Skip to content

Patch 1 #942

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Patch 1 #942

wants to merge 3 commits into from

Conversation

AndresMaqueo
Copy link

Description

please enter the description of your change here

Change request type

  • Release or process automation (GitHub workflows, internal scripts)
  • Internal documentation
  • External documentation
  • Query files (.ql, .qll, .qls or unit tests)
  • External scripts (analysis report or other code shipped as part of a release)

Rules with added or modified queries

  • No rules added
  • Queries have been added for the following rules:
    • rule number here
  • Queries have been modified for the following rules:
    • rule number here

Release change checklist

A change note (development_handbook.md#change-notes) is required for any pull request which modifies:

  • The structure or layout of the release artifacts.
  • The evaluation performance (memory, execution time) of an existing query.
  • The results of an existing query in any circumstance.

If you are only adding new rule queries, a change note is not required.

Author: Is a change note required?

  • Yes
  • No

🚨🚨🚨
Reviewer: Confirm that format of shared queries (not the .qll file, the
.ql file that imports it) is valid by running them within VS Code.

  • Confirmed

Reviewer: Confirm that either a change note is not required or the change note is required and has been added.

  • Confirmed

Query development review checklist

For PRs that add new queries or modify existing queries, the following checklist should be completed by both the author and reviewer:

Author

  • Have all the relevant rule package description files been checked in?
  • Have you verified that the metadata properties of each new query is set appropriately?
  • Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
  • Are the alert messages properly formatted and consistent with the style guide?
  • Have you run the queries on OpenPilot and verified that the performance and results are acceptable?
    As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
  • Does the query have an appropriate level of in-query comments/documentation?
  • Have you considered/identified possible edge cases?
  • Does the query not reinvent features in the standard library?
  • Can the query be simplified further (not golfed!)

Reviewer

  • Have all the relevant rule package description files been checked in?
  • Have you verified that the metadata properties of each new query is set appropriately?
  • Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
  • Are the alert messages properly formatted and consistent with the style guide?
  • Have you run the queries on OpenPilot and verified that the performance and results are acceptable?
    As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
  • Does the query have an appropriate level of in-query comments/documentation?
  • Have you considered/identified possible edge cases?
  • Does the query not reinvent features in the standard library?
  • Can the query be simplified further (not golfed!)

dependabot bot and others added 2 commits August 11, 2025 06:12
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v5)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Contexto y descripción del problema
En tu pipeline de GitHub Actions para pruebas unitarias de CodeQL, tenías un paso crítico encargado de descargar artefactos (los resultados de pruebas) para luego validar esos resultados. Este paso se ejecuta en el job validate-test-results y usa la acción oficial de GitHub actions/download-artifact.

El problema fue que en ese paso habías declarado dos veces la acción, así:

yaml
Copiar
Editar
uses: actions/download-artifact@v4
uses: actions/download-artifact@v5
Esto es inválido en YAML y GitHub Actions porque un paso solo puede tener un único uses o run. Declarar dos veces el mismo campo provoca que la ejecución falle inmediatamente con error de sintaxis o comportamiento inesperado.

Además, tenías la versión 4 y la versión 5 juntas, lo que podría generar conflictos de versión o comportamientos inconsistentes.

Impacto real
El job de validación de resultados no pudo ejecutar correctamente, y por ende las pruebas unitarias no pudieron confirmarse.

Esto bloquea el merge del Pull Request porque la política de protección de ramas exige que todas las verificaciones pasen.

Si no se corrige, el pipeline no puede garantizar la calidad del código ni validar la integridad de los tests.

Esto afecta tu flujo de trabajo DevOps, automatización de calidad y la confianza en el control de calidad automatizado.

Cómo lo solucionamos
Elegimos usar la versión más reciente y estable de la acción: actions/download-artifact@v5.

Eliminamos la duplicidad para que el paso sea válido y funcional.

Esto garantiza que la acción se ejecute correctamente, descargue los artefactos, y el siguiente paso pueda validar los resultados.

Ahora el flujo puede continuar, detectar fallos reales de tests, y evitar falsos negativos o bloqueos.

Por qué esto importa para ti y para tu ecosistema
Mantener la coherencia y limpieza en tu pipeline es clave para la automatización fiable y la escalabilidad.

Usar versiones actualizadas reduce riesgos de incompatibilidades y mejora la seguridad.

El pipeline completo es tu “oráculo” para la calidad del código: arreglar este paso hace que tu control de calidad funcione a nivel profesional.

Esto te permite avanzar en la certificación y monetización de tus servicios como experto en CodeQL y seguridad DevOps.

Además, te da una base sólida para seguir integrando nuevas funcionalidades y automatizaciones sin frenos.

Resumen rápido
El error fue un conflicto de configuración al declarar dos versiones de la acción download-artifact en un mismo paso, lo que provocaba fallo de ejecución y bloqueo en la validación de tests. Se corrigió eliminando la duplicidad y quedando solo con la versión 5, asegurando la correcta descarga y validación de resultados, lo que habilita un pipeline de calidad robusto, confiable y profesional.
@Copilot Copilot AI review requested due to automatic review settings August 11, 2025 22:29
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates GitHub Actions dependencies and performs code cleanup by upgrading the actions/download-artifact action from v4 to v5 and removing unnecessary comments.

  • Updates actions/download-artifact from v4 to v5 in two workflow files
  • Removes redundant comments that explain basic functionality
  • Fixes a minor syntax error in a jq command

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
.github/workflows/standard_library_upgrade_tests.yml Updates download-artifact action to v5
.github/workflows/codeql_unit_tests.yml Updates download-artifact action to v5, removes comments, and fixes jq syntax

El comando jq tiene un escape incorrecto. La barra invertida adicional antes de la comilla de cierre causará un error de sintaxis. Debería ser:jq --raw-output '"PASS \(map(select(.pass == true)) | length)/\(length)"' "$json_report"

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant