     version: "0.0.0",
     language: "java",

scripts/replace-cli-version.sh

@@ -1,12 +0,0 @@
-#!/bin/bash
-
-VERSIONS=$(gh api -H "Accept: application/vnd.github+json" /repos/github/codeql-cli-binaries/releases | jq -r '.[].tag_name' | head -2)
-
-# we are exporting these variables so that we can access these variables in the workflow
-LATEST_VERSION=$(echo $VERSIONS | awk '{ print $1 }')
-PREVIOUS_VERSION=$(echo $VERSIONS | awk '{ print $2 }')
-
-echo "LATEST_VERSION=$LATEST_VERSION" >> $GITHUB_ENV
-echo "PREVIOUS_VERSION=$PREVIOUS_VERSION" >> $GITHUB_ENV
-
-sed -i "s/$PREVIOUS_VERSION/$LATEST_VERSION/g" extensions/ql-vscode/supported_cli_versions.json

syntaxes/ql.tmLanguage.json

@@ -675,9 +675,6 @@
               "begin": "(?x)(?<=/\\*\\*)([^*]|\\*(?!/))*$",
               "while": "(?x)(^|\\G)\\s*([^*]|\\*(?!/))(?=([^*]|[*](?!/))*$)",
               "patterns": [
-
-
-
                 {
                   "match": "(?x)\\G\\s* (@\\S+)",
                   "name": "keyword.tag.ql"
@@ -1469,7 +1466,7 @@
       }
     },
     "select-as-clause": {
-      "end": "(?x)(?<=(?:[0-9A-Za-z_])(?:(?!(?:[0-9A-Za-z_]))))",
+      "end": "(?x)(?<=(?:[0-9A-Za-z_]))(?:(?!(?:[0-9A-Za-z_])))",
       "match": "(?x)meta.block.select-as-clause.ql",
       "patterns": [
         {
@@ -1540,4 +1537,4 @@
       "name": "constant.character.escape.ql"
     }
   }
-}
+}