Update CodeQL CLI Version #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update CodeQL CLI Version | |
| # Bumps the pinned CodeQL CLI/library version (.codeqlversion) and refreshes every | |
| # pack's codeql-pack.lock.yml against it, then opens a PR with the result. | |
| # | |
| # This does NOT publish anything by itself and does NOT bump any pack's `version:` | |
| # field - it only prepares the dependency-refresh half of the process documented in | |
| # CONTRIBUTING.md's "Updating the pinned CodeQL CLI/library version" section. A human | |
| # (or a delegated Copilot coding agent) still needs to fix any compilation/test | |
| # breakage the new CLI/library versions introduce before merging, and the existing | |
| # "CodeQL Update Release" workflow (update-release.yml) is still what bumps every | |
| # pack's version and triggers the real batch publish once this PR is merged. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| codeql_version: | |
| description: "New CodeQL CLI version to pin, e.g. 2.22.0 (a leading 'v' is fine too)" | |
| required: true | |
| type: string | |
| jobs: | |
| update-codeql-version: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read # PR creation uses a scoped GitHub App token (SECLABS_APP_ID/SECLABS_APP_KEY), not GITHUB_TOKEN | |
| packages: read # `codeql pack upgrade` resolves codeql/* library deps from GHCR (see ci.yml) | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Validate and normalize version input | |
| id: version | |
| run: | | |
| set -euo pipefail | |
| VERSION="${{ inputs.codeql_version }}" | |
| VERSION="${VERSION#v}" # tolerate an accidental leading "v" | |
| if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "::error::codeql_version must look like X.Y.Z, got: ${{ inputs.codeql_version }}" | |
| exit 1 | |
| fi | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Update .codeqlversion | |
| run: | | |
| echo "${{ steps.version.outputs.version }}" > .codeqlversion | |
| echo "Pinned CodeQL CLI version bumped to ${{ steps.version.outputs.version }}" | |
| - name: Setup CodeQL | |
| uses: ./.github/actions/install-codeql | |
| - name: Pin codeql/* library dependencies to the CodeQL Bundle version | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| .github/scripts/pin-codeql-library-versions.sh "${{ steps.version.outputs.version }}" | |
| - name: Upgrade every pack's dependencies | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| # Exclusions (kept in sync with the same exclusions in | |
| # .github/scripts/pin-codeql-library-versions.sh): | |
| # - ./ql/hotspots is a standalone local dev tool (see | |
| # ql/hotspots/README.md and .github/workflows/hotspots.yml), not | |
| # one of the per-language src/lib/ext/ext-library-sources packs | |
| # that ci.yml and publish.yml operate on. Its `codeql/ql: '*'` | |
| # dependency isn't a real resolvable GHCR package, so it always | |
| # fails `codeql pack upgrade`. | |
| # - ./codeql_home is where .github/actions/install-codeql | |
| # downloads/extracts the CodeQL CLI; it ships its own small | |
| # vendored qlpack.yml packs (e.g. codeql/<lang>/downgrades) that | |
| # have nothing to do with this repo and shouldn't be touched. | |
| # - ./codeql and */.codeql are a locally-cloned github/codeql | |
| # checkout (used by ql/hotspots) and CodeQL's own per-pack build | |
| # caches, respectively - neither is a repo pack either. | |
| for dir in $(find . -name qlpack.yml -not -path "./ql/hotspots/*" -not -path "./codeql_home/*" -not -path "./codeql/*" -not -path "*/.codeql/*" -exec dirname {} \;); do | |
| echo "::group::codeql pack upgrade $dir" | |
| codeql pack upgrade "$dir" | |
| echo "::endgroup::" | |
| done | |
| - name: Summarize changed files | |
| run: | | |
| { | |
| echo "## Files changed by this CodeQL CLI bump" | |
| echo | |
| git status --porcelain | sed 's/^/- /' | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: Get Token | |
| id: get_workflow_token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| app-id: ${{ secrets.SECLABS_APP_ID }} | |
| private-key: ${{ secrets.SECLABS_APP_KEY }} | |
| - name: Create Pull Request | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 | |
| with: | |
| token: ${{ steps.get_workflow_token.outputs.token }} | |
| title: "chore: bump pinned CodeQL CLI to v${{ steps.version.outputs.version }}" | |
| commit-message: "chore: bump pinned CodeQL CLI to v${{ steps.version.outputs.version }}" | |
| body: | | |
| Automated CLI version bump, requested via the "Update CodeQL CLI Version" | |
| workflow (`workflow_dispatch`, `codeql_version: ${{ steps.version.outputs.version }}`). | |
| This PR: | |
| - Updates `.codeqlversion` to `${{ steps.version.outputs.version }}`. | |
| - Pins every `codeql/<lang>-all` / `codeql/<lang>-queries` dependency across all | |
| `qlpack.yml` files to the exact version shipped in the official CodeQL Bundle | |
| for this CLI release (see `.github/scripts/pin-codeql-library-versions.sh`) - | |
| this keeps `codeql pack upgrade` from jumping those libraries to | |
| registry-latest instead of the version this CLI actually ships/tests against. | |
| - Runs `codeql pack upgrade <dir>` for every pack directory to refresh its | |
| `codeql-pack.lock.yml` against the new CLI and pinned library versions. | |
| **This PR does not publish anything by itself** - no pack `version:` field is | |
| bumped here, so `publish.yml`'s version-diff trigger won't fire for it yet. | |
| Remaining steps (see CONTRIBUTING.md's "Updating the pinned CodeQL CLI/library | |
| version" section): | |
| - [ ] Check CI on this PR - fix any compilation/test errors caused by upstream | |
| API changes. This is usually the hardest part; consider delegating it to a | |
| Copilot coding agent session pointed at this PR/branch. | |
| - [ ] Update the "Supported CodeQL versions" table in CONTRIBUTING.md. | |
| - [ ] Review and merge. | |
| - [ ] Once merged, run the "CodeQL Update Release" workflow | |
| (`update-release.yml`) to bump every pack's `version:` in lockstep via | |
| `.release.yml` and trigger the real batch publish. | |
| branch: "chore/update-codeql-cli-${{ steps.version.outputs.version }}" | |
| labels: "version" | |
| delete-branch: true |