From 780414bfc697a1c081de132ead247fdc91c9d2c3 Mon Sep 17 00:00:00 2001 From: mianava Date: Thu, 26 Mar 2026 23:58:56 -0400 Subject: [PATCH 1/4] Update versions to latest. --- .github/workflows/codeql-analysis.yml | 66 ++++++++++++--------------- 1 file changed, 30 insertions(+), 36 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index d1d4b6e9..fb244532 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -21,7 +21,7 @@ on: jobs: analyze: - runs-on: ubuntu-latest + runs-on: codebuild-cdap-${{ github.ref_name =='main' && 'prod' || 'non-prod' }}-${{github.run_id}}-${{github.run_attempt}} permissions: actions: read contents: read @@ -30,40 +30,34 @@ jobs: strategy: fail-fast: false matrix: - language: [ 'TypeScript' ] - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] - # Learn more about CodeQL language support at https://git.io/codeql-language-support + language: [ 'javascript-typescript' ] + # CodeQL supports: 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' + # Learn more: https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - - name: Checkout repository - uses: actions/checkout@v3 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v2 - with: - languages: ${{ matrix.language }} - source-root: actions/aws-params-env-action/src - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - # queries: ./path/to/local/query, your-org/your-repo/queries@main - - # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@v2 - - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 https://git.io/JvXDl - - # ✏ī¸ If the Autobuild fails above, remove it and uncomment the following three lines - # and modify them (or add more) to build your code if your project - # uses a compiled language - - #- run: | - # make bootstrap - # make release - - - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@v2 + - name: Checkout repository + uses: actions/checkout@v4 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + source-root: actions/aws-params-env-action/src + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + # queries: ./path/to/local/query, your-org/your-repo/queries@main + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + - name: Perform CodeQL analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{ matrix.language }}" \ No newline at end of file From 6b613764f61c259c2a3df8ca741e868a3123ad36 Mon Sep 17 00:00:00 2001 From: mianava Date: Fri, 27 Mar 2026 00:01:02 -0400 Subject: [PATCH 2/4] Update to use arm64 runners --- .github/workflows/python-checks.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/python-checks.yml b/.github/workflows/python-checks.yml index b69623db..c97df3ea 100644 --- a/.github/workflows/python-checks.yml +++ b/.github/workflows/python-checks.yml @@ -8,7 +8,7 @@ on: jobs: python-checks: - runs-on: codebuild-cdap-${{github.run_id}}-${{github.run_attempt}} + runs-on: codebuild-cdap-${{ github.ref_name =='main' && 'prod' || 'non-prod' }}-${{github.run_id}}-${{github.run_attempt}} steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47 From 10258e6a29c2eff9be2ca4c9c1a4966cd02d02bf Mon Sep 17 00:00:00 2001 From: mianava Date: Fri, 27 Mar 2026 01:05:59 -0400 Subject: [PATCH 3/4] Update to v3 and v4 --- .github/workflows/codeql-analysis.yml | 64 +++++++++++++++------------ 1 file changed, 36 insertions(+), 28 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index fb244532..eaf20194 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -31,33 +31,41 @@ jobs: fail-fast: false matrix: language: [ 'javascript-typescript' ] - # CodeQL supports: 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' - # Learn more: https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages + # CodeQL supports [ 'cpp', 'csharp', 'go', 'java-kotlin', 'javascript', 'python', 'ruby', 'swift' ] + # Learn more about CodeQL language support at https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - - name: Checkout repository - uses: actions/checkout@v4 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: ${{ matrix.language }} - source-root: actions/aws-params-env-action/src - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - # queries: ./path/to/local/query, your-org/your-repo/queries@main - - # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@v3 - - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:${{ matrix.language }}" \ No newline at end of file + - name: Checkout repository + uses: actions/checkout@v4 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + source-root: actions/aws-params-env-action/src + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + # queries: ./path/to/local/query, your-org/your-repo/queries@main + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 https://git.io/JvXDl + + # ✏ī¸ If the Autobuild fails above, remove it and uncomment the following three lines + # and modify them (or add more) to build your code if your project + # uses a compiled language + + #- run: | + # make bootstrap + # make release + + - name: Perform CodeQL analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:$${{ matrix.language }}" From 26ca25e16cc9bb892d71ed0032a20cbd36180bad Mon Sep 17 00:00:00 2001 From: mianava Date: Fri, 27 Mar 2026 15:11:51 -0400 Subject: [PATCH 4/4] Default to non-prod builders. --- .github/workflows/test-codebuild-projects.yml | 2 +- .github/workflows/tofu-apply.yml | 2 +- .github/workflows/tofu-plan.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test-codebuild-projects.yml b/.github/workflows/test-codebuild-projects.yml index e046f7ff..2803fd64 100644 --- a/.github/workflows/test-codebuild-projects.yml +++ b/.github/workflows/test-codebuild-projects.yml @@ -7,7 +7,7 @@ on: jobs: smoke-test: - runs-on: codebuild-cdap-${{ contains(fromJSON('["dev", "test"]'), matrix.env) && 'non-prod' || 'prod'}}-${{github.run_id}}-${{github.run_attempt}} + runs-on: codebuild-cdap-${{ contains(fromJSON('["prod", "sandbox"]'), matrix.env) && 'prod' || 'non-prod'}}-${{github.run_id}}-${{github.run_attempt}} strategy: matrix: env: [dev, test, sandbox, prod] diff --git a/.github/workflows/tofu-apply.yml b/.github/workflows/tofu-apply.yml index 7a364f82..b58421c3 100644 --- a/.github/workflows/tofu-apply.yml +++ b/.github/workflows/tofu-apply.yml @@ -21,7 +21,7 @@ jobs: permissions: contents: read id-token: write - runs-on: codebuild-cdap-${{ contains(fromJSON('["dev", "test"]'), matrix.env) && 'non-prod' || 'prod'}}-${{github.run_id}}-${{github.run_attempt}} + runs-on: codebuild-cdap-${{ contains(fromJSON('["prod", "sandbox"]'), matrix.env) && 'prod' || 'non-prod'}}-${{github.run_id}}-${{github.run_attempt}} strategy: fail-fast: false matrix: diff --git a/.github/workflows/tofu-plan.yml b/.github/workflows/tofu-plan.yml index 9c926312..933d8ed4 100644 --- a/.github/workflows/tofu-plan.yml +++ b/.github/workflows/tofu-plan.yml @@ -17,7 +17,7 @@ jobs: permissions: contents: read id-token: write - runs-on: codebuild-cdap-${{ contains(fromJSON('["dev", "test"]'), matrix.env) && 'non-prod' || 'prod'}}-${{github.run_id}}-${{github.run_attempt}} + runs-on: codebuild-cdap-${{ contains(fromJSON('["prod", "sandbox"]'), matrix.env) && 'prod' || 'non-prod'}}-${{github.run_id}}-${{github.run_attempt}} strategy: fail-fast: false matrix: