Declare permissions #5
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Compile all queries using the latest stable CodeQL CLI" | |
| on: | |
| push: | |
| branches: # makes sure the cache gets populated - running on the branches people tend to merge into. | |
| - main | |
| - "rc/*" | |
| - "codeql-cli-*" | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| choose-runner: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| mac-12: ${{ steps.results.outputs.MAC_12 }} | |
| ubuntu-latest: ${{ steps.results.outputs.UBUNTU_LATEST }} | |
| windows-latest: ${{ steps.results.outputs.WINDOWS_LATEST }} | |
| steps: | |
| - id: results | |
| run: | | |
| echo "UBUNTU_LATEST=$UBUNTU_LATEST" >> $GITHUB_OUTPUT | |
| echo "MAC_12=$MAC_12" >> $GITHUB_OUTPUT | |
| echo "WINDOWS_LATEST=$WINDOWS_LATEST" >> $GITHUB_OUTPUT | |
| env: | |
| UBUNTU_LATEST: ${{ vars.use-large-linux-runners-for-speed && 'ubuntu-latest-xl' || 'ubuntu-latest' }} | |
| MAC_12: ${{ vars.use-large-mac-runners-for-speed && 'macos-12-xl' || 'macos-12' }} | |
| WINDOWS_LATEST: ${{ vars.use-large-win-runners-for-speed && 'windows-latest-xl' || 'windows-latest' }} | |
| compile-queries: | |
| needs: choose-runner | |
| runs-on: ${{ needs.choose-runner.outputs.ubuntu-latest }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup CodeQL | |
| uses: ./.github/actions/fetch-codeql | |
| with: | |
| channel: 'release' | |
| - name: Cache compilation cache | |
| id: query-cache | |
| uses: ./.github/actions/cache-query-compilation | |
| with: | |
| key: all-queries | |
| - name: check formatting | |
| run: find */ql -type f \( -name "*.qll" -o -name "*.ql" \) -print0 | xargs -0 -n 3000 -P 10 codeql query format -q --check-only | |
| - name: compile queries - check-only | |
| # run with --check-only if running in a PR (github.sha != main) | |
| if : ${{ github.event_name == 'pull_request' }} | |
| shell: bash | |
| run: codeql query compile -q -j0 */ql/{src,examples} --keep-going --warnings=error --check-only --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}" --compilation-cache-size=500 | |
| - name: compile queries - full | |
| # do full compile if running on main - this populates the cache | |
| if : ${{ github.event_name != 'pull_request' }} | |
| shell: bash | |
| run: codeql query compile -q -j0 */ql/{src,examples} --keep-going --warnings=error --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}" --compilation-cache-size=500 |