feat(bulk): add deterministic structural selectors #1964
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL Code Quality | |
| # Runs the CodeQL "<language>-code-quality" suite PLUS the default | |
| # "<language>-code-scanning" security suite per language and fails the PR on | |
| # ANY finding. | |
| # | |
| # Why the security suite is gated here too: GitHub default setup (the | |
| # Security tab) only analyzes master after merge and posts no blocking check | |
| # on PRs, so a PR can introduce security-query findings (e.g. | |
| # js/xss-through-dom) that surface as code-scanning alerts minutes after | |
| # merge — that is how alerts 33-40 landed. Running the same default | |
| # code-scanning suite in this gate catches them pre-merge. | |
| # | |
| # Languages gated (one matrix leg each), both scanning the whole tree | |
| # (--source-root .): | |
| # - python vendored fixtures under tests/initial_test_state/ are dropped | |
| # by scripts/codeql_quality_gate.py's PATHS_IGNORE. | |
| # - javascript scans the JS/TS family (.js/.mjs/.cjs/.ts/.tsx/.jsx) across the | |
| # whole tree — first-party src/, the Astro site's .mjs config, | |
| # and test JS; the same PATHS_IGNORE drops the vendored fixture | |
| # tree. (CodeQL does not extract .astro component scripts.) | |
| # | |
| # Why a custom workflow instead of GitHub's Code Quality page: | |
| # - GitHub Code Quality (Preview) is gated to Team/Enterprise Cloud org plans; | |
| # this repo's org is on the free plan, so the Settings → Security → Code | |
| # quality toggle is unavailable. | |
| # - We do NOT upload SARIF to code scanning: the repo already uses CodeQL | |
| # *default setup* for security, and SARIF uploads are rejected while default | |
| # setup is enabled. This workflow keeps the quality results out of the | |
| # Security tab and gates purely on the job status + artifact/summary. | |
| permissions: | |
| contents: read | |
| on: | |
| pull_request: | |
| branches: [ master ] | |
| push: | |
| branches: [ master ] | |
| paths: | |
| - '**.py' | |
| - '**.js' | |
| - '**.mjs' | |
| - '**.cjs' | |
| - '**.jsx' | |
| - '**.ts' | |
| - '**.tsx' | |
| - '**.astro' | |
| workflow_dispatch: | |
| concurrency: | |
| group: codeql-quality-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| code-quality: | |
| name: CodeQL Code Quality (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: python | |
| suite: codeql/python-queries:codeql-suites/python-code-quality.qls | |
| security_suite: codeql/python-queries:codeql-suites/python-code-scanning.qls | |
| - language: javascript | |
| suite: codeql/javascript-queries:codeql-suites/javascript-code-quality.qls | |
| security_suite: codeql/javascript-queries:codeql-suites/javascript-code-scanning.qls | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 | |
| with: | |
| python-version: "3.13" | |
| - name: Install CodeQL CLI | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh extensions install github/gh-codeql | |
| gh codeql set-version latest | |
| - name: Create CodeQL database (${{ matrix.language }}) | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh codeql database create ha-mcp-db \ | |
| --language=${{ matrix.language }} \ | |
| --build-mode=none \ | |
| --source-root . \ | |
| --overwrite | |
| - name: Analyze with ${{ matrix.language }} quality + security suites | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh codeql database analyze ha-mcp-db \ | |
| ${{ matrix.suite }} \ | |
| ${{ matrix.security_suite }} \ | |
| --format=sarif-latest \ | |
| --output quality.sarif \ | |
| --download | |
| - name: Upload SARIF artifact | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: codeql-quality-sarif-${{ matrix.language }} | |
| path: quality.sarif | |
| if-no-files-found: warn | |
| - name: Gate on findings | |
| run: python scripts/codeql_quality_gate.py quality.sarif | |
| code-quality-gate: | |
| name: CodeQL Gate | |
| if: ${{ always() }} | |
| needs: code-quality | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Require every CodeQL analysis to pass | |
| run: test "${{ needs.code-quality.result }}" = "success" |