From b1dd33f37e16201637488fdad84af728b08dfa9b Mon Sep 17 00:00:00 2001 From: Karen Santana Date: Mon, 27 Jul 2026 11:25:23 +0100 Subject: [PATCH 1/4] Fix CodeQL workflow --- .github/workflows/codeql.yml | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 716a8dc2f..1bf45c5d6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -16,6 +16,7 @@ on: merge_group: schedule: - cron: "36 6 * * 4" # run every Thursday at 06:36 UTC + workflow_dispatch: concurrency: group: ${{ github.ref_name }}-codeql @@ -28,36 +29,51 @@ jobs: checks: name: Checks and variables runs-on: ubuntu-24.04 + # ONLY run the docs check job if it's actually a Pull Request + if: ${{ github.event_name == 'pull_request' }} outputs: - docs_only: ${{ github.event.pull_request && steps.docs.outputs.docs_only == 'true' }} + docs_only: ${{ steps.docs.outputs.docs_only }} steps: - name: Checkout Repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - name: Filter only docs changes id: docs run: | - files=$(git diff --name-only HEAD^ | egrep -v "^site/" | egrep -v "^examples/" | egrep -v "^README.md") + # Use git diff against the PR target branch instead of HEAD^ for reliability + files=$(git diff --name-only origin/${{ github.base_ref }} | egrep -v "^site/" | egrep -v "^examples/" | egrep -v "^README.md") if [ -z "$files" ]; then echo "docs_only=true" >> $GITHUB_OUTPUT else echo "docs_only=false" >> $GITHUB_OUTPUT fi - echo $files + echo "Files changed: $files" cat $GITHUB_OUTPUT shell: bash --noprofile --norc -o pipefail {0} analyze: - if: ${{ needs.checks.outputs.docs_only != 'true' }} + # Run IF it is not a PR, OR if it is a PR and the changed files are not docs-only + if: ${{ github.event_name != 'pull_request' || needs.checks.outputs.docs_only != 'true' }} needs: [checks] + # 'needs' is ignored if the preceding job is skipped via its 'if' condition, + # but we still want to ensure analyze behaves correctly. + # To bypass strict 'needs' failures when checks is skipped: + always: true permissions: actions: read # for github/codeql-action/init to get workflow details contents: read # for actions/checkout to fetch code packages: read security-events: write # for github/codeql-action/autobuild to send a status report name: Analyze - uses: nginx/compliance-rules/.github/workflows/codeql.yml@543d32464b56e6a695939f41ba8009cbb10e413a # v0.3.3 - with: - requested_languages: go + runs-on: ubuntu-24.04 + steps: + # We must re-checkout the code here because the 'analyze' job runs in its own runner + - name: Checkout Repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Analyze with CodeQL + uses: nginx/compliance-rules/.github/workflows/codeql.yml@a27656f8f9a8748085b434ebe007f5b572709aad # v0.2 + with: + requested_languages: go From 13eb73084cd26cbd3de454dd30e3364a9cc8d204 Mon Sep 17 00:00:00 2001 From: Karen Santana Date: Tue, 28 Jul 2026 12:22:20 +0100 Subject: [PATCH 2/4] Revert downgraded checkout version --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1bf45c5d6..367b2b255 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -35,7 +35,7 @@ jobs: docs_only: ${{ steps.docs.outputs.docs_only }} steps: - name: Checkout Repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -71,7 +71,7 @@ jobs: steps: # We must re-checkout the code here because the 'analyze' job runs in its own runner - name: Checkout Repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Analyze with CodeQL uses: nginx/compliance-rules/.github/workflows/codeql.yml@a27656f8f9a8748085b434ebe007f5b572709aad # v0.2 From 028f95e836f5d3333fe122b04bf888c00c881b87 Mon Sep 17 00:00:00 2001 From: Karen Santana Date: Tue, 28 Jul 2026 13:28:45 +0100 Subject: [PATCH 3/4] Fix yaml syntax --- .github/workflows/codeql.yml | 63 ++++++++++++++++++++---------------- 1 file changed, 35 insertions(+), 28 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 367b2b255..296e7a3af 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -29,8 +29,6 @@ jobs: checks: name: Checks and variables runs-on: ubuntu-24.04 - # ONLY run the docs check job if it's