-
Notifications
You must be signed in to change notification settings - Fork 384
Validate workflow to check that all codeql-action
versions are the same
#3099
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR adds validation to ensure all github/codeql-action
steps in a workflow use the same version reference. The change introduces a new warning when inconsistent versions are detected, helping prevent compatibility issues.
Key changes:
- Added version consistency validation for CodeQL Action steps
- Added comprehensive test coverage for the new validation logic
- Added a new error type for inconsistent action versions
Reviewed Changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
File | Description |
---|---|
src/workflow.ts | Added validation logic to check version consistency across CodeQL Action steps and new error message |
src/workflow.test.ts | Added test cases covering version mismatch scenarios, consistent versions, and other actions |
lib/*.js | Generated JavaScript files (not reviewed per guidelines) |
) { | ||
const parts = step.uses.split("@"); | ||
if (parts.length >= 2) { | ||
codeqlStepRefs.push(parts[parts.length - 1]); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The logic assumes that splitting on '@' will always produce the version as the last part, but this may not handle edge cases correctly. For example, if step.uses
is 'github/codeql-action/init@v2@extra', this would extract 'extra' instead of 'v2@extra'. Consider using parts.slice(1).join('@')
to handle multiple '@' characters properly.
codeqlStepRefs.push(parts[parts.length - 1]); | |
codeqlStepRefs.push(parts.slice(1).join("@")); |
Copilot uses AI. Check for mistakes.
const parts = step.uses.split("@"); | ||
if (parts.length >= 2) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Minor: don't we have this kind of parsing elsewhere already?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We have
const format = new RegExp(
"(?<owner>[^/]+)/(?<repo>[^/]+)/(?<path>[^@]+)@(?<ref>.*)",
);
in getRemoteConfig
, but I thought I'd keep this simple.
0d7b992
to
bb98ff4
Compare
This PR adds an extra check to
validateWorkflows
which collects all the refs used forgithub/codeql-action
steps in the workflow and checks that they are all the same.If there is a mismatch, then this results in a warning.
Risk assessment
For internal use only. Please select the risk level of this change:
Merge / deployment checklist