PowerShell · TravisEz13 · Feb 5, 2025 · Feb 3, 2025
@@ -21,18 +21,12 @@ on:
       - master
       - release/**
       - feature*
-    paths:
-      - ".github/actions/**"
-      - ".github/workflows/linux-ci.yml"
-      - "**.props"
-      - build.psm1
-      - src/**
-      - test/**
-      - tools/buildCommon/**
-      - tools/ci.psm1
-      - tools/WindowsCI.psm1
-      - "!test/common/markdown/**"
-      - "!test/perf/**"
+# Path filters for PRs need to go into the changes job
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ contains(github.ref, 'merge')}}
+
 env:
   DOTNET_CLI_TELEMETRY_OPTOUT: 1
   DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
@@ -44,9 +38,37 @@ env:
   nugetMultiFeedWarnLevel: none
   system_debug: 'false'
 jobs:
+  changes:
+    name: Change Detection
+    runs-on: ubuntu-latest
+    # Required permissions
+    permissions:
+      pull-requests: read
+    # Set job outputs to values from filter step
+    outputs:
+      source: ${{ steps.filter.outputs.source }}
+    steps:
+    # For pull requests it's not necessary to checkout the code
+    - uses: dorny/paths-filter@v3
+      id: filter
+      with:
+        filters: |
+          source:
+            - ".github/actions/**"
+            - ".github/workflows/linux-ci.yml"
+            - "**.props"
+            - build.psm1
+            - src/**
+            - test/**
+            - tools/buildCommon/**
+            - tools/ci.psm1
+            - "!test/common/markdown/**"
+            - "!test/perf/**"
   ci_build:
     name: Build PowerShell
     runs-on: ubuntu-20.04
+    needs: changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     steps:
       - name: checkout
         uses: actions/[email protected]
@@ -56,7 +78,10 @@ jobs:
         uses: "./.github/actions/build/ci"
   linux_test_unelevated_ci:
     name: Linux Unelevated CI
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: ubuntu-20.04
     steps:
       - name: checkout
@@ -70,7 +95,10 @@ jobs:
           tagSet: CI
   linux_test_elevated_ci:
     name: Linux Elevated CI
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: ubuntu-20.04
     steps:
       - name: checkout
@@ -84,7 +112,10 @@ jobs:
           tagSet: CI
   linux_test_unelevated_others:
     name: Linux Unelevated Others
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: ubuntu-20.04
     steps:
       - name: checkout
@@ -98,7 +129,10 @@ jobs:
           tagSet: Others
   linux_test_elevated_others:
     name: Linux Elevated Others
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: ubuntu-20.04
     steps:
       - name: checkout
@@ -112,7 +146,10 @@ jobs:
           tagSet: Others
   verify_xunit:
     name: Verify xUnit test results
-    needs: ci_build
+    needs:
+      - ci_build
+      - changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
     runs-on: ubuntu-latest
     steps:
       - name: checkout
@@ -122,6 +159,74 @@ jobs:
       - name: Verify xUnit test results
         uses: "./.github/actions/test/verify_xunit"
 
+  analyze:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
+    name: Analyze
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Override automatic language detection by changing the below list
+        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
+        language: ['csharp']
+        # Learn more...
+        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        fetch-depth: '0'
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+    - run: |
+        Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
+      name: Capture Environment
+      shell: pwsh
+
+    - run: |
+        Import-Module .\tools\ci.psm1
+        Invoke-CIInstall -SkipUser
+      name: Bootstrap
+      shell: pwsh
+
+    - run: |
+        Import-Module .\tools\ci.psm1
+        Invoke-CIBuild
+      name: Build
+      shell: pwsh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
+
+  ready_to_merge:
+    name: Linux ready to merge
+    needs:
+      - verify_xunit
+      - linux_test_elevated_ci
+      - linux_test_elevated_others
+      - linux_test_unelevated_ci
+      - linux_test_unelevated_others
+      - analyze
+    if: always()
+    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@master
+    with:
+      needs_context: ${{ toJson(needs) }}
   # TODO: Enable this when we have a Linux packaging workflow
 
   # ERROR:  While executing gem ... (Gem::FilePermissionError)