diff --git a/.github/workflows/__linux-arm64.yml b/.github/workflows/__linux-arm64.yml new file mode 100644 index 0000000000..641099ebc8 --- /dev/null +++ b/.github/workflows/__linux-arm64.yml @@ -0,0 +1,91 @@ +# Warning: This file is generated automatically, and should not be modified. +# Instead, please modify the template in the pr-checks directory and run: +# pr-checks/sync.sh +# to regenerate this file. + +name: PR Check - Linux Arm64 +env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GO111MODULE: auto +on: + push: + branches: + - main + - releases/v* + pull_request: {} + merge_group: + types: + - checks_requested + schedule: + - cron: '0 5 * * *' + workflow_dispatch: + inputs: + go-version: + type: string + description: The version of Go to install + required: false + default: '>=1.21.0' + workflow_call: + inputs: + go-version: + type: string + description: The version of Go to install + required: false + default: '>=1.21.0' +defaults: + run: + shell: bash +concurrency: + cancel-in-progress: ${{ github.event_name == 'pull_request' || false }} + group: linux-arm64-${{github.ref}}-${{inputs.go-version}} +jobs: + linux-arm64: + strategy: + fail-fast: false + matrix: + include: + - os: ubuntu-24.04-arm + version: nightly-latest + name: Linux Arm64 + if: github.triggering_actor != 'dependabot[bot]' + permissions: + contents: read + security-events: read + timeout-minutes: 45 + runs-on: ${{ matrix.os }} + steps: + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Install Go + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version: ${{ inputs.go-version || '>=1.21.0' }} + cache: false + - name: Prepare test + id: prepare-test + uses: ./.github/actions/prepare-test + with: + version: ${{ matrix.version }} + use-all-platform-bundle: 'false' + setup-kotlin: 'true' + - uses: ./../action/init + with: + languages: javascript,python,go + tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Build Go code + run: go build main.go + - uses: ./../action/analyze + with: + skip-queries: true + upload-database: false + - name: Assert databases exist + run: | + cd "$RUNNER_TEMP/codeql_databases" + for lang in javascript python go; do + if [[ ! -d "$lang" ]]; then + echo "Did not find a database for $lang" + exit 1 + fi + done + env: + CODEQL_ACTION_TEST_MODE: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 21e812c9f8..2cd2c316d6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] -No user facing changes. +- The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and download the native `linux-arm64` CodeQL bundle when available. [#4072](https://github.com/github/codeql-action/pull/4072) ## 4.37.5 - 03 Aug 2026 diff --git a/lib/entry-points.js b/lib/entry-points.js index cdd0db217d..3183db5467 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -147777,6 +147777,7 @@ var toolrunner3 = __toESM(require_toolrunner()); // src/cli-errors.ts var SUPPORTED_PLATFORMS = [ ["linux", "x64"], + ["linux", "arm64"], ["win32", "x64"], ["darwin", "x64"], ["darwin", "arm64"] @@ -150946,7 +150947,7 @@ function getCodeQLBundleName(compressionMethod) { if (process.platform === "win32") { platform2 = "win64"; } else if (process.platform === "linux") { - platform2 = "linux64"; + platform2 = process.arch === "arm64" ? "linux-arm64" : "linux64"; } else if (process.platform === "darwin") { platform2 = "osx64"; } else { diff --git a/pr-checks/checks/linux-arm64.yml b/pr-checks/checks/linux-arm64.yml new file mode 100644 index 0000000000..d254799ba9 --- /dev/null +++ b/pr-checks/checks/linux-arm64.yml @@ -0,0 +1,31 @@ +name: "Linux Arm64" +description: "An end-to-end integration test running on a Linux Arm64 runner, checking that the native linux-arm64 CodeQL bundle is downloaded and can analyze interpreted and compiled code" +operatingSystems: + - os: ubuntu + runner-image: ubuntu-24.04-arm +# The native linux-arm64 CodeQL bundle is only available in recent CLI releases, so