diff --git a/.github/actions/prepare-test/action.yml b/.github/actions/prepare-test/action.yml index 5e2b5028f7..4c11ec4929 100644 --- a/.github/actions/prepare-test/action.yml +++ b/.github/actions/prepare-test/action.yml @@ -6,11 +6,11 @@ inputs: required: true use-all-platform-bundle: description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL" - default: 'false' + default: "false" required: false setup-kotlin: description: "If true, we setup kotlin" - default: 'true' + default: "true" required: true outputs: tools-url: @@ -73,7 +73,10 @@ runs: exit 1 fi - - uses: fwilhe2/setup-kotlin@9c245a6425255f5e98ba1ce6c15d31fce7eca9da + - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1 if: ${{ inputs.setup-kotlin == 'true' }} with: - version: 1.8.21 + # Kotlin is installed on the runners by default, but the version that is pre-installed is too new + # to be supported by CodeQL. This Kotlin version is selected to be compatible with both the default Java + # version on the `ubuntu-latest` runners and CodeQL. + version: 2.1.20 diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0e0dd0cce1..ae4a4476e4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -26,7 +26,7 @@ updates: - package-ecosystem: github-actions directories: - "/.github/workflows" - - "/.github/actions" + - "/.github/actions/*/" schedule: interval: weekly cooldown: diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml index fb471c5eac..a36cc43a7b 100644 --- a/.github/workflows/__go-tracing-autobuilder.yml +++ b/.github/workflows/__go-tracing-autobuilder.yml @@ -44,7 +44,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-24.04 version: stable-v2.20.7 - os: ubuntu-latest version: stable-v2.21.4 diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml index b3b043def9..05fedfb035 100644 --- a/.github/workflows/__go-tracing-custom-build-steps.yml +++ b/.github/workflows/__go-tracing-custom-build-steps.yml @@ -44,7 +44,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-24.04 version: stable-v2.20.7 - os: ubuntu-latest version: stable-v2.21.4 diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml index 20bdea6955..276d4cfda5 100644 --- a/.github/workflows/__go-tracing-legacy-workflow.yml +++ b/.github/workflows/__go-tracing-legacy-workflow.yml @@ -44,7 +44,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-24.04 version: stable-v2.20.7 - os: ubuntu-latest version: stable-v2.21.4 diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index a388e57342..d54b24a1ef 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -54,7 +54,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-24.04 version: stable-v2.20.7 - os: macos-15-xlarge version: stable-v2.20.7 diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml deleted file mode 100644 index c3348db6cf..0000000000 --- a/.github/workflows/__rubocop-multi-language.yml +++ /dev/null @@ -1,74 +0,0 @@ -# Warning: This file is generated automatically, and should not be modified. -# Instead, please modify the template in the pr-checks directory and run: -# pr-checks/sync.sh -# to regenerate this file. - -name: PR Check - RuboCop multi-language -env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GO111MODULE: auto -on: - push: - branches: - - main - - releases/v* - pull_request: {} - merge_group: - types: - - checks_requested - schedule: - - cron: '0 5 * * *' - workflow_dispatch: - inputs: {} - workflow_call: - inputs: {} -defaults: - run: - shell: bash -concurrency: - cancel-in-progress: ${{ github.event_name == 'pull_request' || false }} - group: rubocop-multi-language-${{github.ref}} -jobs: - rubocop-multi-language: - strategy: - fail-fast: false - matrix: - include: - - os: ubuntu-latest - version: default - name: RuboCop multi-language - if: github.triggering_actor != 'dependabot[bot]' - permissions: - contents: read - security-events: read - timeout-minutes: 45 - runs-on: ${{ matrix.os }} - steps: - - name: Check out repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Prepare test - id: prepare-test - uses: ./.github/actions/prepare-test - with: - version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' - - name: Set up Ruby - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0 - with: - ruby-version: 2.6 - - name: Install Code Scanning integration - run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install - - name: Install dependencies - run: bundle install - - name: RuboCop run - run: | - bash -c " - bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif - [[ $? -ne 2 ]] - " - - uses: ./../action/upload-sarif - with: - sarif_file: rubocop.sarif - env: - CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml index f26b4eb2eb..d3b5a8a5b8 100644 --- a/.github/workflows/__rust.yml +++ b/.github/workflows/__rust.yml @@ -34,7 +34,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-24.04 version: stable-v2.20.7 - os: ubuntu-latest version: stable-v2.22.1 diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index c61bd6b177..4f9082acd2 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -6,13 +6,13 @@ env: on: push: branches: - - main - - releases/v* + - main + - releases/v* pull_request: merge_group: types: [checks_requested] schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: concurrency: @@ -30,10 +30,10 @@ jobs: fail-fast: false matrix: version: - - stable-v2.20.7 - - default - - linked - - nightly-latest + - stable-v2.20.7 + - default + - linked + - nightly-latest name: Upload debug artifacts after failure in analyze continue-on-error: true env: @@ -43,7 +43,12 @@ jobs: # We currently need `security-events: read` to access feature flags. security-events: read timeout-minutes: 45 - runs-on: ubuntu-latest + + # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`). + # We could install that older version on the newer runners, or use the older runner. + # We do the latter here. This can be removed once we stop supporting `v2.20.7`. + runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }} + steps: - name: Dump GitHub event run: cat "${GITHUB_EVENT_PATH}" @@ -60,7 +65,7 @@ jobs: - name: Install .NET uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: - dotnet-version: '9.x' + dotnet-version: "9.x" - name: Assert best-effort artifact scan completed uses: ./../action/.github/actions/verify-debug-artifact-scan-completed - uses: ./../action/init diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 6d162d9c0c..610e1aab8a 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -5,13 +5,13 @@ env: on: push: branches: - - main - - releases/v* + - main + - releases/v* pull_request: merge_group: types: [checks_requested] schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: concurrency: @@ -29,10 +29,10 @@ jobs: fail-fast: false matrix: version: - - stable-v2.20.7 - - default - - linked - - nightly-latest + - stable-v2.20.7 + - default + - linked + - nightly-latest name: Upload debug artifacts env: CODEQL_ACTION_TEST_MODE: true @@ -41,7 +41,12 @@ jobs: contents: read # We currently need `security-events: read` to access feature flags. security-events: read - runs-on: ubuntu-latest + + # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`). + # We could install that older version on the newer runners, or use the older runner. + # We do the latter here. This can be removed once we stop supporting `v2.20.7`. + runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }} + steps: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -56,7 +61,7 @@ jobs: - name: Install .NET uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: - dotnet-version: '9.x' + dotnet-version: "9.x" - name: Assert best-effort artifact scan completed uses: ./../action/.github/actions/verify-debug-artifact-scan-completed - uses: ./../action/init diff --git a/.github/workflows/deflake.yml b/.github/workflows/deflake.yml index 158dc6c96d..27024b3780 100644 --- a/.github/workflows/deflake.yml +++ b/.github/workflows/deflake.yml @@ -60,7 +60,6 @@ on: - "PR Check - Proxy test" - "PR Check - Remote config file" - "PR Check - Resolve environment" - - "PR Check - RuboCop multi-language" - "PR Check - Ruby analysis" - "PR Check - Rust analysis" - "PR Check - Split workflow" diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml deleted file mode 100644 index eec3aa8335..0000000000 --- a/pr-checks/checks/rubocop-multi-language.yml +++ /dev/null @@ -1,23 +0,0 @@ -name: "RuboCop multi-language" -description: "Tests using RuboCop to analyze a multi-language repository and then using the CodeQL Action to upload the resulting SARIF" -# This check doesn't use CodeQL, so the `version` matrix variable is unused. -versions: - - default -steps: - - name: Set up Ruby - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0 - with: - ruby-version: 2.6 - - name: Install Code Scanning integration - run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install - - name: Install dependencies - run: bundle install - - name: RuboCop run - run: | - bash -c " - bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif - [[ $? -ne 2 ]] - " - - uses: ./../action/upload-sarif - with: - sarif_file: rubocop.sarif diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 1729f5409b..c205e94a72 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -137,7 +137,15 @@ interface LanguageSetup { /** Describes partial mappings from built-in languages to their specific setup information. */ type LanguageSetups = Partial>; -// The default set of CodeQL Bundle versions to use for the PR checks. +/** A type representing version identifiers. */ +type Version = + | "default" + | "linked" + | "nightly-latest" + // This is an approximation, but sufficient validation for our needs here. + | `stable-v${number}.${number}.${number}`; + +/** The default set of CodeQL Bundle versions to use for the PR checks. */ const defaultTestVersions = [ // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts` "stable-v2.20.7", @@ -159,7 +167,10 @@ const defaultTestVersions = [ "linked", // A nightly build directly from the our private repo, built in the last 24 hours. "nightly-latest", -]; +] as const satisfies Version[]; + +/** A type representing the default test versions. */ +type DefaultTestVersion = (typeof defaultTestVersions)[number]; /** The default versions we use for languages / frameworks, if not specified as a workflow input. */ const defaultLanguageVersions = { @@ -313,9 +324,11 @@ const languageSetups: LanguageSetups = { }, }; -// This is essentially an arbitrary version of `yq`, which happened to be the one that -// `choco` fetched when we moved away from using that here. -// See https://github.com/github/codeql-action/pull/3423 +/** + * This is essentially an arbitrary version of `yq`, which happened to be the one that + * `choco` fetched when we moved away from using that here. + * See https://github.com/github/codeql-action/pull/3423 + */ const YQ_VERSION = "v4.50.1"; const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks"); @@ -442,10 +455,23 @@ function generateJobMatrix( : [operatingSystemConfig["runner-image"]]; for (const runnerImage of runnerImagesForOs) { - matrix.push({ - os: runnerImage, - version, - }); + // stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest`. + // We could install that older version on the newer runners, or use the older runner. + // We do the latter here. This can be removed once we stop supporting `v2.20.7`. + // Since this is typed as `DefaultTestVersion`, it will become an error once `stable-v2.20.7` + // is removed from `defaultTestVersions`. + const requiresOlderRunnerImage: DefaultTestVersion = "stable-v2.20.7"; + if ( + runnerImage === "ubuntu-latest" && + version === requiresOlderRunnerImage + ) { + matrix.push({ os: "ubuntu-24.04", version }); + } else { + matrix.push({ + os: runnerImage, + version, + }); + } } } }