.github/workflows/codeql.yml - beam - Git at Google


            
            # Licensed to the Apache Software Foundation (ASF) under one or more

            
            # contributor license agreements.  See the NOTICE file distributed with

            
            # this work for additional information regarding copyright ownership.

            
            # The ASF licenses this file to You under the Apache License, Version 2.0

            
            # (the "License"); you may not use this file except in compliance with

            
            # the License.  You may obtain a copy of the License at

            
            #

            
            #     http://www.apache.org/licenses/LICENSE-2.0

            
            #

            
            # Unless required by applicable law or agreed to in writing, software

            
            # distributed under the License is distributed on an "AS IS" BASIS,

            
            # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

            
            # See the License for the specific language governing permissions and

            
            # limitations under the License.


            # Enables code scanning alerts in repo.


            name: "CodeQL Advanced"


            on:

            
              push:

            
                branches: [ "master" ]

            
              pull_request:

            
                branches: [ "master" ]

            
              workflow_dispatch:

            
              schedule:

            
                - cron: '25 10 * * 6'


            jobs:

            
              detect-changes:

            
                runs-on: ubuntu-latest

            
                permissions:

            
                  contents: read

            
                  pull-requests: read

            
                outputs:

            
                  matrix: ${{ steps.set-matrix.outputs.matrix }}

            
                steps:

            
                  - name: Checkout repository

            
                    uses: actions/checkout@v7

            
                  - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d

            
                    id: filter

            
                    with:

            
                      filters: |

            
                        actions:

            
                          - '.github/**'

            
                        go:

            
                          - '**/*.go'

            
                          - '**/go.mod'

            
                          - '**/go.sum'

            
                        java-kotlin:

            
                          - '**/*.java'

            
                          - '**/*.kt'

            
                          - '**/*.gradle'

            
                          - '**/*.gradle.kts'

            
                          - '**/gradle.properties'

            
                          - '**/gradlew'

            
                          - '**/gradlew.bat'

            
                        javascript-typescript:

            
                          - '**/*.js'

            
                          - '**/*.ts'

            
                          - '**/package.json'

            
                          - '**/package-lock.json'

            
                          - '**/tsconfig.json'

            
                        python:

            
                          - '**/*.py'

            
                          - '**/*.pyx'

            
                          - '**/setup.py'

            
                          - '**/setup.cfg'

            
                          - '**/pyproject.toml'

            
                          - '**/*requirements.txt'

            
                        rust:

            
                          - '**/*.rs'


                  - name: Generate Matrix

            
                    id: set-matrix

            
                    run: |

            
                      # Full matrix of all CodeQL supported languages and their build modes in Apache Beam.

            
                      ALL_MATRIX='[

            
                        {"language": "actions", "build-mode": "none"},

            
                        {"language": "go", "build-mode": "manual"},

            
                        {"language": "java-kotlin", "build-mode": "none"},

            
                        {"language": "javascript-typescript", "build-mode": "none"},

            
                        {"language": "python", "build-mode": "none"},

            
                        {"language": "rust", "build-mode": "none"}

            
                      ]'


                      # On periodic scheduled runs (cron) or manual dispatches, scan all languages.

            
                      if [[ "${{ github.event_name }}" == "schedule" || "${{ github.event_name }}" == "workflow_dispatch" ]]; then

            
                        COMPACT_ALL=$(echo "$ALL_MATRIX" | jq -c .)

            
                        echo "matrix=$COMPACT_ALL" >> $GITHUB_OUTPUT

            
                      else

            
                        # Filter ALL_MATRIX entries keeping only entries for languages with path changes.

            
                        FILTERED=$(echo "$ALL_MATRIX" | jq -c '[.[] | select(

            
                          (.language == "actions" and "${{ steps.filter.outputs.actions }}" == "true") or

            
                          (.language == "go" and "${{ steps.filter.outputs.go }}" == "true") or

            
                          (.language == "java-kotlin" and "${{ steps.filter.outputs['java-kotlin'] }}" == "true") or

            
                          (.language == "javascript-typescript" and "${{ steps.filter.outputs['javascript-typescript'] }}" == "true") or

            
                          (.language == "python" and "${{ steps.filter.outputs.python }}" == "true") or

            
                          (.language == "rust" and "${{ steps.filter.outputs.rust }}" == "true")

            
                        )]')

            
                        echo "matrix=$FILTERED" >> $GITHUB_OUTPUT

            
                      fi


              analyze:

            
                name: Analyze (${{ matrix.language }})

            
                needs: detect-changes

            
                if: needs.detect-changes.outputs.matrix != '[]'

            
                # Runner size impacts CodeQL analysis time. To learn more, please see:

            
                #   - https://gh.io/recommended-hardware-resources-for-running-codeql

            
                #   - https://gh.io/supported-runners-and-hardware-resources

            
                #   - https://gh.io/using-larger-runners (GitHub.com only)

            
                # Consider using larger runners or machines with greater resources for possible analysis time improvements.

            
                runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}

            
                permissions:

            
                  # required for all workflows

            
                  security-events: write


                  # required to fetch internal or private CodeQL packs

            
                  packages: read


                  # only required for workflows in private repositories

            
                  actions: read

            
                  contents: read


                strategy:

            
                  fail-fast: false

            
                  matrix:

            
                    include: ${{ fromJSON(needs.detect-changes.outputs.matrix) }}

            
                    # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'

            
                    # Use `c-cpp` to analyze code written in C, C++ or both

            
                    # Use 'java-kotlin' to analyze code written in Java, Kotlin or both

            
                    # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both

            
                    # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,

            
                    # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.

            
                    # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how

            
                    # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages

            
                steps:

            
                - name: Checkout repository

            
                  uses: actions/checkout@v7

            
                  with:

            
                    persist-credentials: false


                - name: Set up Go

            
                  if: matrix.language == 'go'

            
                  uses: actions/setup-go@v7

            
                  with:

            
                    go-version-file: 'sdks/go.mod'


                # Add any setup steps before running the `github/codeql-action/init` action.

            
                # This includes steps like installing compilers or runtimes (`actions/setup-node`

            
                # or others). This is typically only required for manual builds.

            
                # - name: Setup runtime (example)

            
                #   uses: actions/setup-example@v1


                # Initializes the CodeQL tools for scanning.

            
                - name: Initialize CodeQL

            
                  uses: github/codeql-action/init@v4.39.0

            
                  with:

            
                    languages: ${{ matrix.language }}

            
                    build-mode: ${{ matrix.build-mode }}

            
                    # If you wish to specify custom queries, you can do so here or in a config file.

            
                    # By default, queries listed here will override any specified in a config file.

            
                    # Prefix the list here with "+" to use these queries and those in the config file.


                    # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs

            
                    # queries: security-extended,security-and-quality


                # If the analyze step fails for one of the languages you are analyzing with

            
                # "We were unable to automatically build your code", modify the matrix above

            
                # to set the build mode to "manual" for that language. Then modify this step

            
                # to build your code.

            
                # ℹ️ Command-line programs to run using the OS shell.

            
                # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun

            
                - name: Run manual build steps

            
                  if: matrix.build-mode == 'manual'

            
                  shell: bash

            
                  run: |

            
                    if [ "${{ matrix.language }}" = "go" ]; then

            
                      echo "Building sdks module..."

            
                      (cd sdks && go build ./...)


                      echo "Building playground/backend module..."

            
                      (cd playground/backend && go build ./...)


                      echo "Building learning/katas/go module..."

            
                      (cd learning/katas/go && go mod tidy && go build ./...)


                      echo "Building learning/tour-of-beam/backend module..."

            
                      (cd learning/tour-of-beam/backend && go build ./cmd/... ./internal/... ./playground_api/...)

            
                    else

            
                      echo "No manual build steps defined for ${{ matrix.language }}"

            
                      exit 1

            
                    fi


                - name: Perform CodeQL Analysis

            
                  uses: github/codeql-action/analyze@v4.39.0

            
                  with:

            
                    category: "/language:${{matrix.language}}"
	# Licensed to the Apache Software Foundation (ASF) under one or more
	# contributor license agreements. See the NOTICE file distributed with
	# this work for additional information regarding copyright ownership.
	# The ASF licenses this file to You under the Apache License, Version 2.0
	# (the "License"); you may not use this file except in compliance with
	# the License. You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	# Enables code scanning alerts in repo.

	name: "CodeQL Advanced"

	on:
	push:
	branches: [ "master" ]
	pull_request:
	branches: [ "master" ]
	workflow_dispatch:
	schedule:
	- cron: '25 10 * * 6'

	jobs:
	detect-changes:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	pull-requests: read
	outputs:
	matrix: ${{ steps.set-matrix.outputs.matrix }}
	steps:
	- name: Checkout repository
	uses: actions/checkout@v7
	- uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d
	id: filter
	with:
	filters: \|
	actions:
	- '.github/**'
	go:
	- '*/.go'
	- '**/go.mod'
	- '**/go.sum'
	java-kotlin:
	- '*/.java'
	- '*/.kt'
	- '*/.gradle'
	- '*/.gradle.kts'
	- '**/gradle.properties'
	- '**/gradlew'
	- '**/gradlew.bat'
	javascript-typescript:
	- '*/.js'
	- '*/.ts'
	- '**/package.json'
	- '**/package-lock.json'
	- '**/tsconfig.json'
	python:
	- '*/.py'
	- '*/.pyx'
	- '**/setup.py'
	- '**/setup.cfg'
	- '**/pyproject.toml'
	- '*/requirements.txt'
	rust:
	- '*/.rs'

