generate-code-scanning-query-lists.yml

name: Generate code scanning query lists

# Manual CodeQL CLI release runs, about every two weeks, generate query table reusables
# from github/codeql and open a pull request when they change.

on:
  workflow_dispatch:
    inputs:
      SOURCE_BRANCH:
        description: 'Branch to pull the source files from in the codeql repo (for example codeql-cli-2.x.x).'
        type: string
        required: true
        default: 'main'

  pull_request:
    paths:
      - .github/workflows/generate-code-scanning-query-lists.yml
      - src/codeql-queries/scripts/generate-code-scanning-query-list.ts
      - src/codeql-queries/scripts/generate-code-quality-query-list.ts
      - .github/actions/install-cocofix/action.yml

permissions:
  contents: read

jobs:
  generate-security-query-lists:
    if: github.repository == 'github/docs-internal'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: ./.github/actions/node-npm-setup

      - name: Checkout codeql repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: github/codeql
          path: codeql
          ref: ${{ inputs.SOURCE_BRANCH || 'main' }}

      - name: Get the codeql SHA being synced
        id: codeql
        shell: bash
        run: |
          cd codeql
          OPENAPI_COMMIT_SHA=$(git rev-parse HEAD)
          echo "OPENAPI_COMMIT_SHA=$OPENAPI_COMMIT_SHA" >> $GITHUB_OUTPUT
          echo "Copied files from github/codeql repo. Commit SHA: $OPENAPI_COMMIT_SHA"

      - name: Download CodeQL CLI
        # fetch-codeql lives in the checked-out github/codeql repository.
        uses: ./codeql/.github/actions/fetch-codeql

      - name: Test CodeQL CLI Download
        shell: bash
        run: codeql --version

      # Start the CodeQL CLI server once so later CodeQL commands avoid repeated JVM initialization.
      - name: Start CodeQL CLI server in the background
        shell: bash
        run: |
          codeql execute cli-server &
          sleep 3
          codeql --version

      - uses: ./.github/actions/install-cocofix
        with:
          # The Docs Engineering Bot app has repo-level Packages permission and cannot
          # read org-scoped packages, so cocofix installation requires the PAT.
          token: ${{ secrets.DOCS_BOT_PAT_BASE }}

      - name: Build code scanning security query lists
        shell: bash
        run: |
          for lang in "actions" "cpp" "csharp" "go" "java" "javascript" "python" "ruby" "rust" "swift"; do
            echo "Generating code scanning query list for $lang"
            npm run generate-code-scanning-query-list -- \
              --verbose \
              --codeql-path codeql \
              --codeql-dir codeql \
              -o data/reusables/code-scanning/codeql-query-tables/$lang.md \
              $lang
          done

      - name: Upload security query lists
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: security-query-lists
          path: data/reusables/code-scanning/codeql-query-tables/

  generate-quality-query-lists:
    if: github.repository == 'github/docs-internal'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: ./.github/actions/node-npm-setup

      - name: Checkout codeql repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: github/codeql
          path: codeql
          ref: ${{ inputs.SOURCE_BRANCH || 'main' }}

      - name: Get the codeql SHA being synced
        id: codeql
        shell: bash
        run: |
          cd codeql
          OPENAPI_COMMIT_SHA=$(git rev-parse HEAD)
          echo "OPENAPI_COMMIT_SHA=$OPENAPI_COMMIT_SHA" >> $GITHUB_OUTPUT
          echo "Copied files from github/codeql repo. Commit SHA: $OPENAPI_COMMIT_SHA"

      - name: Download CodeQL CLI
        # fetch-codeql lives in the checked-out github/codeql repository.
        uses: ./codeql/.github/actions/fetch-codeql

      - name: Test CodeQL CLI Download
        shell: bash
        run: codeql --version

      # Start the CodeQL CLI server once so later CodeQL commands avoid repeated JVM initialization.
      - name: Start CodeQL CLI server in the background
        shell: bash
        run: |
          codeql execute cli-server &
          sleep 3
          codeql --version

      - name: Build code quality query lists
        shell: bash
        run: |
          for lang in "csharp" "go" "java" "javascript" "python" "ruby"; do
            echo "Generating code quality query list for $lang"
            npm run generate-code-quality-query-list -- \
              --verbose \
              --codeql-path codeql \
              --codeql-dir codeql \
              -o data/reusables/code-quality/codeql-query-tables/$lang.md \
              $lang
          done

      - name: Upload quality query lists
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: quality-query-lists
          path: data/reusables/code-quality/codeql-query-tables/

  create-pull-request:
    if: github.repository == 'github/docs-internal'
    runs-on: ubuntu-latest
    # Serialize publishing so a second run sees the first run's PR before it force-pushes.
    # Pull request dry runs get their own group so they never queue behind or cancel a publisher.
    concurrency:
      group: ${{ github.workflow }}-query-table-publication-${{ github.event_name == 'pull_request' && github.run_id || 'publish' }}
      cancel-in-progress: false
    permissions:
      contents: write
      pull-requests: write
    needs: [generate-security-query-lists, generate-quality-query-lists]
    steps:
      - name: Checkout repository code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Checkout codeql repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: github/codeql
          path: codeql
          ref: ${{ inputs.SOURCE_BRANCH || 'main' }}

      - name: Get the codeql SHA being synced
        id: codeql
        shell: bash
        run: |
          cd codeql
          OPENAPI_COMMIT_SHA=$(git rev-parse HEAD)
          echo "OPENAPI_COMMIT_SHA=$OPENAPI_COMMIT_SHA" >> $GITHUB_OUTPUT
          echo "Copied files from github/codeql repo. Commit SHA: $OPENAPI_COMMIT_SHA"

      - name: Download security query lists
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          name: security-query-lists
          path: data/reusables/code-scanning/codeql-query-tables/

      - name: Download quality query lists
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          name: quality-query-lists
          path: data/reusables/code-quality/codeql-query-tables/

      - name: Insight into diff
        shell: bash
        run: |
          git diff

      - name: Create pull request
        env:
          GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
          DRY_RUN: ${{ github.event_name == 'pull_request'}}
        shell: bash
        run: |

          # Git status must only report generated query tables, so remove the
          # checked-out CodeQL repository.
          rm -fr ./codeql

          changes=$(git diff --name-only | wc -l)
          untracked=$(git status --untracked-files --short | wc -l)
          if [[ $changes -eq 0 ]] && [[ $untracked -eq 0 ]]; then
            echo "There are no changes to commit after running the generation and conversion scripts. Exiting..."
            exit 0
          fi

          git config --global user.name "docs-bot"
          git config --global user.email "77750099+docs-bot@users.noreply.github.com"

          branchname=codeql-query-tables-${{ steps.codeql.outputs.OPENAPI_COMMIT_SHA }}

          # Pull request runs validate generated files without pushing branches.
          if [ "$DRY_RUN" = "true" ]; then
            echo "Dry-run mode when run in a pull request"
            echo "See the 'Insight into diff' step for the changes it would create PR about."
            exit 0
          fi

          # Check for an open PR before pushing so reruns do not overwrite commits added to it.
          existing_pr=$(gh pr list --repo github/docs-internal --head "$branchname" --json number --jq '.[0].number')
          if [[ -n "$existing_pr" ]]; then
            echo "Pull request #$existing_pr already exists for branch $branchname. Skipping PR creation."
            exit 0
          fi

          git checkout -b $branchname
          git add data/reusables/code-scanning/codeql-query-tables
          git add data/reusables/code-quality/codeql-query-tables
          git commit -m "Update CodeQL query tables"

          # Force-push over a branch left by a failed attempt; this workflow exclusively owns these branches.
          git push --force -u origin $branchname

          echo "Creating pull request..."
          gh pr create \
            --title "Update CodeQL query tables" \
            --repo github/docs-internal \
           --label "codeql-query-tables,skip FR board,ready-for-doc-review,workflow-generated" \
            --body '👋 humans. This PR updates the **CodeQL query table reusables** with the latest changes in preparation for the next **CodeQL CLI** release. (Synced from codeql@${{ steps.codeql.outputs.OPENAPI_COMMIT_SHA }})


            No action is required from the first responder for the Docs content team. This PR is automatically added to the Docs content review board. Any writer can review this by checking that the PR looks sensible. If CI does not pass or other problems arise, contact #technical-content on slack.


            When the DRI for the CodeQL CLI release is ready to publish, they will ask us to merge this PR in #docs-content.

            _Generated by the [Generate code scanning query lists](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) workflow run._'