From cfb394096693c34f35d26029562491b6e6b7a3b4 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 9 Nov 2026 17:13:08 +0000 Subject: [PATCH 1/3] Respect `use-all-platform-bundle` for the latest nightly in `prepare-test` Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/actions/prepare-test/action.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/actions/prepare-test/action.yml b/.github/actions/prepare-test/action.yml index 4c11ec4929..1276aca8eb 100644 --- a/.github/actions/prepare-test/action.yml +++ b/.github/actions/prepare-test/action.yml @@ -36,7 +36,14 @@ runs: set -e # Fail this Action if `gh release list` fails. if [[ "$VERSION" == "nightly" || "$VERSION" == "nightly-latest" ]]; then - echo "tools-url=nightly" >> "$GITHUB_OUTPUT" + if [[ "$USE_ALL_PLATFORM_BUNDLE" == "true" ]]; then + # With `tools: nightly`, the Action downloads the bundle for the runner's platform, so look + # up the latest nightly release here to get its all-platform bundle instead. + tag=$(gh release list --repo dsp-testing/codeql-cli-nightlies --limit 1 --json tagName --jq '.[0].tagName') + echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/$tag/codeql-bundle.tar.gz" >> "$GITHUB_OUTPUT" + else + echo "tools-url=nightly" >> "$GITHUB_OUTPUT" + fi exit 0 elif [[ "$VERSION" == "linked" ]]; then echo "tools-url=linked" >> "$GITHUB_OUTPUT" From 91bae3ac6822bcd997cfe984db021f65dfef41b4 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 9 Nov 2026 17:13:32 +0000 Subject: [PATCH 2/3] Check that the `all-platform-bundle` PR check uses an all-platform bundle Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/__all-platform-bundle.yml | 12 ++++++++++++ pr-checks/checks/all-platform-bundle.yml | 12 ++++++++++++ 2 files changed, 24 insertions(+) diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index 22635a0d14..a2d8c1abb3 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -92,6 +92,18 @@ jobs: # Swift is not supported on Ubuntu so we manually exclude it from the list here languages: cpp,csharp,go,java,javascript,python,ruby tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Check that the bundle contains tools for all platforms + env: + CODEQL_PATH: ${{ steps.init.outputs.codeql-path }} + run: | + # Platform-specific bundles only contain the tools for their own platform. + tools_dir="$(dirname "$CODEQL_PATH")/tools" + for platform in linux64 osx64 win64; do + if [[ ! -d "$tools_dir/$platform" ]]; then + echo "::error::Expected an all-platform CodeQL bundle, but '$tools_dir' does not contain a '$platform' directory." + exit 1 + fi + done - name: Build code run: ./build.sh - uses: ./../action/analyze diff --git a/pr-checks/checks/all-platform-bundle.yml b/pr-checks/checks/all-platform-bundle.yml index 24bd290159..40792c8768 100644 --- a/pr-checks/checks/all-platform-bundle.yml +++ b/pr-checks/checks/all-platform-bundle.yml @@ -17,6 +17,18 @@ steps: # Swift is not supported on Ubuntu so we manually exclude it from the list here languages: cpp,csharp,go,java,javascript,python,ruby tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Check that the bundle contains tools for all platforms + env: + CODEQL_PATH: ${{ steps.init.outputs.codeql-path }} + run: | + # Platform-specific bundles only contain the tools for their own platform. + tools_dir="$(dirname "$CODEQL_PATH")/tools" + for platform in linux64 osx64 win64; do + if [[ ! -d "$tools_dir/$platform" ]]; then + echo "::error::Expected an all-platform CodeQL bundle, but '$tools_dir' does not contain a '$platform' directory." + exit 1 + fi + done - name: Build code run: ./build.sh - uses: ./../action/analyze From 4e3aa4135fe5aba52aef5426aaf50b5b1b3170e6 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 9 Nov 2026 17:13:44 +0000 Subject: [PATCH 3/3] Remove the `CodeQL Bundle All` PR check, which duplicates `all-platform-bundle` Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/deflake.yml | 1 - .github/workflows/test-codeql-bundle-all.yml | 62 -------------------- 2 files changed, 63 deletions(-) delete mode 100644 .github/workflows/test-codeql-bundle-all.yml diff --git a/.github/workflows/deflake.yml b/.github/workflows/deflake.yml index 27024b3780..9d6489dcaf 100644 --- a/.github/workflows/deflake.yml +++ b/.github/workflows/deflake.yml @@ -31,7 +31,6 @@ on: - "PR Check - C/C\\+\\+: autoinstalling dependencies is skipped (macOS)" - "PR Check - C/C\\+\\+: disabling autoinstalling dependencies (Linux)" - "PR Check - Clean up database cluster directory" - - "PR Check - CodeQL Bundle All" - "PR Check - Config export" - "PR Check - Config input" - "PR Check - Custom source root" diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml deleted file mode 100644 index 9fae4b04a6..0000000000 --- a/.github/workflows/test-codeql-bundle-all.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: "PR Check - CodeQL Bundle All" -env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GO111MODULE: auto -on: - push: - branches: - - main - - releases/v* - pull_request: - merge_group: - types: [checks_requested] - schedule: - - cron: "0 5 * * *" - workflow_dispatch: - -concurrency: - cancel-in-progress: ${{ github.event_name == 'pull_request' || false }} - group: ${{ github.workflow }}-${{ github.ref }} - -defaults: - run: - shell: bash -jobs: - test-codeql-bundle-all: - strategy: - fail-fast: false - matrix: - include: - - os: ubuntu-26.04 - version: nightly-latest - name: "CodeQL Bundle All" - if: github.triggering_actor != 'dependabot[bot]' - permissions: - contents: read - security-events: read - timeout-minutes: 45 - runs-on: ${{ matrix.os }} - steps: - - name: Check out repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Prepare test - id: prepare-test - uses: ./.github/actions/prepare-test - with: - version: ${{ matrix.version }} - use-all-platform-bundle: true - - name: Install .NET - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 - with: - dotnet-version: "9.x" - - id: init - uses: ./../action/init - with: - # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu - languages: cpp,csharp,go,java,javascript,python,ruby - tools: ${{ steps.prepare-test.outputs.tools-url }} - - name: Build code - run: ./build.sh - - uses: ./../action/analyze - env: - CODEQL_ACTION_TEST_MODE: true