check-expected-release-files.yml

name: Check Expected Release Files

on:
  pull_request:
    paths:
      - .github/workflows/check-expected-release-files.yml
      - src/defaults.json
    # Run checks on reopened draft PRs to support triggering PR checks on draft PRs that were opened
    # by other workflows.
    types: [opened, synchronize, reopened, ready_for_review]

concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
  group: ${{ github.workflow }}-${{ github.ref }}

defaults:
  run:
    shell: bash

jobs:
  check-expected-release-files:
    runs-on: ubuntu-slim

    permissions:
      contents: read

    steps:
      - name: Checkout CodeQL Action
        uses: actions/checkout@v6
      - name: Check Expected Release Files
        run: |
          bundle_version="$(cat "./src/defaults.json" | jq -r ".bundleVersion")"
          set -x
          for expected_file in "codeql-bundle.tar.gz" "codeql-bundle-linux64.tar.gz" "codeql-bundle-osx64.tar.gz" "codeql-bundle-win64.tar.gz"; do
            curl --location --fail --head --request GET "https://github.com/github/codeql-action/releases/download/$bundle_version/$expected_file" > /dev/null
          done