publish.yml

name: Publish CodeQL Packs

# Auto-publish only fires when .release.yml itself changes - that's the
# deliberate "cut a release" signal (see update-release.yml, which bumps
# .release.yml and every pack version together in one PR). Individual pack
# version bumps merged outside of that flow do NOT auto-publish; use
# workflow_dispatch for one-off hotfixes (see CONTRIBUTING.md).
on:
  push:
    branches: [main]
    paths:
      - ".release.yml"
  workflow_dispatch:


jobs:
  queries:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write

    strategy:
      fail-fast: false
      matrix:
        language: ["actions", "cpp", "csharp", "go", "java", "javascript", "python", "ruby", "rust", "swift"]

    steps:
      - uses: actions/checkout@v7

      - name: Check codeql-LANG-queries (src) pack
        id: check_version
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # A brand-new pack's container doesn't exist on GHCR yet, so `gh api` 404s. On any
          # failure, force PUBLISHED_VERSION empty rather than trusting whatever ended up on
          # stdout: on error, `gh api` prints the raw (unfiltered) response body there - e.g.
          # `{"message":"Package not found.",...}` - even with `--jq` and even with
          # `2>/dev/null`. That body's embedded double quotes previously broke out of the
          # `--arg previous_version "..."` quoting in the "Record publish result" step below,
          # corrupting its jq invocation into writing a bare `true`/`false` instead of a JSON
          # object - which then broke the release summary table for every language, not just
          # the newly-published one (this is what happened publishing v0.7.1's new go/python
          # `ext` packs for the first time).
          if ! PUBLISHED_VERSION=$(gh api /orgs/githubsecuritylab/packages/container/codeql-${{ matrix.language }}-queries/versions --jq '.[0].metadata.container.tags[0]' 2>/dev/null); then
            PUBLISHED_VERSION=""
          fi
          CURRENT_VERSION=$(grep -E '^version:' ${{ matrix.language }}/src/qlpack.yml | head -1 | awk '{print $2}')

          echo "Published version: $PUBLISHED_VERSION"
          echo "Local version: $CURRENT_VERSION"

          echo "published_version=$PUBLISHED_VERSION" >> $GITHUB_OUTPUT
          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT

          if [ "$PUBLISHED_VERSION" != "$CURRENT_VERSION" ]; then
            echo "publish=true" >> $GITHUB_OUTPUT
          fi

      - name: Setup CodeQL
        if: steps.check_version.outputs.publish == 'true'
        uses: ./.github/actions/install-codeql

      - name: Publish codeql-LANG-queries (src) pack.
        id: publish
        if: steps.check_version.outputs.publish == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Publishing codeql-${{ matrix.language }}-queries."
          codeql pack install "${{ matrix.language }}/src"
          codeql pack publish "${{ matrix.language }}/src"

      - name: Record publish result
        if: always()
        env:
          # Passed via env (not raw `${{ }}` interpolation) since these values ultimately
          # derive from external content (a GHCR tag, or `gh api`'s error body on a 404 - see
          # the `check_version` step above) that could contain a literal `"`. Interpolating
          # such a value directly into `--arg previous_version "${{ ... }}"` below would break
          # out of that quoting and corrupt the whole jq invocation; referenced as a shell
          # variable instead, it's always passed through safely no matter its content.
          PREVIOUS_VERSION: ${{ steps.check_version.outputs.published_version }}
          TARGET_VERSION: ${{ steps.check_version.outputs.current_version }}
        run: |
          mkdir -p publish-results
          STATUS="up-to-date"
          if [ "${{ steps.check_version.outcome }}" != "success" ]; then
            STATUS="failed"
          elif [ "${{ steps.check_version.outputs.publish }}" == "true" ]; then
            if [ "${{ steps.publish.outcome }}" == "success" ]; then
              STATUS="published"
            else
              STATUS="failed"
            fi
          fi
          jq -n \
            --arg language "${{ matrix.language }}" \
            --arg type "src" \
            --arg package "codeql-${{ matrix.language }}-queries" \
            --arg previous_version "$PREVIOUS_VERSION" \
            --arg target_version "$TARGET_VERSION" \
            --arg status "$STATUS" \
            '{language: $language, type: $type, package: $package, previous_version: $previous_version, target_version: $target_version, status: $status}' \
            > "publish-results/${{ matrix.language }}-src.json"

