Sam Morrow
7e394af647
* chore(ui): migrate vite 6 -> 8 and plugin-react 4 -> 6 Supersedes the auto-generated bump in #2496, which only updated vite and left @vitejs/plugin-react on a peer range that excludes vite 8, breaking the UI build (and every Go job that embeds the UI assets) with ERESOLVE. - vite ^6.0.0 -> ^8.0.13 - @vitejs/plugin-react ^4.3.0 -> ^6.0.2 (peers vite ^8.0.0 only) - vite-plugin-singlefile ^2.0.0 -> ^2.3.3 (peers already allowed v8) - engines.node >=20 -> ^20.19.0 || >=22.12.0 (Vite 7+ requirement) Vite 8 ships Rolldown instead of Rollup, which rejects bundle mutation in generateBundle. The rename-output plugin was doing exactly that to flatten the singlefile-inlined HTML from src/apps/<app>/index.html down to <app>.html. Refactored it to hoist the file in closeBundle (post-write) and renamed it to flatten-output to reflect what it actually does. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(ui): give flatten-output a clearer error when the HTML is missing Addresses Copilot review feedback on #2501: if the singlefile-inlined HTML isn't where we expect it (e.g. because a future Vite/Rolldown change alters the output path), throw with the app name and expected path instead of letting renameSync surface a bare ENOENT. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * perf(ui+ci): cache build artifacts and run vite in single process Introduce a content-addressable cache for the embedded UI HTML and refactor the build script to invoke vite once per Node process instead of three times. * New ui/scripts/build.mjs runs vite build() in a loop within one process, removing the cross-env dev dependency and avoiding redundant plugin/JIT warm-up. Local build time drops from ~2.4s to ~1.5s. * New .github/actions/build-ui composite action restores pkg/github/ui_dist/{get-me,issue-write,pr-write}.html from cache keyed on hashes of ui/ sources and the lockfile. On cache hit it skips Node setup and the build entirely; on miss it sets up Node and runs script/build-ui as before. Saves ~6s per workflow on Go-only PRs, which is the common case across seven workflows. * Replace the duplicated setup-node + Build UI pair in seven workflows (go, lint, docs-check, license-check, goreleaser, mcp-diff, code-scanning) with a single uses: ./.github/actions/build-ui line. code-scanning keeps a dedicated setup-node for the JavaScript CodeQL path. Output files are byte-identical to the pre-refactor build. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * perf(ci): share UI artifact cache across runner OSes The cached HTML output is platform-independent, so set enableCrossOsArchive on the cache step. With this any OS can restore the cache populated by any other OS — one shared cache instead of three. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
104 lines
3.5 KiB
YAML
104 lines
3.5 KiB
YAML
name: "CodeQL"
|
|
run-name: ${{ github.event.inputs.code_scanning_run_name }}
|
|
on: [push, pull_request, workflow_dispatch]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
CODE_SCANNING_REF: ${{ github.event.inputs.code_scanning_ref }}
|
|
CODE_SCANNING_BASE_BRANCH: ${{ github.event.inputs.code_scanning_base_branch }}
|
|
CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH: ${{ github.event.inputs.code_scanning_is_analyzing_default_branch }}
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
# Only run on the main repository, not on forks
|
|
if: github.repository == 'github/github-mcp-server'
|
|
runs-on: ${{ fromJSON(matrix.runner) }}
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
packages: read
|
|
security-events: write
|
|
continue-on-error: false
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- language: actions
|
|
category: /language:actions
|
|
build-mode: none
|
|
runner: '["ubuntu-22.04"]'
|
|
- language: go
|
|
category: /language:go
|
|
build-mode: autobuild
|
|
runner: '["ubuntu-22.04"]'
|
|
- language: javascript
|
|
category: /language:javascript
|
|
build-mode: none
|
|
runner: '["ubuntu-22.04"]'
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@v4
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: ${{ matrix.build-mode }}
|
|
dependency-caching: ${{ runner.environment == 'github-hosted' }}
|
|
queries: "" # Default query suite
|
|
packs: github/ccr-${{ matrix.language }}-queries
|
|
config: |
|
|
paths-ignore:
|
|
- third-party
|
|
- third-party-licenses.*.md
|
|
default-setup:
|
|
org:
|
|
model-packs: [ ${{ github.event.inputs.code_scanning_codeql_packs }} ]
|
|
threat-models: [ ]
|
|
- name: Setup proxy for registries
|
|
id: proxy
|
|
uses: github/codeql-action/start-proxy@v4
|
|
with:
|
|
registries_credentials: ${{ secrets.GITHUB_REGISTRIES_PROXY }}
|
|
language: ${{ matrix.language }}
|
|
|
|
- name: Configure
|
|
uses: github/codeql-action/resolve-environment@v4
|
|
id: resolve-environment
|
|
with:
|
|
language: ${{ matrix.language }}
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v6
|
|
if: matrix.language == 'go' && fromJSON(steps.resolve-environment.outputs.environment).configuration.go.version
|
|
with:
|
|
go-version: ${{ fromJSON(steps.resolve-environment.outputs.environment).configuration.go.version }}
|
|
cache: false
|
|
|
|
- name: Set up Node.js (for JavaScript CodeQL)
|
|
if: matrix.language == 'javascript'
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
cache-dependency-path: ui/package-lock.json
|
|
|
|
- name: Build UI
|
|
if: matrix.language == 'go'
|
|
uses: ./.github/actions/build-ui
|
|
|
|
- name: Autobuild
|
|
uses: github/codeql-action/autobuild@v4
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@v4
|
|
env:
|
|
CODEQL_PROXY_HOST: ${{ steps.proxy.outputs.proxy_host }}
|
|
CODEQL_PROXY_PORT: ${{ steps.proxy.outputs.proxy_port }}
|
|
CODEQL_PROXY_CA_CERTIFICATE: ${{ steps.proxy.outputs.proxy_ca_certificate }}
|
|
with:
|
|
category: ${{ matrix.category }}
|