Validate workflow to check that all codeql-action versions are the same - #3099
Validate workflow to check that all codeql-action versions are the same#3099mbg merged 2 commits into
Conversation
Sorry, something went wrong.
There was a problem hiding this comment.
Pull Request Overview
This PR adds validation to ensure all github/codeql-action steps in a workflow use the same version reference. The change introduces a new warning when inconsistent versions are detected, helping prevent compatibility issues.
Key changes:
- Added version consistency validation for CodeQL Action steps
- Added comprehensive test coverage for the new validation logic
- Added a new error type for inconsistent action versions
Reviewed Changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| src/workflow.ts | Added validation logic to check version consistency across CodeQL Action steps and new error message |
| src/workflow.test.ts | Added test cases covering version mismatch scenarios, consistent versions, and other actions |
| lib/*.js | Generated JavaScript files (not reviewed per guidelines) |
Sorry, something went wrong.
| ) { | ||
| const parts = step.uses.split("@"); | ||
| if (parts.length >= 2) { | ||
| codeqlStepRefs.push(parts[parts.length - 1]); |
Copilot
AI
Sep 10, 2025
There was a problem hiding this comment.
The logic assumes that splitting on '@' will always produce the version as the last part, but this may not handle edge cases correctly. For example, if step.uses is 'github/codeql-action/init@v2@extra', this would extract 'extra' instead of 'v2@extra'. Consider using parts.slice(1).join('@') to handle multiple '@' characters properly.
| codeqlStepRefs.push(parts[parts.length - 1]); | |
| codeqlStepRefs.push(parts.slice(1).join("@")); |
Sorry, something went wrong.
| const parts = step.uses.split("@"); | ||
| if (parts.length >= 2) { |
There was a problem hiding this comment.
Minor: don't we have this kind of parsing elsewhere already?
Sorry, something went wrong.
There was a problem hiding this comment.
We have
const format = new RegExp(
"(?<owner>[^/]+)/(?<repo>[^/]+)/(?<path>[^@]+)@(?<ref>.*)",
);in getRemoteConfig, but I thought I'd keep this simple.
Sorry, something went wrong.
This PR adds an extra check to validateWorkflows which collects all the refs used for github/codeql-action steps in the workflow and checks that they are all the same.
If there is a mismatch, then this results in a warning.
Risk assessment
For internal use only. Please select the risk level of this change:
Merge / deployment checklist