Skip to content

Commit dc2a4a4

Browse files
CopilotTravisEz13
authored and
kilasuit
committed
Refactor analyze job to reusable workflow and enable on Windows CI (PowerShell#26322)
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>
1 parent d5203ca commit dc2a4a4

4 files changed

Lines changed: 102 additions & 56 deletions

File tree

‎.github/workflows/analyze-reusable.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
name: CodeQL Analysis (Reusable)
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
runner_os:
7+
description: 'Runner OS for CodeQL analysis'
8+
type: string
9+
required: false
10+
default: ubuntu-latest
11+
12+
permissions:
13+
actions: read # for github/codeql-action/init to get workflow details
14+
contents: read # for actions/checkout to fetch code
15+
security-events: write # for github/codeql-action/analyze to upload SARIF results
16+
17+
env:
18+
DOTNET_CLI_TELEMETRY_OPTOUT: 1
19+
DOTNET_NOLOGO: 1
20+
POWERSHELL_TELEMETRY_OPTOUT: 1
21+
__SuppressAnsiEscapeSequences: 1
22+
nugetMultiFeedWarnLevel: none
23+
24+
jobs:
25+
analyze:
26+
name: Analyze
27+
runs-on: ${{ inputs.runner_os }}
28+
29+
strategy:
30+
fail-fast: false
31+
matrix:
32+
# Override automatic language detection by changing the below list
33+
# Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
34+
language: ['csharp']
35+
# Learn more...
36+
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
37+
38+
steps:
39+
- name: Checkout repository
40+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
41+
with:
42+
fetch-depth: '0'
43+
44+
- uses: actions/setup-dotnet@v5
45+
with:
46+
global-json-file: ./global.json
47+
48+
# Initializes the CodeQL tools for scanning.
49+
- name: Initialize CodeQL
50+
uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5
51+
with:
52+
languages: ${{ matrix.language }}
53+
# If you wish to specify custom queries, you can do so here or in a config file.
54+
# By default, queries listed here will override any specified in a config file.
55+
# Prefix the list here with "+" to use these queries and those in the config file.
56+
# queries: ./path/to/local/query, your-org/your-repo/queries@main
57+
58+
- run: |
59+
Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
60+
name: Capture Environment
61+
shell: pwsh
62+
63+
- run: |
64+
Import-Module .\tools\ci.psm1
65+
Invoke-CIInstall -SkipUser
66+
name: Bootstrap
67+
shell: pwsh
68+
69+
- run: |
70+
Import-Module .\tools\ci.psm1
71+
Invoke-CIBuild -Configuration 'StaticAnalysis'
72+
name: Build
73+
shell: pwsh
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5

‎.github/workflows/linux-ci.yml‎

Lines changed: 8 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -158,63 +158,16 @@ jobs:
158158
test_results_artifact_name: testResults-xunit
159159

160160
analyze:
161-
permissions:
162-
actions: read # for github/codeql-action/init to get workflow details
163-
contents: read # for actions/checkout to fetch code
164-
security-events: write # for github/codeql-action/analyze to upload SARIF results
165-
name: Analyze
166-
runs-on: ubuntu-latest
161+
name: CodeQL Analysis
167162
needs: changes
168163
if: ${{ needs.changes.outputs.source == 'true' }}
169-
170-
strategy:
171-
fail-fast: false
172-
matrix:
173-
# Override automatic language detection by changing the below list
174-
# Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
175-
language: ['csharp']
176-
# Learn more...
177-
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
178-
179-
steps:
180-
- name: Checkout repository
181-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
182-
with:
183-
fetch-depth: '0'
184-
185-
- uses: actions/setup-dotnet@v5
186-
with:
187-
global-json-file: ./global.json
188-
189-
# Initializes the CodeQL tools for scanning.
190-
- name: Initialize CodeQL
191-
uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5
192-
with:
193-
languages: ${{ matrix.language }}
194-
# If you wish to specify custom queries, you can do so here or in a config file.
195-
# By default, queries listed here will override any specified in a config file.
196-
# Prefix the list here with "+" to use these queries and those in the config file.
197-
# queries: ./path/to/local/query, your-org/your-repo/queries@main
198-
199-
- run: |
200-
Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
201-
name: Capture Environment
202-
shell: pwsh
203-
204-
- run: |
205-
Import-Module .\tools\ci.psm1
206-
Invoke-CIInstall -SkipUser
207-
name: Bootstrap
208-
shell: pwsh
209-
210-
- run: |
211-
Import-Module .\tools\ci.psm1
212-
Invoke-CIBuild
213-
name: Build
214-
shell: pwsh
215-
216-
- name: Perform CodeQL Analysis
217-
uses: github/codeql-action/analyze@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5
164+
uses: ./.github/workflows/analyze-reusable.yml
165+
permissions:
166+
actions: read
167+
contents: read
168+
security-events: write
169+
with:
170+
runner_os: ubuntu-latest
218171

219172
ready_to_merge:
220173
name: Linux ready to merge

‎.github/workflows/windows-ci.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,17 @@ jobs:
156156
with:
157157
runner_os: windows-latest
158158
test_results_artifact_name: testResults-xunit
159+
analyze:
160+
name: CodeQL Analysis
161+
needs: changes
162+
if: ${{ needs.changes.outputs.source == 'true' }}
163+
uses: ./.github/workflows/analyze-reusable.yml
164+
permissions:
165+
actions: read
166+
contents: read
167+
security-events: write
168+
with:
169+
runner_os: windows-latest
159170
windows_packaging:
160171
name: Windows Packaging
161172
needs:
@@ -170,6 +181,7 @@ jobs:
170181
- windows_test_elevated_others
171182
- windows_test_unelevated_ci
172183
- windows_test_unelevated_others
184+
- analyze
173185
- windows_packaging
174186
if: always()
175187
uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@v1.0.0

‎tools/ci.psm1‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,11 @@ function Invoke-CIFull
101101
# Implements the CI 'build_script' step
102102
function Invoke-CIBuild
103103
{
104+
param(
105+
[ValidateSet('Debug', 'Release', 'CodeCoverage', 'StaticAnalysis')]
106+
[string]$Configuration = 'Release'
107+
)
108+
104109
$releaseTag = Get-ReleaseTag
105110
# check to be sure our test tags are correct
106111
$result = Get-PesterTag
@@ -115,7 +120,7 @@ function Invoke-CIBuild
115120
Start-PSBuild -Configuration 'CodeCoverage' -PSModuleRestore -CI -ReleaseTag $releaseTag
116121
}
117122

118-
Start-PSBuild -PSModuleRestore -Configuration 'Release' -CI -ReleaseTag $releaseTag -UseNuGetOrg
123+
Start-PSBuild -PSModuleRestore -Configuration $Configuration -CI -ReleaseTag $releaseTag -UseNuGetOrg
119124
Save-PSOptions
120125

121126
$options = (Get-PSOptions)

0 commit comments

Comments
 (0)