      - name: Upload publish result
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: publish-result-${{ matrix.language }}-src
          path: publish-results/${{ matrix.language }}-src.json
          retention-days: 1

  library:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write

    strategy:
      fail-fast: false
      matrix:
        language: ["cpp", "csharp", "go", "java", "javascript", "python", "ruby"] 

    steps:
      - uses: actions/checkout@v7

      - name: Check codeql-LANG-libs (lib) pack
        id: check_version
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # See the `queries` job above for why PUBLISHED_VERSION is forced empty on any
          # `gh api` failure instead of relying on `|| true`.
          if ! PUBLISHED_VERSION=$(gh api /orgs/githubsecuritylab/packages/container/codeql-${{ matrix.language }}-libs/versions --jq '.[0].metadata.container.tags[0]' 2>/dev/null); then
            PUBLISHED_VERSION=""
          fi
          CURRENT_VERSION=$(grep -E '^version:' ${{ matrix.language }}/lib/qlpack.yml | head -1 | awk '{print $2}')

          echo "Published version: $PUBLISHED_VERSION"
          echo "Local version: $CURRENT_VERSION"

          echo "published_version=$PUBLISHED_VERSION" >> $GITHUB_OUTPUT
          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT

          if [ "$PUBLISHED_VERSION" != "$CURRENT_VERSION" ]; then
            echo "publish=true" >> $GITHUB_OUTPUT
          fi

      - name: Setup CodeQL
        if: steps.check_version.outputs.publish == 'true'
        uses: ./.github/actions/install-codeql

      - name: Publish codeql-LANG-libs (lib) pack
        id: publish
        if: steps.check_version.outputs.publish == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Publishing codeql-${{ matrix.language }}-libs."
          codeql pack install "${{ matrix.language }}/lib"
          codeql pack publish "${{ matrix.language }}/lib"

      - name: Record publish result
        if: always()
        env:
          # See the `queries` job above for why these are passed via env, not `${{ }}`.
          PREVIOUS_VERSION: ${{ steps.check_version.outputs.published_version }}
          TARGET_VERSION: ${{ steps.check_version.outputs.current_version }}
        run: |
          mkdir -p publish-results
          STATUS="up-to-date"
          if [ "${{ steps.check_version.outcome }}" != "success" ]; then
            STATUS="failed"
          elif [ "${{ steps.check_version.outputs.publish }}" == "true" ]; then
            if [ "${{ steps.publish.outcome }}" == "success" ]; then
              STATUS="published"
            else
              STATUS="failed"
            fi
          fi
          jq -n \
            --arg language "${{ matrix.language }}" \
            --arg type "lib" \
            --arg package "codeql-${{ matrix.language }}-libs" \
            --arg previous_version "$PREVIOUS_VERSION" \
            --arg target_version "$TARGET_VERSION" \
            --arg status "$STATUS" \
            '{language: $language, type: $type, package: $package, previous_version: $previous_version, target_version: $target_version, status: $status}' \
            > "publish-results/${{ matrix.language }}-lib.json"

      - name: Upload publish result
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: publish-result-${{ matrix.language }}-lib
          path: publish-results/${{ matrix.language }}-lib.json
          retention-days: 1

  extensions:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write

    strategy:
      fail-fast: false
      matrix:
        language: ["csharp", "go", "java", "python", "rust"]

    steps:
      - uses: actions/checkout@v7

      - name: Check codeql-LANG-extensions (ext) pack
        id: check_version
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # See the `queries` job above for why PUBLISHED_VERSION is forced empty on any
          # `gh api` failure instead of relying on `|| true`.
          if ! PUBLISHED_VERSION=$(gh api /orgs/githubsecuritylab/packages/container/codeql-${{ matrix.language }}-extensions/versions --jq '.[0].metadata.container.tags[0]' 2>/dev/null); then
            PUBLISHED_VERSION=""
          fi
          CURRENT_VERSION=$(grep -E '^version:' ${{ matrix.language }}/ext/qlpack.yml | head -1 | awk '{print $2}')

