From 95ab225a5b63a3b57bed32f4083575604157e3cb Mon Sep 17 00:00:00 2001 From: LizardByte-bot <108553330+LizardByte-bot@users.noreply.github.com> Date: Sun, 9 Jun 2024 17:06:48 -0400 Subject: [PATCH] chore: update global workflows (#151) --- .github/pr_release_template.md | 28 ------------ .github/workflows/auto-create-pr.yml | 35 --------------- .github/workflows/automerge.yml | 64 ---------------------------- .github/workflows/codeql.yml | 36 ++++++++++++++-- .github/workflows/python-flake8.yml | 4 +- .github/workflows/yaml-lint.yml | 4 +- 6 files changed, 37 insertions(+), 134 deletions(-) delete mode 100644 .github/pr_release_template.md delete mode 100644 .github/workflows/auto-create-pr.yml delete mode 100644 .github/workflows/automerge.yml diff --git a/.github/pr_release_template.md b/.github/pr_release_template.md deleted file mode 100644 index b6f6acf5847..00000000000 --- a/.github/pr_release_template.md +++ /dev/null @@ -1,28 +0,0 @@ -## Description - -This PR was created automatically. - - -### Screenshot - - - -### Issues Fixed or Closed - - - - - -## Type of Change -- [ ] Bug fix (non-breaking change which fixes an issue) -- [ ] New feature (non-breaking change which adds functionality) -- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) -- [ ] Dependency update (updates to dependencies) -- [ ] Documentation update (changes to documentation) -- [ ] Repository update (changes to repository files, e.g. `.github/...`) - -## Branch Updates -- [x] I want maintainers to keep my branch updated - -## Changelog Summary - diff --git a/.github/workflows/auto-create-pr.yml b/.github/workflows/auto-create-pr.yml deleted file mode 100644 index 13705dd539c..00000000000 --- a/.github/workflows/auto-create-pr.yml +++ /dev/null @@ -1,35 +0,0 @@ ---- -# This action is centrally managed in https://github.com//.github/ -# Don't make changes to this file in this repo as they will be overwritten with changes made to the same file in -# the above-mentioned repo. - -# This workflow creates a PR automatically when anything is merged/pushed into the `nightly` branch. The PR is created -# against the `master` (default) branch. - -name: Auto create PR - -on: - push: - branches: - - 'nightly' - -jobs: - create_pr: - if: startsWith(github.repository, 'LizardByte/') - runs-on: ubuntu-latest - - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Create Pull Request - uses: repo-sync/pull-request@v2 - with: - source_branch: "" # should be "nightly" as it's the triggering branch - destination_branch: "master" - pr_title: "Pulling ${{ github.ref_name }} into master" - pr_template: ".github/pr_release_template.md" - pr_assignee: "${{ secrets.GH_BOT_NAME }}" - pr_draft: true - pr_allow_empty: false - github_token: ${{ secrets.GH_BOT_TOKEN }} diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml deleted file mode 100644 index 04c9f1acfbc..00000000000 --- a/.github/workflows/automerge.yml +++ /dev/null @@ -1,64 +0,0 @@ ---- -# This action is centrally managed in https://github.com//.github/ -# Don't make changes to this file in this repo as they will be overwritten with changes made to the same file in -# the above-mentioned repo. - -# This workflow will, first, automatically approve PRs created by @LizardByte-bot. Then it will automerge relevant PRs. - -name: Automerge PR - -on: - pull_request: - types: - - opened - - synchronize - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - autoapprove: - if: >- - contains(fromJson('["LizardByte-bot"]'), github.event.pull_request.user.login) && - contains(fromJson('["LizardByte-bot"]'), github.actor) && - startsWith(github.repository, 'LizardByte/') - runs-on: ubuntu-latest - steps: - - name: Autoapproving - uses: hmarr/auto-approve-action@v4 - with: - github-token: "${{ secrets.GITHUB_TOKEN }}" - - - name: Label autoapproved - uses: actions/github-script@v7 - with: - github-token: ${{ secrets.GH_BOT_TOKEN }} - script: | - github.rest.issues.addLabels({ - issue_number: context.issue.number, - owner: context.repo.owner, - repo: context.repo.repo, - labels: ['autoapproved', 'autoupdate'] - }) - - automerge: - if: startsWith(github.repository, 'LizardByte/') - needs: [autoapprove] - runs-on: ubuntu-latest - - steps: - - name: Automerging - uses: pascalgn/automerge-action@v0.16.3 - env: - BASE_BRANCHES: nightly - GITHUB_TOKEN: ${{ secrets.GH_BOT_TOKEN }} - GITHUB_LOGIN: ${{ secrets.GH_BOT_NAME }} - MERGE_LABELS: "!dependencies" - MERGE_METHOD: "squash" - MERGE_COMMIT_MESSAGE: "{pullRequest.title} (#{pullRequest.number})" - MERGE_DELETE_BRANCH: true - MERGE_ERROR_FAIL: true - MERGE_FILTER_AUTHOR: ${{ secrets.GH_BOT_NAME }} - MERGE_RETRIES: "240" # 1 hour - MERGE_RETRY_SLEEP: "15000" # 15 seconds diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ec4ed250181..4ff15026b3b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -9,9 +9,9 @@ name: "CodeQL" on: push: - branches: ["master", "nightly"] + branches: ["master"] pull_request: - branches: ["master", "nightly"] + branches: ["master"] schedule: - cron: '00 12 * * 0' # every Sunday at 12:00 UTC @@ -140,9 +140,12 @@ jobs: submodules: recursive - name: Setup msys2 - if: runner.os == 'Windows' + if: >- + runner.os == 'Windows' && + matrix.language == 'cpp' uses: msys2/setup-msys2@v2 with: + msystem: ucrt64 update: true # Initializes the CodeQL tools for scanning. @@ -157,6 +160,10 @@ jobs: # yamllint disable-line rule:line-length # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs # queries: security-extended,security-and-quality + config: | + paths-ignore: + - node_modules + - third-party # Pre autobuild # create a file named .codeql-prebuild-${{ matrix.language }}.sh in the root of your repository @@ -180,3 +187,26 @@ jobs: uses: github/codeql-action/analyze@v3 with: category: "/language:${{matrix.language}}" + output: sarif-results + upload: failure-only + + - name: filter-sarif + uses: advanced-security/filter-sarif@v1 + with: + input: sarif-results/${{ matrix.language }}.sarif + output: sarif-results/${{ matrix.language }}.sarif + patterns: | + -node_modules/** + -third\-party/** + + - name: Upload SARIF + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: sarif-results/${{ matrix.language }}.sarif + + - name: Upload loc as a Build Artifact + uses: actions/upload-artifact@v4 + with: + name: sarif-results-${{ matrix.language }}-${{ runner.os }} + path: sarif-results + retention-days: 1 diff --git a/.github/workflows/python-flake8.yml b/.github/workflows/python-flake8.yml index e08ab10fcac..61e23f741b7 100644 --- a/.github/workflows/python-flake8.yml +++ b/.github/workflows/python-flake8.yml @@ -9,11 +9,11 @@ name: flake8 on: pull_request: - branches: [master, nightly] + branches: [master] types: [opened, synchronize, reopened] concurrency: - group: ${{ github.workflow }}-${{ github.ref }} + group: "${{ github.workflow }}-${{ github.ref }}" cancel-in-progress: true jobs: diff --git a/.github/workflows/yaml-lint.yml b/.github/workflows/yaml-lint.yml index 7e1fd469409..023b836c0ce 100644 --- a/.github/workflows/yaml-lint.yml +++ b/.github/workflows/yaml-lint.yml @@ -9,11 +9,11 @@ name: yaml lint on: pull_request: - branches: [master, nightly] + branches: [master] types: [opened, synchronize, reopened] concurrency: - group: ${{ github.workflow }}-${{ github.ref }} + group: "${{ github.workflow }}-${{ github.ref }}" cancel-in-progress: true jobs: