From e881f254f8b79834fe4dcfdd9de206092ab48a69 Mon Sep 17 00:00:00 2001
From: Lai Jiang <jianglai@google.com>
Date: Mon, 11 Mar 2024 14:55:13 -0400
Subject: [PATCH] Add a GitHub Action (#2360)

* Add a GitHub Action workflow

This allows us to create Gradle depedency graphs for Dependabot analysis (as the ones we already get for Javascript dependencies).

* Update Java version

* Add build scan

* codeql 3

* run with gradle

* exclude jIFC

* build scan

* Finalize
---
 .github/workflows/codeql.yml                | 23 +++++++++++++------
 .github/workflows/dependency-submission.yml | 25 +++++++++++++++++++++
 2 files changed, 41 insertions(+), 7 deletions(-)
 create mode 100644 .github/workflows/dependency-submission.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d1e1bc25a2a..923b7544954 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
     # The branches below must be a subset of the branches above
     branches: [ 'master' ]
   schedule:
-    - cron: '24 4 * * 2'
+    - cron: '24 4 * * *'
 
 jobs:
   analyze:
@@ -27,17 +27,17 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Set Java version
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         distribution: 'temurin'
         java-version: '21'
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -47,11 +47,20 @@ jobs:
         # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
         queries: security-and-quality
 
+    # Build with Gradle
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v3
+      with:
+        build-scan-publish: true
+        build-scan-terms-of-service-url: "https://gradle.com/terms-of-service"
+        build-scan-terms-of-service-agree: "yes"
+    - name: Execute Gradle build
+      run: ./gradlew build -x test -x jIFC
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+    #- name: Autobuild
+    #  uses: github/codeql-action/autobuild@v3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -64,6 +73,6 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
new file mode 100644
index 00000000000..e6e41a7e694
--- /dev/null
+++ b/.github/workflows/dependency-submission.yml
@@ -0,0 +1,25 @@
+name: Dependency Submission
+
+on:
+  push:
+    branches: [ 'master' ]
+  schedule:
+    - cron: '24 3 * * *'
+
+permissions:
+  contents: write
+
+jobs:
+
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Set Java version
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'temurin'
+        java-version: '21'
+    - name: Generate and submit dependency graph
+      uses: gradle/actions/dependency-submission@v3
\ No newline at end of file