Skip to content

Commit fee8cd5

Browse files
thpiercethpierce
authored
feat: add self-validating workflow gate jobs (#458)
Add gate job that fail if any workflow job fails OR if any job is missing from the gate's needs array. Prevents both job failures and configuration drift when adding new workflow jobs. Add CodeQL advanced config to align with ADOT Lang (e.g. https://github.com/aws-observability/aws-otel-python-instrumentation/blob/main/.github/workflows/codeql.yml), add gate job to workflow.Callout: I don't think it's possible to have one gate for both workflows, but it should not be the case that we add more over time. CodeQL is generated by using the GitHub UI to enable advance config. I only changed `<action>@v#` -> `<action>@<SHA>` and added the `all-codeql-checks-pass` job, aligning with other repos. ### Testing: See: aws-observability/aws-otel-python-instrumentation#477 *Rollback procedure:* Revert *Ensure you've run the following tests on your changes and include the link below:* PR workflow sufficient By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
1 parent 8981d01 commit fee8cd5

File tree

2 files changed

+177
-1
lines changed

2 files changed

+177
-1
lines changed

‎.github/workflows/codeql.yml‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL Advanced"
13+
14+
on:
15+
push:
16+
branches: [ "main", "release/*" ]
17+
pull_request:
18+
branches: [ "main", "release/*" ]
19+
schedule:
20+
- cron: '33 6 * * 1'
21+
22+
jobs:
23+
analyze:
24+
name: Analyze (${{ matrix.language }})
25+
# Runner size impacts CodeQL analysis time. To learn more, please see:
26+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
27+
# - https://gh.io/supported-runners-and-hardware-resources
28+
# - https://gh.io/using-larger-runners (GitHub.com only)
29+
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
30+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
31+
permissions:
32+
# required for all workflows
33+
security-events: write
34+
35+
# required to fetch internal or private CodeQL packs
36+
packages: read
37+
38+
# only required for workflows in private repositories
39+
actions: read
40+
contents: read
41+
42+
strategy:
43+
fail-fast: false
44+
matrix:
45+
include:
46+
- language: actions
47+
build-mode: none
48+
- language: csharp
49+
build-mode: none
50+
- language: java-kotlin
51+
build-mode: none # This mode only analyzes Java. Set this to 'autobuild' or 'manual' to analyze Kotlin too.
52+
- language: javascript-typescript
53+
build-mode: none
54+
- language: python
55+
build-mode: none
56+
# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
57+
# Use `c-cpp` to analyze code written in C, C++ or both
58+
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
59+
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
60+
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
61+
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
62+
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
63+
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
64+
steps:
65+
- name: Checkout repository
66+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #5.0.0
67+
68+
# Add any setup steps before running the `github/codeql-action/init` action.
69+
# This includes steps like installing compilers or runtimes (`actions/setup-node`
70+
# or others). This is typically only required for manual builds.
71+
# - name: Setup runtime (example)
72+
# uses: actions/setup-example@v1
73+
74+
# Initializes the CodeQL tools for scanning.
75+
- name: Initialize CodeQL
76+
uses: github/codeql-action/init@16df4fbc19aea13d921737861d6c622bf3cefe23 #v2.23.0
77+
with:
78+
languages: ${{ matrix.language }}
79+
build-mode: ${{ matrix.build-mode }}
80+
# If you wish to specify custom queries, you can do so here or in a config file.
81+
# By default, queries listed here will override any specified in a config file.
82+
# Prefix the list here with "+" to use these queries and those in the config file.
83+
84+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
85+
# queries: security-extended,security-and-quality
86+
87+
# If the analyze step fails for one of the languages you are analyzing with
88+
# "We were unable to automatically build your code", modify the matrix above
89+
# to set the build mode to "manual" for that language. Then modify this step
90+
# to build your code.
91+
# ℹ️ Command-line programs to run using the OS shell.
92+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
93+
- if: matrix.build-mode == 'manual'
94+
shell: bash
95+
run: |
96+
echo 'If you are using a "manual" build mode for one or more of the' \
97+
'languages you are analyzing, replace this with the commands to build' \
98+
'your code, for example:'
99+
echo ' make bootstrap'
100+
echo ' make release'
101+
exit 1
102+
103+
- name: Perform CodeQL Analysis
104+
uses: github/codeql-action/analyze@16df4fbc19aea13d921737861d6c622bf3cefe23 #v2.23.0
105+
with:
106+
category: "/language:${{matrix.language}}"
107+
108+
all-codeql-checks-pass:
109+
runs-on: ubuntu-latest
110+
needs: [analyze]
111+
if: always()
112+
steps:
113+
- name: Checkout to get workflow file
114+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #5.0.0
115+
116+
- name: Check all jobs succeeded and none missing
117+
run: |
118+
# Check if all needed jobs succeeded
119+
results='${{ toJSON(needs) }}'
120+
if echo "$results" | jq -r '.[] | .result' | grep -v success; then
121+
echo "Some jobs failed"
122+
exit 1
123+
fi
124+
125+
# Extract all job names from workflow (excluding this gate job)
126+
all_jobs=$(yq eval '.jobs | keys | .[]' .github/workflows/codeql.yml | grep -v "all-codeql-checks-pass" | sort)
127+
128+
# Extract job names from needs array
129+
needed_jobs='${{ toJSON(needs) }}'
130+
needs_list=$(echo "$needed_jobs" | jq -r 'keys[]' | sort)
131+
132+
# Check if any jobs are missing from needs
133+
missing_jobs=$(comm -23 <(echo "$all_jobs") <(echo "$needs_list"))
134+
if [ -n "$missing_jobs" ]; then
135+
echo "ERROR: Jobs missing from needs array in all-codeql-checks-pass:"
136+
echo "$missing_jobs"
137+
echo "Please add these jobs to the needs array of all-codeql-checks-pass"
138+
exit 1
139+
fi
140+
141+
echo "All CodeQL checks passed and no jobs missing from gate!"