          echo "Published version: $PUBLISHED_VERSION"
          echo "Local version: $CURRENT_VERSION"
          echo "published_version=$PUBLISHED_VERSION" >> $GITHUB_OUTPUT
          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
          if [ "$PUBLISHED_VERSION" != "$CURRENT_VERSION" ]; then
            echo "publish=true" >> $GITHUB_OUTPUT
          fi

      - name: Setup CodeQL
        if: steps.check_version.outputs.publish == 'true'
        uses: ./.github/actions/install-codeql

      - name: Publish codeql-LANG-extensions (ext) pack
        id: publish
        if: steps.check_version.outputs.publish == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Publishing codeql-${{ matrix.language }}-extensions."
          # NOTE: deliberately no `codeql pack install` here. `ext` is a CodeQL model/extension
          # pack (`library: true`, `extensionTargets`, no `dependencies`) - installing it just
          # (re)writes a `codeql-pack.lock.yml` with an empty `dependencies: {}` map, and a
          # checked-in lock file in that state makes a subsequent `codeql pack publish`/`create`
          # emit a bogus `addsTo.pack '...' is not an extension target of '...'` warning for every
          # data extension in the pack (a known CodeQL CLI bug, see
          # https://github.com/github/codeql/issues/20211). See CONTRIBUTING.md.
          codeql pack publish "${{ matrix.language }}/ext"

      - name: Record publish result
        if: always()
        env:
          # See the `queries` job above for why these are passed via env, not `${{ }}`.
          PREVIOUS_VERSION: ${{ steps.check_version.outputs.published_version }}
          TARGET_VERSION: ${{ steps.check_version.outputs.current_version }}
        run: |
          mkdir -p publish-results
          STATUS="up-to-date"
          if [ "${{ steps.check_version.outcome }}" != "success" ]; then
            STATUS="failed"
          elif [ "${{ steps.check_version.outputs.publish }}" == "true" ]; then
            if [ "${{ steps.publish.outcome }}" == "success" ]; then
              STATUS="published"
            else
              STATUS="failed"
            fi
          fi
          jq -n \
            --arg language "${{ matrix.language }}" \
            --arg type "ext" \
            --arg package "codeql-${{ matrix.language }}-extensions" \
            --arg previous_version "$PREVIOUS_VERSION" \
            --arg target_version "$TARGET_VERSION" \
            --arg status "$STATUS" \
            '{language: $language, type: $type, package: $package, previous_version: $previous_version, target_version: $target_version, status: $status}' \
            > "publish-results/${{ matrix.language }}-ext.json"

      - name: Upload publish result
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: publish-result-${{ matrix.language }}-ext
          path: publish-results/${{ matrix.language }}-ext.json
          retention-days: 1


  library_sources_extensions:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write

    strategy:
      fail-fast: false
      matrix:
        language: ["csharp", "java"]

    steps:
      - uses: actions/checkout@v7

      - name: Check codeql-LANG-library-sources (ext-library-sources) pack
        id: check_version
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # See the `queries` job above for why PUBLISHED_VERSION is forced empty on any
          # `gh api` failure instead of relying on `|| true`.
          if ! PUBLISHED_VERSION=$(gh api /orgs/githubsecuritylab/packages/container/codeql-${{ matrix.language }}-library-sources/versions --jq '.[0].metadata.container.tags[0]' 2>/dev/null); then
            PUBLISHED_VERSION=""
          fi
          CURRENT_VERSION=$(grep -E '^version:' ${{ matrix.language }}/ext-library-sources/qlpack.yml | head -1 | awk '{print $2}')

          echo "Published version: $PUBLISHED_VERSION"
          echo "Local version: $CURRENT_VERSION"
          echo "published_version=$PUBLISHED_VERSION" >> $GITHUB_OUTPUT
          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
          if [ "$PUBLISHED_VERSION" != "$CURRENT_VERSION" ]; then
            echo "publish=true" >> $GITHUB_OUTPUT
          fi

      - name: Setup CodeQL
        if: steps.check_version.outputs.publish == 'true'
        uses: ./.github/actions/install-codeql

      - name: Publish codeql-LANG-library-sources (ext-library-sources) pack
        id: publish
        if: steps.check_version.outputs.publish == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Publishing codeql-${{ matrix.language }}-library-sources."
          # NOTE: deliberately no `codeql pack install` here - see the matching comment in the
          # `extensions` job above.
          codeql pack publish "${{ matrix.language }}/ext-library-sources"

      - name: Record publish result
        if: always()
        env:
          # See the `queries` job above for why these are passed via env, not `${{ }}`.
          PREVIOUS_VERSION: ${{ steps.check_version.outputs.published_version }}
          TARGET_VERSION: ${{ steps.check_version.outputs.current_version }}
        run: |
          mkdir -p publish-results
          STATUS="up-to-date"
          if [ "${{ steps.check_version.outcome }}" != "success" ]; then
            STATUS="failed"
          elif [ "${{ steps.check_version.outputs.publish }}" == "true" ]; then
            if [ "${{ steps.publish.outcome }}" == "success" ]; then
              STATUS="published"
            else
              STATUS="failed"
            fi
          fi
          jq -n \
            --arg language "${{ matrix.language }}" \
            --arg type "ext-library-sources" \
            --arg package "codeql-${{ matrix.language }}-library-sources" \
            --arg previous_version "$PREVIOUS_VERSION" \
            --arg target_version "$TARGET_VERSION" \
            --arg status "$STATUS" \
            '{language: $language, type: $type, package: $package, previous_version: $previous_version, target_version: $target_version, status: $status}' \
            > "publish-results/${{ matrix.language }}-ext-library-sources.json"

      - name: Upload publish result
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: publish-result-${{ matrix.language }}-ext-library-sources
          path: publish-results/${{ matrix.language }}-ext-library-sources.json
          retention-days: 1

  summary:
    name: Publish summary
    needs: [queries, library, extensions, library_sources_extensions]
    if: always()
    runs-on: ubuntu-latest

    permissions:
      contents: write
      actions: read

    steps:
      - uses: actions/checkout@v7

      # Not actions/download-artifact with merge-multiple: a re-run or restarted publish job
      # leaves a second same-named artifact in the run, and merge-multiple can let the stale
      # (e.g. cancelled/failed) one overwrite the newer result. This keeps the newest per name.
      - name: Download publish results
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: .github/scripts/download-latest-publish-results.sh "${{ github.run_id }}" publish-results

      - name: Build summary table
        run: |
          mkdir -p publish-results
          echo "Result fragments found:"
          ls -la publish-results
          .github/scripts/build-publish-summary.sh publish-results > summary.md
          echo "summary.md is $(wc -l < summary.md) lines, $(wc -c < summary.md) bytes"
          cat summary.md >> "$GITHUB_STEP_SUMMARY"

      - name: Build CodeQL library & query pack versions table
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          .github/scripts/build-codeql-lib-versions-table.sh > codeql-lib-versions.md
          cat codeql-lib-versions.md >> "$GITHUB_STEP_SUMMARY"

      - name: Upsert release table
        # Only the release-cut path (push to .release.yml) should touch a GitHub Release's
        # notes. A workflow_dispatch run is often a one-off hotfix publish for a single pack
        # (see CONTRIBUTING.md's "Manual/one-off hotfix publish") while .release.yml still
        # points at the last cut release - upserting this run's tables into that release would
        # misleadingly overwrite its notes with a summary of an unrelated hotfix run.
        if: github.event_name == 'push'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          .github/scripts/upsert-release-table.sh summary.md publish-summary
          .github/scripts/upsert-release-table.sh codeql-lib-versions.md codeql-lib-versions