diff --git a/.github/workflows/code-scan.yml b/.github/workflows/code-scan.yml index ce95eb5..d114308 100644 --- a/.github/workflows/code-scan.yml +++ b/.github/workflows/code-scan.yml @@ -90,91 +90,9 @@ jobs: exit(1) os.system('echo Validation passed')" - upload-cached-results: - runs-on: ubuntu-24.04 - needs: input-validation - outputs: - skip_job_and_continue_scan: ${{ env.GHA_SECURITY_CODE_SCAN_SKIP_JOB_AND_CONTINUE_SCAN }} - permissions: - pull-requests: read - actions: read - security-events: write - contents: write - steps: - - name: "Skip job if not triggered by a push to main/master" - env: - GITHUB_EVENT_NAME: ${{ github.event_name }} - GITHUB_REFNAME: ${{ github.ref_name }} - GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} - run: | - if [ "$GITHUB_EVENT_NAME" = "push" ] && [ "$GITHUB_REFNAME" = "$GITHUB_DEFAULT_BRANCH" ]; then - echo 'GHA_SECURITY_CODE_SCAN_SKIP_JOB_AND_CONTINUE_SCAN=False' >> "$GITHUB_ENV" - else - echo 'GHA_SECURITY_CODE_SCAN_SKIP_JOB_AND_CONTINUE_SCAN=True' >> "$GITHUB_ENV" - fi - - name: "Get workflow run ID for matching PR" - if: ${{ env.GHA_SECURITY_CODE_SCAN_SKIP_JOB_AND_CONTINUE_SCAN == 'False' }} - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # used by gh cli - GITHUB_SHA: ${{ github.sha }} - GITHUB_REPOSITORY: ${{ github.repository }} # repository string in format / - run: | - HEAD_REF=$(gh pr list --state merged --search "$GITHUB_SHA" --json headRefOid -R "$GITHUB_REPOSITORY" | jq -r '.[0].headRefOid') - if [ "$HEAD_REF" = "null" ]; then - echo "::warning ::Failed to fetch closed PRs, defaulting to running a new scan" - echo 'GHA_SECURITY_CODE_SCAN_SKIP_JOB_AND_CONTINUE_SCAN=True' >> "$GITHUB_ENV" - else - JOB_ID=$(gh run list -s completed -e pull_request -c "$HEAD_REF" --json databaseId -R "$GITHUB_REPOSITORY" -w ".github/workflows/codeql.yml" | - jq -r '.[0].databaseId') - if [ "$JOB_ID" = "null" ]; then - echo '::warning ::Failed to find a matching job, defaulting to running a new scan' - echo 'GHA_SECURITY_CODE_SCAN_SKIP_JOB_AND_CONTINUE_SCAN=True' >> "$GITHUB_ENV" - else - echo "GHA_SECURITY_CODE_SCAN_WORKFLOW_RUN_ID=$JOB_ID" >> "$GITHUB_ENV" - fi - fi - - - name: "Download existing cached results from previous job (pr)" - if: ${{ env.GHA_SECURITY_CODE_SCAN_SKIP_JOB_AND_CONTINUE_SCAN == 'False' }} - uses: actions/download-artifact@v8 - with: - run-id: ${{ env.GHA_SECURITY_CODE_SCAN_WORKFLOW_RUN_ID }} - github-token: ${{ secrets.GITHUB_TOKEN }} - path: "/home/runner/work/${{ github.event.repository.name }}/results" - merge-multiple: true - - - name: "Upload scan results" - if: ${{ env.GHA_SECURITY_CODE_SCAN_SKIP_JOB_AND_CONTINUE_SCAN == 'False' }} - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: "/home/runner/work/${{ github.event.repository.name }}/results" - category: 'scan-results' - token: ${{ secrets.GITHUB_TOKEN }} - - - name: "Upload dependency graph" - if: ${{ env.GHA_SECURITY_CODE_SCAN_SKIP_JOB_AND_CONTINUE_SCAN == 'False' }} - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # used by gh cli - GITHUB_SHA: ${{ github.sha }} - GITHUB_REF: ${{ github.ref }} - GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }} - GITHUB_REPOSITORY: ${{ github.repository }} # repository string in format / - run: | - if [ -d "/home/runner/work/$GITHUB_REPOSITORY_NAME/results" ]; then - shopt -s globstar nullglob - for file in "/home/runner/work/$GITHUB_REPOSITORY_NAME/results"/**/*.json ; do - if [ -d "$file" ] ; then - continue - fi - echo "Uploading cached dependency graph $file" - jq ".sha = \"$GITHUB_SHA\" | .ref = \"$GITHUB_REF\"" < "$file" | gh api "/repos/$GITHUB_REPOSITORY/dependency-graph/snapshots" --method POST --input - || true - done - fi - get-repository-metadata: - if: ${{ failure() || needs.upload-cached-results.outputs.skip_job_and_continue_scan == 'True' }} runs-on: ubuntu-24.04 - needs: upload-cached-results + needs: input-validation outputs: codeql_languages: ${{ env.GHA_SECURITY_CODE_SCAN_REPOSITORY_LANGUAGES_CQ }} semgrep_languages: ${{ env.GHA_SECURITY_CODE_SCAN_REPOSITORY_LANGUAGES_SEM }} @@ -558,8 +476,9 @@ jobs: ${{ needs.get-repository-metadata.outputs.found_gradle == 'True' && ( - contains('java', needs.get-repository-metadata.outputs.codeql_languages) || - contains('scala', needs.get-repository-metadata.outputs.codeql_languages) + contains(needs.get-repository-metadata.outputs.codeql_languages, 'java') || + contains(needs.get-repository-metadata.outputs.codeql_languages, 'scala') || + contains(needs.get-repository-metadata.outputs.codeql_languages, 'kotlin') ) }} uses: gradle/actions/dependency-submission@v5