mcp_transcoder: add status to dynamic metadata #109994
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL/push | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| concurrency: | |
| group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }} | |
| cancel-in-progress: true | |
| env: | |
| SEARCH_FOLDER: //source/common/... | |
| jobs: | |
| CodeQL-Build: | |
| permissions: | |
| actions: read | |
| contents: read | |
| # for github/codeql-action/analyze to upload SARIF results | |
| security-events: write | |
| pull-requests: read | |
| runs-on: ubuntu-22.04 | |
| if: github.repository == 'envoyproxy/envoy' | |
| steps: | |
| - uses: envoyproxy/toolshed/actions/bind-mounts@1f5b552c6749502b885cb8cf23549b929e745547 # actions-v0.4.17 | |
| if: ! github.event.repository.private | |
| with: | |
| mounts: | | |
| - src: /mnt/workspace | |
| target: GITHUB_WORKSPACE | |
| chown: "runner:runner" | |
| - src: /mnt/runner-cache | |
| target: /home/runner/.cache | |
| chown: "runner:runner" | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 2 | |
| - name: Detect C++ changes | |
| run: | | |
| if [[ "${{ github.event_name }}" == "pull_request" ]]; then | |
| git fetch --depth=1 "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" main 2>/dev/null | |
| TO_OTHER=FETCH_HEAD | |
| else | |
| TO_OTHER=HEAD^1 | |
| fi | |
| if git diff --name-only HEAD "${TO_OTHER}" -- source/common/ include/ | grep -q .; then | |
| echo "CPP_CHANGED=true" >> "$GITHUB_ENV" | |
| else | |
| echo "CPP_CHANGED=false" >> "$GITHUB_ENV" | |
| fi | |
| - name: Free disk space | |
| if: | | |
| env.CPP_CHANGED == 'true' | |
| && github.event.repository.private | |
| uses: envoyproxy/toolshed/actions/diskspace@1f5b552c6749502b885cb8cf23549b929e745547 # actions-v0.4.17 | |
| with: | |
| to_remove: | | |
| /usr/local/.ghcup | |
| /usr/local/lib/android | |
| - name: Get build targets | |
| if: env.CPP_CHANGED == 'true' | |
| run: | | |
| # TODO(phlax): Shift this to an action | |
| compare_head () { | |
| while IFS= read -r line; do | |
| if [[ -n "$line" ]]; then | |
| bazel query "rdeps($SEARCH_FOLDER, $line, 1)" 2> /dev/null | |
| fi | |
| done < <(git diff --name-only HEAD "${1}" -- source/common/* include/*) | |
| } | |
| if [[ "$GIT_EVENT" == "pull_request" ]]; then | |
| git fetch "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" main 2> /dev/null | |
| TO_OTHER=FETCH_HEAD | |
| else | |
| TO_OTHER=HEAD^1 | |
| fi | |
| BUILD_TARGETS="$(compare_head "$TO_OTHER" | grep -v '\.cc\|\.h' | sort -u | head -n 3)" | |
| echo 'BUILD_TARGETS<<EOF' >> $GITHUB_ENV | |
| echo "$BUILD_TARGETS" >> $GITHUB_ENV | |
| echo 'EOF' >> $GITHUB_ENV | |
| env: | |
| GIT_EVENT: ${{ github.event_name }} | |
| - name: Set default build target | |
| if: env.CPP_CHANGED == 'true' && env.BUILD_TARGETS == '' | |
| run: | | |
| echo "MINIMAL_BUILD_TARGET=//source/common/common:assert_lib" > $GITHUB_ENV | |
| - name: Initialize CodeQL | |
| if: env.CPP_CHANGED == 'true' | |
| uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # codeql-bundle-v4.36.1 | |
| with: | |
| languages: cpp | |
| trap-caching: false | |
| # No-op analysis to satisfy Scorecard SAST check when no C++ changes are present. | |
| # Running codeql-action/analyze unconditionally ensures every merge commit gets | |
| # a github-code-scanning check run with conclusion 'success', which Scorecard | |
| # requires to award full SAST score. | |
| - name: Initialize CodeQL (noop) | |
| if: env.CPP_CHANGED != 'true' | |
| uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # codeql-bundle-v4.36.1 | |
| with: | |
| languages: javascript | |
| trap-caching: false | |
| - name: Install deps | |
| if: env.CPP_CHANGED == 'true' | |
| shell: bash | |
| run: | | |
| sudo apt-get -qq update --error-on=any | |
| sudo apt-get -qq install --yes \ | |
| libtool libtinfo5 automake autoconf curl unzip | |
| # Note: the llvm/clang version should match the version specifed in: | |
| # - bazel/repository_locations.bzl | |
| # - .github/workflows/codeql-daily.yml | |
| # - https://github.com/envoyproxy/envoy-build-tools/blob/main/build_container/build_container_ubuntu.sh#L84 | |
| # | |
| # IMPORTANT: the clang bundle MUST be unpacked outside $GITHUB_WORKSPACE (we use $RUNNER_TEMP). | |
| # The CodeQL C++ extractor treats anything under the source root as project code, so headers | |
| # under a checkout subdirectory would be analysed as Envoy source and produce false positives | |
| # (e.g. cpp/new-free-mismatch in <vector>, alert #1881). Keeping it under $RUNNER_TEMP makes | |
| # CodeQL classify those headers as system headers — same as /usr/include/c++/** on a normal | |
| # build. Do NOT move this back into the checkout tree. | |
| mkdir -p "${RUNNER_TEMP}/clang18.1.8" | |
| cd "${RUNNER_TEMP}/clang18.1.8" | |
| wget -q https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.8/clang+llvm-18.1.8-x86_64-linux-gnu-ubuntu-18.04.tar.xz | |
| tar -xf clang+llvm-18.1.8-x86_64-linux-gnu-ubuntu-18.04.tar.xz --strip-components 1 | |
| - name: Build | |
| if: env.CPP_CHANGED == 'true' | |
| run: | | |
| bazel shutdown | |
| bazel build \ | |
| -c fastbuild \ | |
| --repo_env=BAZEL_LLVM_PATH="${RUNNER_TEMP}/clang18.1.8" \ | |
| --spawn_strategy=local \ | |
| --discard_analysis_cache \ | |
| --nouse_action_cache \ | |
| --features="-layering_check" \ | |
| --config=clang \ | |
| --config=ci \ | |
| ${BUILD_TARGETS:-${MINIMAL_BUILD_TARGET}} | |
| echo -e "Built targets...\n${BUILD_TARGETS:-${MINIMAL_BUILD_TARGET}}" | |
| - name: Clean Artifacts | |
| if: env.CPP_CHANGED == 'true' | |
| run: | | |
| git clean -xdf | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463 # codeql-bundle-v4.36.1 |