Skip to content

Commit 27ad39a

Browse files
mhuckamhucka
committed
Revise nightly test & scan workflows (quantumlib#1015)
This updates the workflows to the latest version from our template repo. It should fix the current failure with Scorecard, as well as streamline the CodeQL runs.
1 parent b2d1ef4 commit 27ad39a

5 files changed

Lines changed: 170 additions & 84 deletions

File tree

‎.github/workflows/codeql.yaml‎

Lines changed: 61 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,89 @@
1-
# Summary: configuration for CodeQL.
1+
# Zero-configuration modular workflow to run CodeQL code scans.
2+
#
3+
# CodeQL is a semantic code analysis tool that finds vulnerabilities by
4+
# understanding the code's logic. It is provided by GitHub. CodeQL's findings
5+
# are reported in the repo's code-scanning results page,
6+
# https://github.com/quantumlib/REPO/security/code-scanning/.
27
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
38

49
name: CodeQL code scan
5-
run-name: Do ${{inputs.reason}} CodeQL code scan
10+
run-name: Run CodeQL code scan ${{inputs.reason}}
611

712
on:
13+
pull_request:
14+
types: [opened, synchronize]
15+
branches:
16+
- main
17+
- master
18+
19+
# Support merge queues.
20+
merge_group:
21+
types:
22+
- checks_requested
23+
24+
# Allow manual invocation.
25+
workflow_dispatch:
26+
827
# Allow calling from nightly.yaml.
928
workflow_call:
1029
inputs:
11-
# Why is this workflow being called?
1230
reason:
1331
type: string
14-
required: false
15-
16-
# Allow manual invocation.
17-
workflow_dispatch:
1832

1933
# Declare default permissions as read only.
2034
permissions: read-all
2135

22-
# Cancel any previously-started but still active runs on the same branch.
23-
concurrency:
24-
cancel-in-progress: true
25-
group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
26-
2736
jobs:
37+
create-matrix:
38+
name: Determine languages used
39+
runs-on: ubuntu-24.04
40+
timeout-minutes: 5
41+
outputs:
42+
language-matrix: ${{steps.matrix.outputs.languages}}
43+
steps:
44+
- name: Get list of programming languages used in this repo
45+
id: matrix
46+
uses: advanced-security/set-codeql-language-matrix@975244ea2e4c0668b8d289ac2b61fa7f0976f328
47+
with:
48+
access-token: ${{secrets.GITHUB_TOKEN}}
49+
endpoint: ${{github.event.repository.languages_url}}
50+
2851
codeql:
29-
name: Run
52+
if: ${{needs.create-matrix.outputs.language-matrix != '[]'}}
53+
name: Run CodeQL scanner for ${{matrix.language}}
54+
needs: create-matrix
3055
runs-on: ubuntu-24.04
56+
timeout-minutes: 10
3157
permissions:
32-
security-events: write
58+
actions: read
59+
contents: read
3360
packages: read
61+
security-events: write
62+
strategy:
63+
fail-fast: false
64+
matrix:
65+
language: ${{fromJSON(needs.create-matrix.outputs.language-matrix)}}
3466
steps:
3567
- name: Check out a copy of the git repository
3668
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3769

38-
- name: Initialize CodeQL
39-
uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3
70+
- name: Initialize CodeQL scanning tool
71+
uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3
4072
with:
41-
languages: Python
73+
languages: ${{matrix.language}}
74+
queries: security-and-quality
75+
config: |
76+
paths-ignore:
77+
- '**/*.gltf'
78+
- '**/*.json'
79+
- '**/*.md'
80+
- '**/*.png'
81+
- '**/*.rst'
82+
- '**/*.svg'
83+
- '**/*.stim'
84+
- '**/*.txt'
4285
4386
- name: Perform CodeQL Analysis
4487
uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3
4588
with:
46-
category: '/language:Python'
89+
category: "/language:${{matrix.language}}"

‎.github/workflows/nightly-pytest.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
# This workflow expects input values passed by nightly.yml.
33
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
44