‎.github/workflows/pr-build.yml‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,39 @@ jobs:
2121
uses: gradle/actions/setup-gradle@v3
2222

2323
- name: Build with Gradle
24-
run: ./gradlew build
24+
run: ./gradlew build
25+
26+
all-pr-checks-pass:
27+
runs-on: ubuntu-latest
28+
needs: [build]
29+
if: always()
30+
steps:
31+
- name: Checkout to get workflow file
32+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #5.0.0
33+
34+
- name: Check all jobs succeeded and none missing
35+
run: |
36+
# Check if all needed jobs succeeded
37+
results='${{ toJSON(needs) }}'
38+
if echo "$results" | jq -r '.[] | .result' | grep -v success; then
39+
echo "Some jobs failed"
40+
exit 1
41+
fi
42+
43+
# Extract all job names from workflow (excluding this gate job)
44+
all_jobs=$(yq eval '.jobs | keys | .[]' .github/workflows/pr-build.yml | grep -v "all-pr-checks-pass" | sort)
45+
46+
# Extract job names from needs array
47+
needed_jobs='${{ toJSON(needs) }}'
48+
needs_list=$(echo "$needed_jobs" | jq -r 'keys[]' | sort)
49+
50+
# Check if any jobs are missing from needs
51+
missing_jobs=$(comm -23 <(echo "$all_jobs") <(echo "$needs_list"))
52+
if [ -n "$missing_jobs" ]; then
53+
echo "ERROR: Jobs missing from needs array in all-pr-checks-pass:"
54+
echo "$missing_jobs"
55+
echo "Please add these jobs to the needs array of all-pr-checks-pass"
56+
exit 1
57+
fi
58+
59+
echo "All checks passed and no jobs missing from gate!"

0 commit comments

Comments
 (0)