Repository navigation
chore(deps): update dependency chrome-for-testing to v157 #3215
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Durable code-scanning coverage bound to the PR branch's HEAD SHA. | |
| # | |
| # WHY THIS EXISTS — the "stuck PR" class | |
| # The `main` ruleset's `code_scanning` rule blocks a PR until CodeQL has a | |
| # current analysis that maps onto it. GitHub maps an `on: push` head-SHA analysis | |
| # onto any open PR on that branch (what this workflow provides); the merge-commit | |
| # analysis from the `pull_request` codeql job in security.yml is the other source. | |
| # That `pull_request` job only analyses the MERGE commit (`refs/pull/N/merge`), | |
| # which GitHub RECOMPUTES every time the base (main) moves. A base move fires no | |
| # `pull_request` event, so that merge-ref result is never refreshed — | |
| # it goes stale and the PR sticks at mergeStateStatus=BLOCKED ("waiting for | |
| # results from CodeQL …") even with every required status check green, Greptile | |
| # approved, and threads resolved. pr-auto-update normally papers over this by | |
| # pushing a merge commit (→ synchronize → CodeQL re-runs) on each main move, but | |
| # it CANNOT for the PRs it skips: bot/Renovate, `dependencies`-labelled, fork, | |
| # and already-current (204) PRs — those stay stuck. | |
| # | |
| # THE FIX | |
| # Running CodeQL on `push` binds a result to the branch's STABLE head SHA, which | |
| # the rule honours regardless of how the merge commit churns on base moves. This | |
| # satisfies the code_scanning rule without depending on pr-auto-update producing | |
| # a synchronize, so the IN-REPO skipped classes above (bot/Renovate, | |
| # `dependencies`-labelled, already-current) stop getting stuck too. NOT fork PRs: | |
| # a fork author's pushes fire `on: push` in THEIR repo, never here, so this | |
| # workflow can't reach them. codeql-fork-upload.yml now closes that gap: on a fork | |
| # PR it binds a head-SHA analysis from the SARIF security.yml's fork `pull_request` | |
| # codeql job produces (advisory for forks — the fork self-attests it; see that | |
| # workflow's header). `pull_request_target` could reach the head SHA directly but | |
| # runs untrusted code with write scope, which we won't do. | |
| # | |
| # SCOPE / SAFETY | |
| # - Additive: security.yml's `pull_request` codeql job (merge-ref + PR-diff-aware | |
| # alerts) and the `security required checks passed` aggregator are UNCHANGED — | |
| # this only adds head-SHA coverage, it does not touch the required-check wiring. | |
| # - `branches-ignore: [main]`: main's head SHA is already analysed by | |
| # security.yml's `push: branches: [main]` codeql job, so excluding it here | |
| # avoids a duplicate run; tag pushes (releases) are not matched by a | |
| # branches-only filter, so the release path is untouched. | |
| # - `push` events are inherently fork-safe: a fork pushes to its OWN repo, so it | |
| # can never trigger this workflow here. The SARIF upload uses a minted clauster-ci | |
| # App token against the public `code-scanning/sarifs` endpoint (#1445), off the | |
| # shared GITHUB_TOKEN pool; `upload-sarif` cannot take an App token | |
| # (github/codeql-action#2719), so `analyze` runs with `upload: never`. | |
| name: CodeQL (head SHA) | |
| on: | |
| push: | |
| branches-ignore: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| codeql: | |
| name: codeql analyze | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| # `analyze` runs with `upload: never` and a minted App token does the upload, | |
| # so the job token no longer needs `security-events: write`. | |
| packages: read | |
| actions: read | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [python] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| # Mint an upload-only App token (`security-events: write`) BEFORE the analysis, so | |
| # the token exists regardless of the analysis outcome and the `always()` upload | |
| # below can post off the App's own rate bucket (#1445). This workflow runs on | |
| # `push` in this repo only, so the same-repo `if:` is always true here. | |
| - name: Mint SARIF upload token | |
| id: sarif-token | |
| if: >- | |
| ${{ github.event_name != 'pull_request' | |
| || github.event.pull_request.head.repo.full_name == github.repository }} | |
| uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 | |
| with: | |
| client-id: ${{ secrets.CLAUSTER_CI_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.CLAUSTER_CI_APP_PRIVATE_KEY }} | |