	- name: Generate Matrix
	id: set-matrix
	run: \|
	# Full matrix of all CodeQL supported languages and their build modes in Apache Beam.
	ALL_MATRIX='[
	{"language": "actions", "build-mode": "none"},
	{"language": "go", "build-mode": "manual"},
	{"language": "java-kotlin", "build-mode": "none"},
	{"language": "javascript-typescript", "build-mode": "none"},
	{"language": "python", "build-mode": "none"},
	{"language": "rust", "build-mode": "none"}
	]'

	# On periodic scheduled runs (cron) or manual dispatches, scan all languages.
	if [[ "${{ github.event_name }}" == "schedule" \|\| "${{ github.event_name }}" == "workflow_dispatch" ]]; then
	COMPACT_ALL=$(echo "$ALL_MATRIX" \| jq -c .)
	echo "matrix=$COMPACT_ALL" >> $GITHUB_OUTPUT
	else
	# Filter ALL_MATRIX entries keeping only entries for languages with path changes.
	FILTERED=$(echo "$ALL_MATRIX" \| jq -c '[.[] \| select(
	(.language == "actions" and "${{ steps.filter.outputs.actions }}" == "true") or
	(.language == "go" and "${{ steps.filter.outputs.go }}" == "true") or
	(.language == "java-kotlin" and "${{ steps.filter.outputs['java-kotlin'] }}" == "true") or
	(.language == "javascript-typescript" and "${{ steps.filter.outputs['javascript-typescript'] }}" == "true") or
	(.language == "python" and "${{ steps.filter.outputs.python }}" == "true") or
	(.language == "rust" and "${{ steps.filter.outputs.rust }}" == "true")
	)]')
	echo "matrix=$FILTERED" >> $GITHUB_OUTPUT
	fi

	analyze:
	name: Analyze (${{ matrix.language }})
	needs: detect-changes
	if: needs.detect-changes.outputs.matrix != '[]'
	# Runner size impacts CodeQL analysis time. To learn more, please see:
	# - https://gh.io/recommended-hardware-resources-for-running-codeql
	# - https://gh.io/supported-runners-and-hardware-resources
	# - https://gh.io/using-larger-runners (GitHub.com only)
	# Consider using larger runners or machines with greater resources for possible analysis time improvements.
	runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') \|\| 'ubuntu-latest' }}
	permissions:
	# required for all workflows
	security-events: write

	# required to fetch internal or private CodeQL packs
	packages: read

	# only required for workflows in private repositories
	actions: read
	contents: read

	strategy:
	fail-fast: false
	matrix:
	include: ${{ fromJSON(needs.detect-changes.outputs.matrix) }}
	# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
	# Use `c-cpp` to analyze code written in C, C++ or both
	# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
	# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
	# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
	# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
	# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
	# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
	steps:
	- name: Checkout repository
	uses: actions/checkout@v7
	with:
	persist-credentials: false

	- name: Set up Go
	if: matrix.language == 'go'
	uses: actions/setup-go@v7
	with:
	go-version-file: 'sdks/go.mod'

	# Add any setup steps before running the `github/codeql-action/init` action.
	# This includes steps like installing compilers or runtimes (`actions/setup-node`
	# or others). This is typically only required for manual builds.
	# - name: Setup runtime (example)
	# uses: actions/setup-example@v1

	# Initializes the CodeQL tools for scanning.
	- name: Initialize CodeQL
	uses: github/codeql-action/init@v4.39.0
	with:
	languages: ${{ matrix.language }}
	build-mode: ${{ matrix.build-mode }}
	# If you wish to specify custom queries, you can do so here or in a config file.
	# By default, queries listed here will override any specified in a config file.
	# Prefix the list here with "+" to use these queries and those in the config file.

	# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
	# queries: security-extended,security-and-quality

	# If the analyze step fails for one of the languages you are analyzing with
	# "We were unable to automatically build your code", modify the matrix above
	# to set the build mode to "manual" for that language. Then modify this step
	# to build your code.
	# ℹ️ Command-line programs to run using the OS shell.
	# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
	- name: Run manual build steps
	if: matrix.build-mode == 'manual'
	shell: bash
	run: \|
	if [ "${{ matrix.language }}" = "go" ]; then
	echo "Building sdks module..."
	(cd sdks && go build ./...)

	echo "Building playground/backend module..."
	(cd playground/backend && go build ./...)

	echo "Building learning/katas/go module..."
	(cd learning/katas/go && go mod tidy && go build ./...)

	echo "Building learning/tour-of-beam/backend module..."
	(cd learning/tour-of-beam/backend && go build ./cmd/... ./internal/... ./playground_api/...)
	else
	echo "No manual build steps defined for ${{ matrix.language }}"
	exit 1
	fi

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v4.39.0
	with:
	category: "/language:${{matrix.language}}"