Skip to content

Commit 6174a09

Browse files
daxian-dbwdaxian-dbw
authored
[release/v7.5] Refactor analyze job to reusable workflow and enable on Windows CI (#26799)
1 parent 487acc5 commit 6174a09

4 files changed

Lines changed: 102 additions & 58 deletions

File tree

‎.github/workflows/analyze-reusable.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
name: CodeQL Analysis (Reusable)
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
runner_os:
7+
description: 'Runner OS for CodeQL analysis'
8+
type: string
9+
required: false
10+
default: ubuntu-latest
11+
12+
permissions:
13+
actions: read # for github/codeql-action/init to get workflow details
14+
contents: read # for actions/checkout to fetch code
15+
security-events: write # for github/codeql-action/analyze to upload SARIF results
16+
17+
env:
18+
DOTNET_CLI_TELEMETRY_OPTOUT: 1
19+
DOTNET_NOLOGO: 1
20+
POWERSHELL_TELEMETRY_OPTOUT: 1
21+
__SuppressAnsiEscapeSequences: 1
22+
nugetMultiFeedWarnLevel: none
23+
24+
jobs:
25+
analyze:
26+
name: Analyze
27+
runs-on: ${{ inputs.runner_os }}
28+
29+
strategy:
30+
fail-fast: false
31+
matrix:
32+
# Override automatic language detection by changing the below list
33+
# Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
34+
language: ['csharp']
35+
# Learn more...
36+
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
37+
38+
steps:
39+
- name: Checkout repository
40+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
41+
with:
42+
fetch-depth: '0'
43+
44+
- uses: actions/setup-dotnet@v5
45+
with:
46+
global-json-file: ./global.json
47+
48+
# Initializes the CodeQL tools for scanning.
49+
- name: Initialize CodeQL
50+
uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5
51+
with:
52+
languages: ${{ matrix.language }}
53+
# If you wish to specify custom queries, you can do so here or in a config file.
54+
# By default, queries listed here will override any specified in a config file.
55+
# Prefix the list here with "+" to use these queries and those in the config file.
56+
# queries: ./path/to/local/query, your-org/your-repo/queries@main
57+
58+
- run: |
59+
Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
60+
name: Capture Environment
61+
shell: pwsh
62+
63+
- run: |
64+
Import-Module .\tools\ci.psm1
65+
Invoke-CIInstall -SkipUser
66+
name: Bootstrap
67+
shell: pwsh
68+
69+
- run: |
70+
Import-Module .\tools\ci.psm1
71+
Invoke-CIBuild -Configuration 'StaticAnalysis'
72+
name: Build
73+
shell: pwsh
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5

‎.github/workflows/linux-ci.yml‎

Lines changed: 8 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -155,65 +155,17 @@ jobs:
155155
runner_os: ubuntu-latest
156156
test_results_artifact_name: testResults-xunit
157157

158-
159158
analyze:
160-
permissions:
161-
actions: read # for github/codeql-action/init to get workflow details
162-
contents: read # for actions/checkout to fetch code
163-
security-events: write # for github/codeql-action/analyze to upload SARIF results
164-
name: Analyze
165-
runs-on: ubuntu-latest
159+
name: CodeQL Analysis
166160
needs: changes
167161
if: ${{ needs.changes.outputs.source == 'true' }}
168-
169-
strategy:
170-
fail-fast: false
171-
matrix:
172-
# Override automatic language detection by changing the below list
173-
# Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
174-
language: ['csharp']
175-
# Learn more...
176-
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
177-
178-
steps:
179-
- name: Checkout repository
180-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
181-
with:
182-
fetch-depth: '0'
183-
184-
- uses: actions/setup-dotnet@v4
185-
with:
186-
global-json-file: ./global.json
187-
188-
# Initializes the CodeQL tools for scanning.
189-
- name: Initialize CodeQL
190-
uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
191-
with:
192-
languages: ${{ matrix.language }}
193-
# If you wish to specify custom queries, you can do so here or in a config file.
194-
# By default, queries listed here will override any specified in a config file.
195-
# Prefix the list here with "+" to use these queries and those in the config file.
196-
# queries: ./path/to/local/query, your-org/your-repo/queries@main
197-
198-
- run: |
199-
Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
200-
name: Capture Environment
201-
shell: pwsh
202-
203-
- run: |
204-
Import-Module .\tools\ci.psm1
205-
Invoke-CIInstall -SkipUser
206-
name: Bootstrap
207-
shell: pwsh
208-
209-
- run: |
210-
Import-Module .\tools\ci.psm1
211-
Invoke-CIBuild
212-
name: Build
213-
shell: pwsh
214-
215-
- name: Perform CodeQL Analysis
216-
uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
162+
uses: ./.github/workflows/analyze-reusable.yml
163+
permissions:
164+
actions: read
165+
contents: read
166+
security-events: write
167+
with:
168+
runner_os: ubuntu-latest
217169

218170
ready_to_merge:
219171
name: Linux ready to merge

‎.github/workflows/windows-ci.yml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,17 @@ jobs:
154154
with:
155155
runner_os: windows-latest
156156
test_results_artifact_name: testResults-xunit
157-
157+
analyze:
158+
name: CodeQL Analysis
159+
needs: changes
160+
if: ${{ needs.changes.outputs.source == 'true' }}
161+
uses: ./.github/workflows/analyze-reusable.yml
162+
permissions:
163+
actions: read
164+
contents: read
165+
security-events: write
166+
with:
167+
runner_os: windows-latest
158168
windows_packaging:
159169
name: Windows Packaging
160170
needs:
@@ -169,6 +179,7 @@ jobs:
169179
- windows_test_elevated_others
170180
- windows_test_unelevated_ci
171181
- windows_test_unelevated_others
182+
- analyze
172183
- windows_packaging
173184
if: always()
174185
uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@v1.0.0

‎tools/ci.psm1‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,11 @@ function Invoke-CIFull
101101
# Implements the CI 'build_script' step
102102
function Invoke-CIBuild
103103
{
104+
param(
105+
[ValidateSet('Debug', 'Release', 'CodeCoverage', 'StaticAnalysis')]
106+
[string]$Configuration = 'Release'
107+
)
108+
104109
$releaseTag = Get-ReleaseTag
105110
# check to be sure our test tags are correct
106111
$result = Get-PesterTag
@@ -115,7 +120,7 @@ function Invoke-CIBuild
115120
Start-PSBuild -Configuration 'CodeCoverage' -PSModuleRestore -CI -ReleaseTag $releaseTag
116121
}
117122

118-
Start-PSBuild -PSModuleRestore -Configuration 'Release' -CI -ReleaseTag $releaseTag -UseNuGetOrg
123+
Start-PSBuild -PSModuleRestore -Configuration $Configuration -CI -ReleaseTag $releaseTag -UseNuGetOrg
119124
Save-PSOptions
120125

121126
$options = (Get-PSOptions)

0 commit comments

Comments
 (0)