we restrict this +# check to `nightly-latest`, which is guaranteed to ship it. Older stable versions do not have an +# arm64 asset, and `prepare-test` would resolve an x64 bundle URL for them on this runner. +versions: + - nightly-latest +installGo: true +steps: + - uses: ./../action/init + with: + languages: javascript,python,go + tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Build Go code + run: go build main.go + - uses: ./../action/analyze + with: + skip-queries: true + upload-database: false + - name: Assert databases exist + run: | + cd "$RUNNER_TEMP/codeql_databases" + for lang in javascript python go; do + if [[ ! -d "$lang" ]]; then + echo "Did not find a database for $lang" + exit 1 + fi + done diff --git a/src/cli-errors.test.ts b/src/cli-errors.test.ts index 9e2d7dc799..1a83def516 100644 --- a/src/cli-errors.test.ts +++ b/src/cli-errors.test.ts @@ -128,7 +128,6 @@ test("CliError constructor with empty stderr", (t) => { for (const [platform, arch] of [ ["weird_plat", "x64"], - ["linux", "arm64"], ["win32", "arm64"], ]) { test.serial( diff --git a/src/cli-errors.ts b/src/cli-errors.ts index 84ec1aa4e6..608413002c 100644 --- a/src/cli-errors.ts +++ b/src/cli-errors.ts @@ -8,6 +8,7 @@ import { ConfigurationError } from "./util"; const SUPPORTED_PLATFORMS = [ ["linux", "x64"], + ["linux", "arm64"], ["win32", "x64"], ["darwin", "x64"], ["darwin", "arm64"], diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index 219e39984c..b6b287ff8e 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -120,24 +120,42 @@ test.serial( const LINKED_BUNDLE_TEST_CASES = [ { platform: "linux", + arch: "x64", tarSupportsZstd: true, expectedBundleName: "codeql-bundle-linux64.tar.zst", expectedCompressionMethod: "zstd", }, + { + platform: "linux", + arch: "arm64", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-linux-arm64.tar.zst", + expectedCompressionMethod: "zstd", + }, + { + platform: "darwin", + arch: "arm64", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-osx64.tar.zst", + expectedCompressionMethod: "zstd", + }, { platform: "darwin", + arch: "x64", tarSupportsZstd: true, expectedBundleName: "codeql-bundle-osx64.tar.zst", expectedCompressionMethod: "zstd", }, { platform: "win32", + arch: "x64", tarSupportsZstd: true, expectedBundleName: "codeql-bundle-win64.tar.gz", expectedCompressionMethod: "gzip", }, { platform: "linux", + arch: "x64", tarSupportsZstd: false, expectedBundleName: "codeql-bundle-linux64.tar.gz", expectedCompressionMethod: "gzip", @@ -146,15 +164,17 @@ const LINKED_BUNDLE_TEST_CASES = [ for (const { platform, + arch, tarSupportsZstd, expectedBundleName, expectedCompressionMethod, } of LINKED_BUNDLE_TEST_CASES) { test.serial( - `getCodeQLSource selects ${expectedBundleName} for linked tools`, + `getCodeQLSource selects ${expectedBundleName} for linked tools on ${platform}/${arch}`, async (t) => { const features = createFeatures([]); sinon.stub(process, "platform").value(platform); + sinon.stub(process, "arch").value(arch); await withTmpDir(async (tmpDir) => { setupActionsVars(tmpDir, tmpDir); diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 8d374585aa..9b2f6dc067 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -75,7 +75,7 @@ export function getCodeQLBundleName( if (process.platform === "win32") { platform = "win64"; } else if (process.platform === "linux") { - platform = "linux64"; + platform = process.arch === "arm64" ? "linux-arm64" : "linux64"; } else if (process.platform === "darwin") { platform = "osx64"; } else { diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 279459275d..aa1b9dc381 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -936,7 +936,9 @@ export function mockBundleDownloadApi({ process.platform === "win32" ? "win64" : process.platform === "linux" - ? "linux64" + ? process.arch === "arm64" + ? "linux-arm64" + : "linux64" : "osx64"; const baseUrl = apiDetails?.url ?? "https://example.com";