5-
name: Nightly full tests – Pytest matrix
6-
run-name: Run ${{inputs.reason}} Pytest full tests
5+
name: 'Nightly tests & scans – Pytest matrix'
6+
run-name: Run nightly Pytest
77

88
on:
99
workflow_call:

‎.github/workflows/nightly.yaml‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
# https://github.com/quantumlib/OpenFermion/actions/workflows/nightly.yaml
66
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
77

8-
name: Nightly full tests
9-
run-name: Run nightly tests and code scans in ${{github.repository}}
8+
name: 'Nightly tests & scans'
9+
run-name: Run nightly tests and code scans
1010

1111
on:
1212
schedule:
@@ -20,36 +20,37 @@ permissions: read-all
2020

2121
jobs:
2222
cirq-stable:
23-
name: Pytest Cirq stable release
23+
name: Nightly Pytest Cirq stable
2424
uses: ./.github/workflows/nightly-pytest.yaml
2525
with:
2626
args: ''
27-
reason: nightly
27+
reason: '(nightly)'
2828

2929
cirq-pre:
30-
name: Pytest Cirq pre-release
30+
name: Nightly Pytest Cirq pre-release
3131
uses: ./.github/workflows/nightly-pytest.yaml
3232
with:
3333
args: '--pre'
34-
reason: nightly
34+
reason: '(nightly)'
3535

3636
codeql:
37-
name: CodeQL code scan
37+
name: Nightly CodeQL code scan
3838
uses: ./.github/workflows/codeql.yaml
3939
permissions: write-all
4040
with:
41-
reason: nightly
41+
reason: '(nightly)'
4242

43-
scorecard:
44-
name: Scorecard code scan
45-
uses: ./.github/workflows/scorecard.yaml
43+
osv:
44+
name: Nightly OSV code scan
45+
uses: ./.github/workflows/osv-scanner.yaml
4646
permissions: write-all
4747
with:
48-
reason: nightly
48+
reason: '(nightly)'
4949

50-
osv:
51-
name: OSV code scan
52-
uses: ./.github/workflows/osv-scanner.yaml
50+
scorecard:
51+
name: Nightly Scorecard analysis
52+
uses: ./.github/workflows/scorecard.yaml
5353
permissions: write-all
54+
secrets: inherit
5455
with:
55-
reason: nightly
56+
reason: '(nightly)'

‎.github/workflows/osv-scanner.yaml‎

Lines changed: 68 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,79 +1,118 @@
1-
# Summary: run Open Source Vulnerabilities (OSV) code scan.
1+
# Zero-config modular workflow to run Open Source Vulnerabilities code scans.
2+
#
3+
# The OSV scanner is a dependency vulnerability scanner that identifies known
4+
# vulnerabilities in a project's dependencies. It supports C/C++, Python, Java,
5+
# JavaScript, and others. The findings are reported in the repo's code-scanning
6+
# results page, https://github.com/quantumlib/REPO/security/code-scanning/.
27
#
38
# The OSV project provides a GA workflow that you can reference as a step with
4-
# "uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml".
5-
# Unfortunately, that workflow inexplicably doesn't use the latest version of
6-
# the scanner and reporter workflows, and also does other things like hard-code
7-
# the value of the osv-scanner "--gh-annotations" option to "false". Using the
8-
# separate actions directly allows us to adjust the options and use Dependabot
9-
# to update the workflow versions as new ones are introduced.
9+
# uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml.
10+
# Unfortunately, that workflow hardcodes some behaviors (such as uploading the
11+
# SARIF file to the workflow Actions tab, which we rarely need). The workflow
12+
# below is basically a heavily modified version of theirs.
1013
#
11-
# For more examples and options, including how to ignore specific
14+
# For more OSV scanner examples and options, including how to ignore specific
1215
# vulnerabilities, see https://google.github.io/osv-scanner/github-action/.
1316
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1417

1518
name: OSV code scan
16-
run-name: Do ${{inputs.reason}} OSV code scan
19+
run-name: Run OSV vulnerability scanner ${{inputs.reason}}
1720