| # `analyze` resolves an "analysis key" through the Actions API even with | |
| # `upload: never`, so the mint needs `actions: read` (and `contents: read` for | |
| # the bundle and repo reads), and CodeQL's own `token` is routed at this App | |
| # token below. Otherwise that lookup stays on GITHUB_TOKEN and throws under pool | |
| # exhaustion after the SARIF is already written. | |
| permission-actions: read | |
| permission-contents: read | |
| permission-security-events: write | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # Route every CodeQL API call (bundle lookup, feature flags, analysis key, | |
| # status reports) at the App token, off the shared GITHUB_TOKEN pool. This is | |
| # NOT the SARIF upload route: `upload: never` means the action never posts, and | |
| # that route rejects App tokens (PR 1435). The internal endpoints degrade to | |
| # warnings with a non-Actions token (status-report.ts and feature-flags.ts map | |
| # 403/404 to `core.warning`). | |
| token: ${{ steps.sarif-token.outputs.token || github.token }} | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2 | |
| with: | |
| # `upload: never` + `output`: write the SARIF to disk instead of uploading via | |
| # the action (GITHUB_TOKEN-only; codeql-action#2719). The step below posts it | |
| # to the public endpoint with the minted App token. `token` routes analyze's own | |
| # API calls (the analysis-key lookup that runs even under `upload: never`, plus | |
| # status reports) at the App token, off the shared pool. | |
| upload: never | |
| output: codeql-sarif | |
| # Upload the POST-PROCESSED SARIF (fingerprints added), which the action writes | |
| # as `upload.sarif` in this dir; `SARIF_DIR` points here. The `*.sarif` glob | |
| # matches it, and the jq below still forces the category. | |
| post-processed-sarif-path: codeql-sarif-processed | |
| token: ${{ steps.sarif-token.outputs.token || github.token }} | |
| - name: Upload CodeQL SARIF | |
| # Post each analysis to the public `code-scanning/sarifs` endpoint with the | |
| # minted App token, off the shared GITHUB_TOKEN pool (see security.yml). Every | |
| # dynamic value comes through `env:`. Same-repo only, though `push` here is | |
| # always same-repo (`always()` counts a skip as passing). | |
| if: >- | |
| ${{ always() | |
| && (github.event_name != 'pull_request' | |
| || github.event.pull_request.head.repo.full_name == github.repository) }} | |
| env: | |
| GH_TOKEN: ${{ steps.sarif-token.outputs.token }} | |
| REPO: ${{ github.repository }} | |
| COMMIT_SHA: ${{ github.sha }} | |
| REF: ${{ github.ref }} | |
| CHECKOUT_URI: file://${{ github.workspace }} | |
| # Trailing slash is load-bearing: GitHub parses `automationDetails.id` as | |
| # `category/run-id`, so `/language:python` with no slash records an EMPTY | |
| # category. `/language:python/` gives the category with an empty run-id. | |
| CATEGORY: "/language:${{ matrix.language }}/" | |
| SARIF_DIR: codeql-sarif-processed | |
| run: | | |
| set -euo pipefail | |
| shopt -s nullglob | |
| found=0 | |
| for f in "$SARIF_DIR"/*.sarif; do | |
| found=1 | |
| # `automationDetails.id` = the analysis category, so a re-upload supersedes | |
| # the prior series for this language instead of duplicating it. | |
| sarif_b64="$(jq --arg cat "$CATEGORY" '.runs[].automationDetails.id = $cat' "$f" | gzip -c | base64 -w0)" | |
| sarif_id="$(gh api "repos/$REPO/code-scanning/sarifs" \ | |
| -f "commit_sha=$COMMIT_SHA" \ | |
| -f "ref=$REF" \ | |
| -f "checkout_uri=$CHECKOUT_URI" \ | |
| -f "tool_name=CodeQL" \ | |
| -f "sarif=$sarif_b64" \ | |
| --jq .id)" | |
| echo "Uploaded $f (id=$sarif_id); waiting for processing." | |
| last_err="" | |
| done_ok="" | |
| for _ in $(seq 1 30); do | |
| if ! status="$(gh api "repos/$REPO/code-scanning/sarifs/$sarif_id" \ | |
| --jq .processing_status 2>/tmp/gh_poll_err)"; then | |
| last_err="$(cat /tmp/gh_poll_err)" | |
| status="pending" | |
| fi | |
| echo "processing_status=$status" | |
| case "$status" in | |
| complete) done_ok=1; break ;; | |
| failed) | |
| echo "CodeQL SARIF processing failed:" >&2 | |
| gh api "repos/$REPO/code-scanning/sarifs/$sarif_id" --jq '.errors[]?' >&2 | |
| exit 1 ;; | |
| esac | |
| sleep 5 | |
| done | |
| if [ -z "$done_ok" ]; then | |
| echo "::warning title=CodeQL SARIF::$f still '$status' after the bounded wait;" \ | |
| "not failing the gate. last GET error: ${last_err:-none}" | |
| fi | |
| done | |
| if [ "$found" = 0 ]; then | |
| echo "::warning title=CodeQL SARIF::no SARIF in $SARIF_DIR; nothing uploaded." | |
| fi |