Skip to content

Commit 5ec7b68

Browse files
nirinchevnirinchev
authored
chore(ci): update CodeQL workflow MONGOSH-1994 (#2327)
1 parent 7e35e10 commit 5ec7b68

File tree

8 files changed

+106
-117
lines changed

8 files changed

+106
-117
lines changed

‎.github/workflows/bump-auxiliary-packages.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ name: Bump Auxiliary Packages
22
on:
33
workflow_dispatch:
44

5+
permissions:
6+
contents: none # We use the github app to checkout and create PR
7+
58
jobs:
69
update_generated_files:
710
name: Bump packages
@@ -11,7 +14,7 @@ jobs:
1114
id: app-token
1215
with:
1316
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
14-
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}
17+
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}
1518
- uses: actions/checkout@v4
1619
with:
1720
# don't checkout a detatched HEAD

‎.github/workflows/check-pr-title.yml

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,25 @@ on:
33
pull_request:
44
types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled, converted_to_draft, edited]
55

6+
permissions:
7+
pull-requests: read # to read PR title and labels
8+
69
jobs:
710
check-pr-title:
811
name: Check PR Title
912
runs-on: ubuntu-latest
1013
steps:
1114
- name: Enforce conventional commit style
12-
uses: realm/ci-actions/title-checker@main
15+
uses: realm/ci-actions/title-checker@d6cc8f067474759d38e6d24e272027b4c88bc0a9
1316
with:
1417
regex: '^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test|ops){1}(\([\w\-\.]+\))?(!)?: .*'
1518
error-hint: 'Invalid PR title. Make sure it follows the conventional commit specification (i.e. "<type>(<optional scope>): <description>") or add the no-title-validation label'
16-
ignore-labels: 'no-title-validation'
19+
ignore-labels: "no-title-validation"
1720
- name: Enforce JIRA ticket in title
18-
uses: realm/ci-actions/title-checker@main
21+
uses: realm/ci-actions/title-checker@d6cc8f067474759d38e6d24e272027b4c88bc0a9
1922
# Skip the JIRA ticket check for PRs opened by bots
2023
if: ${{ !contains(github.event.pull_request.user.login, '[bot]') }}
2124
with:
22-
regex: '[A-Z]{4,10}-[0-9]{1,5}$'
23-
error-hint: 'Invalid PR title. Make sure it ends with a JIRA ticket - i.e. MONGOSH-1234 or add the no-title-validation label'
24-
ignore-labels: 'no-title-validation'
25+
regex: "[A-Z]{4,10}-[0-9]{1,5}$"
26+
error-hint: "Invalid PR title. Make sure it ends with a JIRA ticket - i.e. MONGOSH-1234 or add the no-title-validation label"
27+
ignore-labels: "no-title-validation"

‎.github/workflows/codeql.yml

Lines changed: 38 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,26 @@
1-
# For most projects, this workflow file will not need changing; you simply need
2-
# to commit it to your repository.
3-
#
4-
# You may wish to alter this file to override the set of languages analyzed,
5-
# or to provide custom queries or build logic.
6-
#
7-
# ******** NOTE ********
8-
# We have attempted to detect the languages in your repository. Please check
9-
# the `language` matrix defined below to confirm you have the correct set of
10-
# supported CodeQL languages.
11-
#
12-
name: "CodeQL"
1+
name: CodeQL
132

143
on:
154
push:
16-
branches: [ "main" ]
5+
branches:
6+
- main
177
pull_request:
18-
# The branches below must be a subset of the branches above
19-
branches: [ "main" ]
8+
branches:
9+
- main
2010
schedule:
21-
- cron: '30 20 * * 1'
11+
- cron: "30 20 * * 1"
2212
workflow_run:
23-
workflows: ["Update automatically generated files"]
13+
workflows:
14+
- Update automatically generated files
2415
types:
2516
- completed
26-
branches: [ "main" ]
17+
branches:
18+
- main
2719

2820
jobs:
2921
analyze:
3022
name: Analyze
31-
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
23+
runs-on: ubuntu-latest
3224
permissions:
3325
actions: read
3426
contents: read
@@ -37,55 +29,32 @@ jobs:
3729
strategy:
3830
fail-fast: false
3931
matrix:
40-
language: [ 'javascript' ]
41-
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
42-
# Use only 'java' to analyze code written in Java, Kotlin or both
43-
# Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
44-
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
32+
language:
33+
- javascript
34+
- actions
4535

4636
steps:
47-
- name: Checkout repository
48-
uses: actions/checkout@v3
49-
50-
# Initializes the CodeQL tools for scanning.
51-
- name: Initialize CodeQL
52-
uses: github/codeql-action/init@v2
53-
with:
54-
languages: ${{ matrix.language }}
55-
# If you wish to specify custom queries, you can do so here or in a config file.
56-
# By default, queries listed here will override any specified in a config file.
57-
# Prefix the list here with "+" to use these queries and those in the config file.
58-
59-
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
60-
# queries: security-extended,security-and-quality
61-
config: |
62-
paths-ignore:
63-
- '**/*.test.js'
64-
- '**/*.spec.js'
65-
- '**/*.test.ts'
66-
- '**/*.spec.ts'
67-
- '**/*.test.tsx'
68-
- '**/*.spec.tsx'
69-
- 'packages/build/**'
70-
- 'packages/e2e-tests/**'
71-
- 'scripts/**'
72-
73-
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java).
74-
# If this step fails, then you should remove it and run the build manually (see below)
75-
- name: Autobuild
76-
uses: github/codeql-action/autobuild@v2
77-
78-
# ℹ️ Command-line programs to run using the OS shell.
79-
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
80-
81-
# If the Autobuild fails above, remove it and uncomment the following three lines.
82-
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
83-
84-
# - run: |
85-
# echo "Run, Build Application using script"
86-
# ./location_of_script_within_repo/buildscript.sh
87-
88-
- name: Perform CodeQL Analysis
89-
uses: github/codeql-action/analyze@v2
90-
with:
91-
category: "/language:${{matrix.language}}"
37+
- name: Checkout repository
38+
uses: actions/checkout@v3
39+
40+
# Initializes the CodeQL tools for scanning.
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@v3
43+
with:
44+
languages: ${{ matrix.language }}
45+
config: |
46+
paths-ignore:
47+
- '**/*.test.js'
48+
- '**/*.spec.js'
49+
- '**/*.test.ts'
50+
- '**/*.spec.ts'
51+
- '**/*.test.tsx'
52+
- '**/*.spec.tsx'
53+
- 'packages/build/**'
54+
- 'packages/e2e-tests/**'
55+
- 'scripts/**'
56+
57+
- name: Perform CodeQL Analysis
58+
uses: github/codeql-action/analyze@v3
59+
with:
60+
category: "/language:${{matrix.language}}"

‎.github/workflows/cron-tasks.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ on:
88
branches:
99
- main
1010

11+
permissions:
12+
contents: none # We use the github app to checkout and push changes
13+
1114
jobs:
1215
update_generated_files:
1316
name: Update automatically generated files

‎.github/workflows/homebrew.yml

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ on:
44
schedule:
55
- cron: "0 0 * * *"
66

7+
permissions:
8+
contents: read
9+
710
jobs:
811
smoke-test-homebrew:
912
name: Test on ${{ matrix.runner }}
@@ -21,10 +24,7 @@ jobs:
2124

2225
- name: Report failure
2326
if: ${{ failure() }}
24-
env:
25-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_MONGOSH_DEVEL_WEBHOOK_URL }}
26-
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
27-
uses: slackapi/[email protected]
27+
uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # 2.0.0
2828
with:
2929
payload: |
3030
{
@@ -39,3 +39,5 @@ jobs:
3939
}
4040
]
4141
}
42+
webhook: ${{ secrets.SLACK_MONGOSH_DEVEL_WEBHOOK_URL }}
43+
webhook-type: incoming-webhook

‎.github/workflows/publish-auxiliary-packages.yml

Lines changed: 39 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ on:
99
branches:
1010
- main
1111

12+
permissions:
13+
contents: none # We use the github app to checkout and push tags
14+
1215
jobs:
1316
publish:
1417
if: |
@@ -18,40 +21,39 @@ jobs:
1821
runs-on: ubuntu-latest
1922

2023
steps:
21-
- uses: mongodb-js/devtools-shared/actions/setup-bot-token@main
22-
id: app-token
23-
with:
24-
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
25-
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}
26-
27-
- uses: actions/checkout@v4
28-
with:
29-
# don't checkout a detatched HEAD
30-
ref: ${{ github.head_ref }}
31-
32-
# this is important so git log can pick up on
33-
# the whole history to generate the list of AUTHORS
34-
fetch-depth: "0"
35-
token: ${{ steps.app-token.outputs.token }}
36-
37-
- name: "Use Node.js 20"
38-
uses: actions/setup-node@v4
39-
with:
40-
node-version: 20.16.0
41-
42-
- name: Install [email protected]
43-
run: npm install -g [email protected]
44-
45-
- name: Install Dependencies
46-
run: |
47-
npm ci
48-
49-
- name: "Publish what is not already in NPM"
50-
env:
51-
NPM_TOKEN: ${{ secrets.DEVTOOLSBOT_NPM_TOKEN }}
52-
run: |
53-
echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> ~/.npmrc
54-
npm config list
55-
echo "Publishing packages as $(npm whoami)"
56-
npm run publish-auxiliary
57-
24+
- uses: mongodb-js/devtools-shared/actions/setup-bot-token@main
25+
id: app-token
26+
with:
27+
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
28+
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}
29+
30+
- uses: actions/checkout@v4
31+
with:
32+
# don't checkout a detatched HEAD
33+
ref: ${{ github.head_ref }}
34+
35+
# this is important so git log can pick up on
36+
# the whole history to generate the list of AUTHORS
37+
fetch-depth: "0"
38+
token: ${{ steps.app-token.outputs.token }}
39+
40+
- name: "Use Node.js 20"
41+
uses: actions/setup-node@v4
42+
with:
43+
node-version: 20.16.0
44+
45+
- name: Install [email protected]
46+
run: npm install -g [email protected]
47+
48+
- name: Install Dependencies
49+
run: |
50+
npm ci
51+
52+
- name: "Publish what is not already in NPM"
53+
env:
54+
NPM_TOKEN: ${{ secrets.DEVTOOLSBOT_NPM_TOKEN }}
55+
run: |
56+
echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> ~/.npmrc
57+
npm config list
58+
echo "Publishing packages as $(npm whoami)"
59+
npm run publish-auxiliary

‎.github/workflows/smoke-tests.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on:
55
- main
66
pull_request:
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
smoke-tests:
1013
name: "OS: ${{ matrix.runner }}, node@${{ matrix.node }}"

‎.github/workflows/update-node-js.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
schedule:
77
- cron: "0 0 * * *"
88

9+
permissions:
10+
contents: none # We use the github app to open a PR
11+
912
jobs:
1013
update_generated_files:
1114
name: Update Node.js versions
@@ -21,6 +24,7 @@ jobs:
2124
with:
2225
# don't checkout a detatched HEAD
2326
ref: ${{ github.head_ref }}
27+
token: ${{ steps.app-token.outputs.token }}
2428

2529
- uses: actions/setup-node@v4
2630
with:

0 commit comments

Comments
 (0)