Skip to content

Commit d1097e7

Browse files
evansimsevansims
authored
test: Improvements to CI Workflow (#519)
### Changes This pull request updates our continuous integration workflows. #### codeql.yml - Add's [GitHub's CodeQL vulnerability scanner](https://codeql.github.com/) to CI. #### semgrep.yml - Updated to skip unnecessary runs on Dependabot PRs and re-runs on merge group queues. - Updated name to use "Check for Vulnerabilities" for clarity in branch protection filters. - Added concurrency check (cancels redundant in-progress runs.) #### snyk.yml - Added workflow to trigger Snyk security checks. We previously used webhooks to trigger these checks, but this method is incompatible with GitHub's merge queue feature. This approach allows us to use the feature and autonomously run checks on a set schedule as we do in other repositories. #### docs.yml - Removed quotes around branch names for consistency with other migrations. #### build.yml → test.yml - Renamed to bring clarity of purpose and consistency with migrations of other repositories. - Added concurrency check (cancels redundant in-progress runs.) - Fixed checkout reference missing its `ref` property (relevant for `pull_request_target`.) #### release.yml → publish.yml - Renamed to bring clarity of purpose and consistency with migrations of other repositories. ### References Updates based on internal feedback and conversations. ### Testing - This pull request applies improvements to the continuous integration testing for the repository but does not add additional unit tests. - The CodeQL workflow is new and may need further tuning after merge, but is implemented in a matter consistent with GitHub's Python integration guidance as well as our other migrations. ### Checklist - [x] I have read the [Auth0 general contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md) - [x] I have read the [Auth0 Code of Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md) - [x] All existing and new tests complete without errors
2 parents 0e444eb + 1c416f0 commit d1097e7

File tree

6 files changed

+116
-5
lines changed

6 files changed

+116
-5
lines changed

‎.github/workflows/codeql.yml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: CodeQL
2+
3+
on:
4+
merge_group:
5+
pull_request:
6+
types:
7+
- opened
8+
- synchronize
9+
push:
10+
branches:
11+
- master
12+
schedule:
13+
- cron: "56 12 * * 1"
14+
15+
permissions:
16+
actions: read
17+
contents: read
18+
security-events: write
19+
20+
concurrency:
21+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
22+
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
23+
24+
jobs:
25+
analyze:
26+
name: Analyze
27+
runs-on: ubuntu-latest
28+
29+
strategy:
30+
fail-fast: false
31+
matrix:
32+
language: [python]
33+
34+
steps:
35+
- if: github.actor == 'dependabot[bot]' || github.event_name == 'merge_group'
36+
run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
37+
38+
- name: Checkout
39+
uses: actions/checkout@v3
40+
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@v2
43+
with:
44+
languages: ${{ matrix.language }}
45+
queries: +security-and-quality
46+
47+
- name: Autobuild
48+
uses: github/codeql-action/autobuild@v2
49+
50+
- name: Perform CodeQL Analysis
51+
uses: github/codeql-action/analyze@v2
52+
with:
53+
category: "/language:${{ matrix.language }}"

‎.github/workflows/docs.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Build Documentation
33
on:
44
push:
55
branches:
6-
- "master"
6+
- master
77

88
permissions:
99
contents: read

‎.github/workflows/release.yml renamed to ‎.github/workflows/publish.yml

File renamed without changes.

‎.github/workflows/semgrep.yml

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,25 +15,31 @@ on:
1515
permissions:
1616
contents: read
1717

18+
concurrency:
19+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
20+
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
21+
1822
jobs:
1923
authorize:
2024
name: Authorize
21-
environment: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
25+
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
2226
runs-on: ubuntu-latest
2327
steps:
2428
- run: true
2529

2630
run:
27-
if: (github.actor != 'dependabot[bot]')
2831
needs: authorize # Require approval before running on forked pull requests
2932

30-
name: Run
33+
name: Check for Vulnerabilities
3134
runs-on: ubuntu-latest
3235

3336
container:
3437
image: returntocorp/semgrep
3538

3639
steps:
40+
- if: github.actor == 'dependabot[bot]' || github.event_name == 'merge_group'
41+
run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
42+
3743
- uses: actions/checkout@v3
3844
with:
3945
ref: ${{ github.event.pull_request.head.sha || github.ref }}

‎.github/workflows/snyk.yml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Snyk
2+
3+
on:
4+
merge_group:
5+
pull_request_target:
6+
types:
7+
- opened
8+
- synchronize
9+
push:
10+
branches:
11+
- master
12+
schedule:
13+
- cron: "30 0 1,15 * *"
14+
15+
permissions:
16+
contents: read
17+
18+
concurrency:
19+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
20+
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
21+
22+
jobs:
23+
authorize:
24+
name: Authorize
25+
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
26+
runs-on: ubuntu-latest
27+
steps:
28+
- run: true
29+
30+
check:
31+
needs: authorize
32+
33+
name: Check for Vulnerabilities
34+
runs-on: ubuntu-latest
35+
36+
steps:
37+
- if: github.actor == 'dependabot[bot]' || github.event_name == 'merge_group'
38+
run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
39+
40+
- uses: actions/checkout@v3
41+
with:
42+
ref: ${{ github.event.pull_request.head.sha || github.ref }}
43+
44+
- uses: snyk/actions/php@b98d498629f1c368650224d6d212bf7dfa89e4bf # pin@0.4.0
45+
env:
46+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

‎.github/workflows/build.yml renamed to ‎.github/workflows/test.yml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,14 @@ on:
1313
permissions:
1414
contents: read
1515

16+
concurrency:
17+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
18+
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
19+
1620
jobs:
1721
authorize:
1822
name: Authorize
19-
environment: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
23+
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
2024
runs-on: ubuntu-latest
2125
steps:
2226
- run: true
@@ -48,6 +52,8 @@ jobs:
4852
steps:
4953
- name: Checkout code
5054
uses: actions/checkout@v3
55+
with:
56+
ref: ${{ github.event.pull_request.head.sha || github.ref }}
5157

5258
- name: Configure Python ${{ matrix.python-version }}
5359
uses: actions/setup-python@v4

0 commit comments

Comments
 (0)