fix(coverage): bound filament-coverage resolution so one dark printer can't stall mobile startup #1425
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| branches: [development] | |
| pull_request: | |
| branches: [development] | |
| schedule: | |
| # Weekly, so newly published CodeQL queries surface without a code change. | |
| - cron: '17 3 * * 1' | |
| workflow_dispatch: | |
| concurrency: | |
| group: codeql-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # select — reuses ci.yml's changed-path classifier (scripts/ci/select-dotnet-tests.sh) | |
| # for its full-safe fallback (shared build config, CI/workflow edits, unmapped | |
| # src/ paths, trusted pushes, workflow_dispatch all force a full run), then | |
| # additionally scans the raw changed-file list for C#/JS-TS extensions | |
| # directly. A path-classification bucket (`want_dotnet_build`/`want_frontend`) | |
| # is not a safe proxy for "does CodeQL need to scan this language": those | |
| # flags only cover `src/**`/`src/Web/**` respectively, while trackable | |
| # JS/TS/C# sources also live outside those trees (e.g. `scripts/compliance/*.mjs`, | |
| # `tools/*.js`, root-level `*.ts` configs). The extension scan is therefore | |
| # the authoritative signal for gating each CodeQL leg; the selector script | |
| # only supplies the full-safe fallback. schedule has no diff to compute | |
| # against so it is force-treated as full-safe explicitly (the shared script | |
| # only natively special-cases workflow_dispatch/trusted pushes), keeping the | |
| # weekly scan and manual runs at full-matrix coverage. | |
| # --------------------------------------------------------------------------- | |
| select: | |
| name: Select affected languages | |
| runs-on: ubuntu-latest | |
| outputs: | |
| codeql_matrix: ${{ steps.langs.outputs.codeql_matrix }} | |
| reason: ${{ steps.selector.outputs.reason }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Compute change set | |
| id: diff | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| BASE_REF: ${{ github.event.pull_request.base.ref || github.ref_name }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| AFTER_SHA: ${{ github.sha }} | |
| OUT_FILE: ${{ runner.temp }}/changed.z | |
| run: bash scripts/ci/compute-change-set.sh | |
| - name: Run selector | |
| id: selector | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| BASE_REF: ${{ github.event.pull_request.base.ref || github.ref_name }} | |
| CHANGED_FILES_FROM_Z: ${{ steps.diff.outputs.changed_file }} | |
| # select-dotnet-tests.sh only special-cases workflow_dispatch/trusted | |
| # pushes as full-safe; schedule has no diff to compute against, so | |
| # force full-safe here to preserve unconditional weekly scans. | |
| FORCE_FULL_SAFE: ${{ github.event_name == 'schedule' && 'schedule' || steps.diff.outputs.force_full_safe }} | |
| run: bash scripts/ci/select-dotnet-tests.sh | |
| - name: Detect touched languages | |
| id: langs | |
| env: | |
| CHANGED_FILES_FROM_Z: ${{ steps.diff.outputs.changed_file }} | |
| # full_matrix already folds in every full-safe reason (shared | |
| # config, CI/workflow edits, unmapped src/ paths, trusted pushes, | |
| # workflow_dispatch, forced schedule, diff-load failure). | |
| FULL_MATRIX: ${{ steps.selector.outputs.full_matrix }} | |
| run: | | |
| set -uo pipefail | |
| want_csharp="false" | |
| want_js="false" | |
| if [[ "$FULL_MATRIX" == "true" ]]; then | |
| want_csharp="true" | |
| want_js="true" | |
| else | |
| f="${CHANGED_FILES_FROM_Z:-}" | |
| if [[ -n "$f" && -r "$f" ]]; then | |
| while IFS= read -r -d '' p; do | |
| [[ -z "$p" ]] && continue | |
| case "$p" in | |
| *.cs|*.csproj|*.sln) want_csharp="true" ;; | |
| esac | |
| case "$p" in | |
| *.js|*.jsx|*.mjs|*.cjs|*.ts|*.tsx) want_js="true" ;; | |
| esac | |
| done < "$f" | |
| fi | |
| fi | |
| items="" | |
| first=1 | |
| if [[ "$want_csharp" == "true" ]]; then | |
| items+='{"language":"csharp","build-mode":"manual"}' | |
| first=0 | |
| fi | |
| if [[ "$want_js" == "true" ]]; then | |
| if (( first == 0 )); then items+=","; fi | |
| items+='{"language":"javascript-typescript","build-mode":"none"}' | |
| fi | |
| matrix_json='{"include":['"$items"']}' | |
| { | |
| echo "want_csharp=$want_csharp" | |
| echo "want_js=$want_js" | |
| echo "codeql_matrix=$matrix_json" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Publish selection to summary | |
| env: | |
| SELECTOR_REASON: ${{ steps.selector.outputs.reason }} | |
| WANT_CSHARP: ${{ steps.langs.outputs.want_csharp }} | |
| WANT_JS: ${{ steps.langs.outputs.want_js }} | |
| run: | | |
| { | |
| echo "## CodeQL selection" | |
| printf -- '- reason: `%s`\n' "$SELECTOR_REASON" | |
| printf -- '- csharp leg: `%s`\n' "$WANT_CSHARP" | |
| printf -- '- javascript-typescript leg: `%s`\n' "$WANT_JS" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| needs: [select] | |
| if: needs.select.outputs.codeql_matrix != '{"include":[]}' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJson(needs.select.outputs.codeql_matrix) }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| config-file: ./.github/codeql/codeql-config.yml | |
| - name: Setup .NET | |
| if: matrix.language == 'csharp' | |
| uses: actions/setup-dotnet@v6 | |
| with: | |
| dotnet-version: 10.0.x | |
| # CodeQL analyses exactly what the build compiles, and `paths-ignore` in | |
| # codeql-config.yml has no effect under `build-mode: manual` — so test | |
| # code is kept out of the C# database by not compiling it. Test projects | |
| # are leaf nodes, so production coverage is unchanged. This build is for | |
| # extraction only; ci.yml still builds and tests the full solution. | |
| - name: Generate CodeQL solution filter (excludes src/tests) | |
| if: matrix.language == 'csharp' | |
| run: bash scripts/ci/generate-codeql-slnf.sh | |
| - name: Build (C#) | |
| if: matrix.language == 'csharp' | |
| working-directory: src | |
| run: dotnet build ./farm-web.codeql.slnf | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: /language:${{ matrix.language }} |