codeql-extractor-bicep/.github/workflows/build.yml at 5916aef1dee37e4dbf09d649e402da1f442595fe · GitHubSecurityLab/codeql-extractor-bicep · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
name: Build and Compile Extractor Pack

on:
  pull_request:
    branches: ["main", "develop"]
  workflow_dispatch:

permissions:
  contents: read
  packages: read
  pull-requests: read

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        test-folders: ["library-tests", "queries-tests"]
    steps:
      - name: "Checkout"
        uses: actions/checkout@v4

      - name: "Check for changes"
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
        id: extractor-changes
        with:
          filters: |
            src:
              - 'extractor/**'
              - 'rust-toolchain.toml'
              - 'Cargo.*'

      - name: "Download Extracter"
        if: steps.extractor-changes.outputs.src == 'false'
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: |
          set -e

          gh release list -L 1 -R "$GITHUB_REPOSITORY"

          gh release download \
              -R "$GITHUB_REPOSITORY" \
              --clobber \
              --pattern 'extractor-bicep.tar.gz'

          tar -zxf extractor-bicep.tar.gz
          chmod +x extractor-pack/tools/*.sh
          chmod +x extractor-pack/tools/**/*

      - name: "Set up Rust"
        uses: dtolnay/rust-toolchain@nightly
        if: steps.extractor-changes.outputs.src == 'true'

      - name: "Build Extractor"
        if: steps.extractor-changes.outputs.src == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh extensions install github/gh-codeql
          gh codeql set-version latest

          ./scripts/create-extractor-pack.sh

          gh codeql resolve languages --format=json --search-path ./extractor-pack

      - name: "Run Tests"
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          ./scripts/run-tests.sh "ql/test/${{ matrix.test-folders }}"

  docs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
        id: changes
        with:
          filters: |
            src:
              - '**.md'
      # lint markdown
      - name: "Lint Markdown"
        if: steps.changes.outputs.src == 'true'
        run: |
          npm install -g markdownlint-cli
          markdownlint '**.md' --ignore node_modules --disable MD013