From b9ba01bc4e8b090c46c70e9f694f97b5d003b196 Mon Sep 17 00:00:00 2001 From: Victor Frank Date: Wed, 16 Apr 2025 21:29:34 -0500 Subject: [PATCH 1/3] issue 98 create a analyze report on the pull request --- .github/workflows/go_build.yaml | 52 +++++++++++++++++++++------------ 1 file changed, 34 insertions(+), 18 deletions(-) diff --git a/.github/workflows/go_build.yaml b/.github/workflows/go_build.yaml index 89dcc19..fcb085d 100644 --- a/.github/workflows/go_build.yaml +++ b/.github/workflows/go_build.yaml @@ -12,17 +12,16 @@ # See the License for the specific language governing permissions and # limitations under the License. -name: go_test -on: [push, pull_request] -jobs: +name: CQL Testing and Analysis +on: [push, pull_request, workflow_dispatch] +jobs: go_test: runs-on: ${{ matrix.os }} strategy: matrix: os: [ubuntu-latest, macOS-latest, windows-latest] steps: - - name: Check out code uses: actions/checkout@v6 @@ -30,6 +29,7 @@ jobs: uses: actions/setup-go@v6 with: go-version-file: 'go.mod' + cache: true id: go - name: Get dependencies @@ -44,12 +44,8 @@ jobs: go test ./... go_spec_test_coverage: - runs-on: ${{ matrix.os }} - strategy: - matrix: - os: [ubuntu-latest] + runs-on: ubuntu-latest steps: - - name: Check out code uses: actions/checkout@v6 @@ -57,15 +53,35 @@ jobs: uses: actions/setup-go@v6 with: go-version-file: 'go.mod' - id: go + cache: true - name: Get dependencies - run: | - go mod download - - name: Build - run: | - go build ./... + run: go mod download - - name: Spec Test Coverage - run: | - go run tests/spectests/cmd/analyzer/analyzer.go \ No newline at end of file + - name: Build analyzer + run: go build -o analyzer tests/spectests/cmd/analyzer/analyzer.go + + - name: Run analyzer + run: ./analyzer > analyzer-output.txt + + - name: Upload analyzer results + uses: actions/upload-artifact@v4 + with: + name: analyzer-results + path: analyzer-output.txt + if-no-files-found: error + + - name: Comment PR with analyzer results + if: github.event_name == 'pull_request' + uses: actions/github-script@v7 + with: + script: | + const fs = require('fs'); + const analyzerOutput = fs.readFileSync('analyzer-output.txt', 'utf8'); + + github.rest.issues.createComment({ + issue_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + body: '## CQL Test Analyzer Results\n\n```\n' + analyzerOutput + '\n```' + }); \ No newline at end of file From 90f2b199fcbd977146198be1983ac59c2016bc51 Mon Sep 17 00:00:00 2001 From: Victor Frank Date: Sun, 11 Oct 2026 10:57:57 -0400 Subject: [PATCH 2/3] #102 address review comments: drop explicit cache, report to job summary setup-go v4+ caches by default, so the cache: true lines are removed and the job layout matches main again (action versions, matrix, go.mod). The analyzer prints through log.Println, i.e. to stderr, so the old "./analyzer > analyzer-output.txt" produced an empty file. A pull_request run from a fork also gets a read-only GITHUB_TOKEN, so creating a PR comment fails with 403. Capture stderr and write the report to GITHUB_STEP_SUMMARY instead; the artifact upload is dropped as redundant. --- .github/workflows/go_build.yaml | 55 ++++++++++++++------------------- 1 file changed, 23 insertions(+), 32 deletions(-) diff --git a/.github/workflows/go_build.yaml b/.github/workflows/go_build.yaml index fcb085d..997cd0e 100644 --- a/.github/workflows/go_build.yaml +++ b/.github/workflows/go_build.yaml @@ -14,14 +14,15 @@ name: CQL Testing and Analysis on: [push, pull_request, workflow_dispatch] - jobs: + go_test: runs-on: ${{ matrix.os }} strategy: matrix: os: [ubuntu-latest, macOS-latest, windows-latest] steps: + - name: Check out code uses: actions/checkout@v6 @@ -29,7 +30,6 @@ jobs: uses: actions/setup-go@v6 with: go-version-file: 'go.mod' - cache: true id: go - name: Get dependencies @@ -44,8 +44,12 @@ jobs: go test ./... go_spec_test_coverage: - runs-on: ubuntu-latest + runs-on: ${{ matrix.os }} + strategy: + matrix: + os: [ubuntu-latest] steps: + - name: Check out code uses: actions/checkout@v6 @@ -53,35 +57,22 @@ jobs: uses: actions/setup-go@v6 with: go-version-file: 'go.mod' - cache: true + id: go - name: Get dependencies - run: go mod download - - - name: Build analyzer - run: go build -o analyzer tests/spectests/cmd/analyzer/analyzer.go + run: | + go mod download + - name: Build + run: | + go build ./... - - name: Run analyzer - run: ./analyzer > analyzer-output.txt - - - name: Upload analyzer results - uses: actions/upload-artifact@v4 - with: - name: analyzer-results - path: analyzer-output.txt - if-no-files-found: error - - - name: Comment PR with analyzer results - if: github.event_name == 'pull_request' - uses: actions/github-script@v7 - with: - script: | - const fs = require('fs'); - const analyzerOutput = fs.readFileSync('analyzer-output.txt', 'utf8'); - - github.rest.issues.createComment({ - issue_number: context.issue.number, - owner: context.repo.owner, - repo: context.repo.repo, - body: '## CQL Test Analyzer Results\n\n```\n' + analyzerOutput + '\n```' - }); \ No newline at end of file + - name: Spec Test Coverage + run: | + set -o pipefail + go run tests/spectests/cmd/analyzer/analyzer.go 2>&1 | tee analyzer-output.txt + { + echo '## CQL Test Analyzer Results' + echo '```' + cat analyzer-output.txt + echo '```' + } >> "$GITHUB_STEP_SUMMARY" From 65c90e63b5949bc63280f94939d59230ec29f4e2 Mon Sep 17 00:00:00 2001 From: Victor Frank Date: Sun, 11 Oct 2026 13:22:43 -0400 Subject: [PATCH 3/3] #98 pin workflow actions to commit hashes and set read-only permissions The zizmor check on this PR requires every action pinned to a hash. Pins checkout and setup-go to the commits their v6 tags point at today (v6.1.0, v6.5.0), adds a read-only permissions block, and turns off checkout credential persistence, which no step needs. --- .github/workflows/go_build.yaml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/go_build.yaml b/.github/workflows/go_build.yaml index 997cd0e..42b5760 100644 --- a/.github/workflows/go_build.yaml +++ b/.github/workflows/go_build.yaml @@ -14,6 +14,8 @@ name: CQL Testing and Analysis on: [push, pull_request, workflow_dispatch] +permissions: + contents: read jobs: go_test: @@ -24,10 +26,12 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: 'go.mod' id: go @@ -51,10 +55,12 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: 'go.mod' id: go