actually a Pull Request - if: ${{ github.event_name == 'pull_request' }} outputs: docs_only: ${{ steps.docs.outputs.docs_only }} steps: @@ -39,41 +37,50 @@ jobs: with: fetch-depth: 0 - - name: Filter only docs changes + - name: Default docs_only value id: docs + run: echo "docs_only=false" >> "$GITHUB_OUTPUT" + + - name: Filter only docs changes + if: ${{ github.event_name == 'pull_request' }} + id: docs_pr run: | - # Use git diff against the PR target branch instead of HEAD^ for reliability - files=$(git diff --name-only origin/${{ github.base_ref }} | egrep -v "^site/" | egrep -v "^examples/" | egrep -v "^README.md") + git fetch origin "${{ github.base_ref }}" + + files=$(git diff --name-only "origin/${{ github.base_ref }}"...HEAD \ + | egrep -v "^site/" \ + | egrep -v "^examples/" \ + | egrep -v "^README.md") + if [ -z "$files" ]; then - echo "docs_only=true" >> $GITHUB_OUTPUT + echo "docs_only=true" >> "$GITHUB_OUTPUT" else - echo "docs_only=false" >> $GITHUB_OUTPUT + echo "docs_only=false" >> "$GITHUB_OUTPUT" fi - echo "Files changed: $files" - cat $GITHUB_OUTPUT + + echo "Files changed:" + echo "$files" + shell: bash --noprofile --norc -o pipefail {0} + - name: Copy PR result to job output + if: ${{ github.event_name == 'pull_request' }} + run: | + echo "docs_only=${{ steps.docs_pr.outputs.docs_only }}" >> "$GITHUB_OUTPUT" + shell: bash --noprofile --norc -o pipefail {0} + id: docs + analyze: - # Run IF it is not a PR, OR if it is a PR and the changed files are not docs-only + needs: checks if: ${{ github.event_name != 'pull_request' || needs.checks.outputs.docs_only != 'true' }} - needs: [checks] - # 'needs' is ignored if the preceding job is skipped via its 'if' condition, - # but we still want to ensure analyze behaves correctly. - # To bypass strict 'needs' failures when checks is skipped: - always: true + permissions: - actions: read # for github/codeql-action/init to get workflow details - contents: read # for actions/checkout to fetch code + actions: read + contents: read packages: read - security-events: write # for github/codeql-action/autobuild to send a status report - name: Analyze - runs-on: ubuntu-24.04 - steps: - # We must re-checkout the code here because the 'analyze' job runs in its own runner - - name: Checkout Repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + security-events: write - - name: Analyze with CodeQL - uses: nginx/compliance-rules/.github/workflows/codeql.yml@a27656f8f9a8748085b434ebe007f5b572709aad # v0.2 - with: - requested_languages: go + name: Analyze + uses: nginx/compliance-rules/.github/workflows/codeql.yml@543d32464b56e6a695939f41ba8009cbb10e413a # v0.3.3 + with: + requested_languages: go From 893e25ea5fa2a59567f768d71c26438bc59a5337 Mon Sep 17 00:00:00 2001 From: Karen Santana Date: Tue, 28 Jul 2026 13:37:02 +0100 Subject: [PATCH 4/4] Fix id duplication --- .github/workflows/codeql.yml | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 296e7a3af..db9614eed 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -37,14 +37,16 @@ jobs: with: fetch-depth: 0 - - name: Default docs_only value + - name: Determine whether changes are docs-only id: docs - run: echo "docs_only=false" >> "$GITHUB_OUTPUT" - - - name: Filter only docs changes - if: ${{ github.event_name == 'pull_request' }} - id: docs_pr + shell: bash --noprofile --norc -o pipefail {0} run: | + # Non-PR events should always run CodeQL. + if [ "${{ github.event_name }}" != "pull_request" ]; then + echo "docs_only=false" >> "$GITHUB_OUTPUT" + exit 0 + fi + git fetch origin "${{ github.base_ref }}" files=$(git diff --name-only "origin/${{ github.base_ref }}"...HEAD \ @@ -60,15 +62,7 @@ jobs: echo "Files changed:" echo "$files" - - shell: bash --noprofile --norc -o pipefail {0} - - - name: Copy PR result to job output - if: ${{ github.event_name == 'pull_request' }} - run: | - echo "docs_only=${{ steps.docs_pr.outputs.docs_only }}" >> "$GITHUB_OUTPUT" - shell: bash --noprofile --norc -o pipefail {0} - id: docs + cat "$GITHUB_OUTPUT" analyze: needs: checks