Skip to content

Commit eea9643

Browse files
vincentkocvincentkoc
authored
chore(ci): add gateway CodeQL PR quality guard
Adds the gateway runtime quality shard to the PR CodeQL guard, keeps PR quality analysis path-sharded by surface, and documents the shard selector behavior.
1 parent 2de6ad4 commit eea9643

3 files changed

Lines changed: 75 additions & 7 deletions

File tree

‎.github/codeql/codeql-gateway-runtime-boundary-critical-quality.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,11 @@ query-filters:
1414
- security
1515

1616
paths:
17+
- src/gateway/method-scopes.ts
1718
- src/gateway/protocol
1819
- src/gateway/server-methods
20+
- src/gateway/server-methods.ts
21+
- src/gateway/server-methods-list.ts
1922

2023
paths-ignore:
2124
- "**/node_modules"

‎.github/workflows/codeql-critical-quality.yml‎

Lines changed: 67 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ on:
1010
type: choice
1111
options:
1212
- all
13+
- gateway-runtime-boundary
1314
- plugin-boundary
1415
- plugin-sdk-package-contract
1516
- plugin-sdk-reply-runtime
@@ -22,6 +23,11 @@ on:
2223
- ".github/workflows/codeql-critical-quality.yml"
2324
- "packages/plugin-package-contract/**"
2425
- "packages/plugin-sdk/**"
26+
- "src/gateway/method-scopes.ts"
27+
- "src/gateway/protocol/**"
28+
- "src/gateway/server-methods/**"
29+
- "src/gateway/server-methods.ts"
30+
- "src/gateway/server-methods-list.ts"
2531
- "src/plugin-sdk/**"
2632
- "src/plugins/**"
2733
schedule:
@@ -37,9 +43,64 @@ env:
3743
permissions:
3844
actions: read
3945
contents: read
46+
pull-requests: read
4047
security-events: write
4148

4249
jobs:
50+
quality-shards:
51+
name: Select Critical Quality shards
52+
runs-on: blacksmith-4vcpu-ubuntu-2404
53+
timeout-minutes: 5
54+
outputs:
55+
gateway: ${{ steps.detect.outputs.gateway }}
56+
plugin: ${{ steps.detect.outputs.plugin }}
57+
plugin_sdk_package: ${{ steps.detect.outputs.plugin_sdk_package }}
58+
steps:
59+
- name: Detect PR shard paths
60+
id: detect
61+
env:
62+
EVENT_NAME: ${{ github.event_name }}
63+
GH_TOKEN: ${{ github.token }}
64+
PR_NUMBER: ${{ github.event.pull_request.number }}
65+
REPOSITORY: ${{ github.repository }}
66+
run: |
67+
set -euo pipefail
68+
69+
gateway=false
70+
plugin=false
71+
plugin_sdk_package=false
72+
73+
if [[ "${EVENT_NAME}" != "pull_request" ]]; then
74+
gateway=true
75+
plugin=true
76+
plugin_sdk_package=true
77+
else
78+
while IFS= read -r file; do
79+
case "${file}" in
80+
.github/codeql/*|.github/workflows/codeql-critical-quality.yml)
81+
gateway=true
82+
plugin=true
83+
plugin_sdk_package=true
84+
;;
85+
src/gateway/method-scopes.ts|src/gateway/protocol/*|src/gateway/server-methods/*|src/gateway/server-methods.ts|src/gateway/server-methods-list.ts)
86+
gateway=true
87+
;;
88+
src/plugin-sdk/*|src/plugins/*)
89+
plugin=true
90+
;;
91+
packages/plugin-package-contract/*|packages/plugin-sdk/*|src/plugin-sdk/*)
92+
plugin_sdk_package=true
93+
;;
94+
esac
95+
done < <(gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --jq '.[].filename')
96+
fi
97+
98+
{
99+
echo "gateway=${gateway}"
100+
echo "plugin=${plugin}"
101+
echo "plugin_sdk_package=${plugin_sdk_package}"
102+
} >> "${GITHUB_OUTPUT}"
103+
43104
core-auth-secrets:
44105
name: Critical Quality (core-auth-secrets)
45106
if: ${{ github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || inputs.profile == 'all') }}
@@ -86,7 +147,8 @@ jobs:
86147

87148
gateway-runtime-boundary:
88149
name: Critical Quality (gateway-runtime-boundary)
89-
if: ${{ github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || inputs.profile == 'all') }}
150+
needs: quality-shards
151+
if: ${{ needs.quality-shards.outputs.gateway == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'gateway-runtime-boundary') }}
90152
runs-on: blacksmith-4vcpu-ubuntu-2404
91153
timeout-minutes: 25
92154
steps:
@@ -306,7 +368,8 @@ jobs:
306368

307369
plugin-boundary:
308370
name: Critical Quality (plugin-boundary)
309-
if: ${{ (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'plugin-boundary') }}
371+
needs: quality-shards
372+
if: ${{ needs.quality-shards.outputs.plugin == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'plugin-boundary') }}
310373
runs-on: blacksmith-4vcpu-ubuntu-2404
311374
timeout-minutes: 25
312375
steps:
@@ -328,7 +391,8 @@ jobs:
328391

329392
plugin-sdk-package-contract:
330393
name: Critical Quality (plugin-sdk-package-contract)
331-
if: ${{ (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'plugin-sdk-package-contract') }}
394+
needs: quality-shards
395+
if: ${{ needs.quality-shards.outputs.plugin_sdk_package == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'plugin-sdk-package-contract') }}
332396
runs-on: blacksmith-4vcpu-ubuntu-2404
333397
timeout-minutes: 25
334398
steps:

‎docs/ci.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -299,10 +299,11 @@ The `CodeQL Critical Quality` workflow is the matching non-security shard. It
299299
runs only error-severity, non-security JavaScript/TypeScript quality queries
300300
over narrow high-value surfaces on the smaller Blacksmith Linux runner. Its
301301
pull request guard is intentionally smaller than the scheduled profile: non-draft
302-
PRs only run the `plugin-boundary` and `plugin-sdk-package-contract` shards when
303-
plugin loader, Plugin SDK, package-contract, CodeQL config, or quality workflow
304-
files change. Its manual dispatch accepts
305-
`profile=all|plugin-boundary|plugin-sdk-package-contract|plugin-sdk-reply-runtime|provider-runtime-boundary|session-diagnostics-boundary`;
302+
PRs only run the matching `gateway-runtime-boundary`, `plugin-boundary`, and
303+
`plugin-sdk-package-contract` shards for gateway protocol/server-method, plugin
304+
loader, Plugin SDK, or package-contract changes. CodeQL config and quality
305+
workflow changes run all three PR quality shards. Its manual dispatch accepts
306+
`profile=all|gateway-runtime-boundary|plugin-boundary|plugin-sdk-package-contract|plugin-sdk-reply-runtime|provider-runtime-boundary|session-diagnostics-boundary`;
306307
the narrow profiles are teaching/iteration hooks for running one quality shard
307308
in isolation without dispatching the rest of the workflow.
308309
Its

0 commit comments

Comments
 (0)