1821
on:
22+
pull_request:
23+
types: [opened, synchronize]
24+
branches:
25+
- main
26+
- master
27+
28+
# Support merge queues.
1929
merge_group:
2030
types:
2131
- checks_requested
2232

33+
# Allow manual invocation.
34+
workflow_dispatch:
35+
2336
# Allow calling from nightly.yaml.
2437
workflow_call:
2538
inputs:
26-
# Why is this workflow being called?
2739
reason:
2840
type: string
29-
required: false
30-
31-
# Allow manual invocation.
32-
workflow_dispatch:
3341

3442
# Declare default permissions as read only.
3543
permissions: read-all
3644

3745
jobs:
3846
osv-scan:
39-
name: Run
40-
runs-on: ubuntu-22.04
47+
name: Run OSV scanner
48+
runs-on: ubuntu-24.04
4149
timeout-minutes: 15
4250
permissions:
43-
# Needed to upload the results to code-scanning dashboard.
51+
# Needed to read commit contents:
52+
actions: read
53+
# Needed to upload the results to code-scanning dashboard:
4454
security-events: write
45-
# Read commit contents
55+
# Needed to upload SARIF file to CodeQL.
4656
contents: read
47-
actions: read
4857
steps:
4958
- name: Check out a copy of the git repository
5059
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5160
with:
52-
persist-credentials: false
61+
fetch-depth: 0
62+
63+
- name: Check out the target branch
64+
run: |
65+
git checkout ${{github.base_ref || github.ref_name}}
66+
git submodule update --recursive
67+
68+
- name: Run OSV scanner on existing code
69+
# yamllint disable rule:line-length
70+
uses: google/osv-scanner-action/osv-scanner-action@119c605e0e6e6c491e092da25b0c752d109b0b43 # v2.0.0
71+
continue-on-error: true
72+
with:
73+
scan-args: |-
74+
--format=json
75+
--output=old-results.json
76+
--include-git-root
77+
--recursive
78+
./
79+
80+
- name: Check out current branch
81+
# Use -f in case any changes were made by osv-scanner.
82+
run: |
83+
git checkout -f "$GITHUB_SHA"
84+
git submodule update --recursive
5385
54-
- name: Run OSV scanner
86+
- name: Run OSV scanner on new code
5587
# yamllint disable rule:line-length
56-
uses: google/osv-scanner-action/osv-scanner-action@90fad544eb4036129491f76db3161ffdc2956748 # v1.9.2
88+
uses: google/osv-scanner-action/osv-scanner-action@119c605e0e6e6c491e092da25b0c752d109b0b43 # v2.0.0
5789
continue-on-error: true
5890
with:
5991
scan-args: |-
60-
--config=.osv-scanner.toml
6192
--format=json
62-
--output=osv-results.json
93+
--output=new-results.json
94+
--include-git-root
6395
--recursive
6496
./
6597
66-
- name: Run OSV reporter
98+
- name: Run the OSV scanner reporter
6799
# yamllint disable rule:line-length
68-
uses: google/osv-scanner-action/osv-reporter-action@90fad544eb4036129491f76db3161ffdc2956748 # v1.9.2
100+
uses: google/osv-scanner-action/osv-reporter-action@119c605e0e6e6c491e092da25b0c752d109b0b43 # v2.0.0
69101
with:
70102
scan-args: |-
71103
--output=osv-results.sarif
72-
--new=osv-results.json
104+
--old=old-results.json
105+
--new=new-results.json
73106
--gh-annotations=true
74107
--fail-on-vuln=true
75108
76-
- name: Upload to code-scanning dashboard
77-
uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
109+
- name: Upload results to the repository's code-scanning results dashboard
110+
id: upload_artifact
111+
# yamllint disable rule:line-length
112+
uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
78113
with:
79114
sarif_file: osv-results.sarif
115+
116+
- name: Error troubleshooter
117+
if: ${{always() && steps.upload_artifact.outcome == 'failure'}}
118+
run: echo '::error::Artifact upload failed. Check the workflow logs.'

0 commit comments

Comments
 (0)