codeql-action/.github/workflows/debug-artifacts-safe.yml

# Checks logs, SARIF, and database bundle debug artifacts exist.
name: PR Check - Debug artifact upload
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
on:
  push:
    branches:
    - main
    - releases/v*
  pull_request:
  merge_group:
    types: [checks_requested]
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:

concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
  group: ${{ github.workflow }}-${{ github.ref }}

defaults:
  run:
    shell: bash

jobs:
  upload-artifacts:
    if: github.triggering_actor != 'dependabot[bot]'
    strategy:
      fail-fast: false
      matrix:
        version:
        - stable-v2.20.3
        - default
        - linked
        - nightly-latest
    name: Upload debug artifacts
    env:
      CODEQL_ACTION_TEST_MODE: true
    timeout-minutes: 45
    permissions:
      contents: read
      # We currently need `security-events: read` to access feature flags.
      security-events: read
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
        with:
          version: ${{ matrix.version }}
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version: ^1.13.1
      - name: Install .NET
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
        with:
          dotnet-version: '9.x'
      - name: Assert best-effort artifact scan completed
        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
      - uses: ./../action/init
        id: init
        with:
          tools: ${{ steps.prepare-test.outputs.tools-url }}
          debug: true
          debug-artifact-name: my-debug-artifacts
          debug-database-name: my-db
          # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
          languages: cpp,csharp,go,java,javascript,python,ruby
      - name: Build code
        run: ./build.sh
      - uses: ./../action/analyze
        id: analysis
  download-and-check-artifacts:
    name: Download and check debug artifacts
    if: github.triggering_actor != 'dependabot[bot]'
    needs: upload-artifacts
    timeout-minutes: 45
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      - name: Check expected artifacts exist
        run: |
          VERSIONS="stable-v2.20.3 default linked nightly-latest"
          LANGUAGES="cpp csharp go java javascript python"
          for version in $VERSIONS; do
            pushd "./my-debug-artifacts-${version//./}"
            echo "Artifacts from version $version:"
            for language in $LANGUAGES; do
              echo "- Checking $language"
              if [[ ! -f "$language.sarif" ]] ; then
                echo "Missing a SARIF file for $language"
                exit 1
              fi
              if [[ ! -f "my-db-$language.zip" ]] ; then
                echo "Missing a database bundle for $language"
                exit 1
              fi
              if [[ ! -d "$language/log" ]] ; then
                echo "Missing logs for $language"
                exit 1
              fi
            done
            popd
          done
        env:
          GO111MODULE: auto