Swift: add ARM build to CI, and other fixes

Also:
* removed the pretty much non-functioning bazel cache, will come back to
  it when we have a broader solution
* replaced sharing the extractor pack via cache with uploading and
  downloading it

.github/workflows/swift.yml

@@ -37,14 +37,19 @@ permissions:
   contents: read
 
 jobs:
-  # not using a matrix as you cannot depend on a specific job in a matrix, and we want to start linux checks
-  # without waiting for the macOS build
+  # not putting linux in the matrix as you cannot depend on a specific job in a matrix, and we want to start linux
+  # checks without waiting for the macOS build
   build-and-test-macos:
     if: github.repository_owner == 'github'
-    runs-on: macos-12-xl
+    strategy:
+      matrix:
+        runner: [macos-13-xlarge, macos-13-large]  # both ARM and Intel
+    runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v4
       - uses: ./swift/actions/build-and-test
+        with:
+          upload: ${{ matrix.runner == 'macos-13-large' }}
   build-and-test-linux:
     if: github.repository_owner == 'github'
     runs-on: ubuntu-latest-xl
@@ -61,7 +66,7 @@ jobs:
   qltests-macos:
     if: ${{ github.repository_owner == 'github' && github.event_name == 'pull_request' }}
     needs: build-and-test-macos
-    runs-on: macos-12-xl
+    runs-on: macos-13-xlarge
     steps:
       - uses: actions/checkout@v4
       - uses: ./swift/actions/run-ql-tests
@@ -75,7 +80,7 @@ jobs:
   integration-tests-macos:
     if: ${{ github.repository_owner == 'github' && github.event_name == 'pull_request' }}
     needs: build-and-test-macos
-    runs-on: macos-12-xl
+    runs-on: macos-13-xlarge
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4

swift/.python-version

@@ -1 +1 @@
-3.8.14
+3.11

swift/actions/build-and-test/action.yml

@@ -1,53 +1,21 @@
 name: Build Swift CodeQL pack
 description: Builds the Swift CodeQL pack
+inputs:
+  upload:
+    description: Whether to upload the extractor pack
+    default: true
 runs:
   using: composite
   steps:
     - uses: bazelbuild/setup-bazelisk@v2
     - uses: actions/setup-python@v4
       with:
         python-version-file: 'swift/.python-version'
-    # FIXME: this is copy-pasted from .github/actions/cache-query-compilation, but we cannot factor it out to a common
-    # composite action because of https://github.com/actions/runner/issues/2009 (cache fails to save in the post action
-    # phase because its inputs were lost in the meantime)
-    # calculate the merge-base with main, in a way that works both on PRs and pushes to main.
-    - name: Calculate merge-base
-      shell: bash
-      if: ${{ github.event_name == 'pull_request' }}
-      env:
-        BASE_BRANCH: ${{ github.base_ref }}
-      run: |
-        MERGE_BASE=$(git cat-file commit $GITHUB_SHA | grep '^parent ' | head -1 | cut -f 2 -d " ")
-        echo "merge_base=$MERGE_BASE" >> $GITHUB_ENV
-    - name: Restore read-only cache (PR)
-      if: ${{ github.event_name == 'pull_request' }}
-      uses: actions/cache/restore@v3
-      with:
-        path: 'bazel-cache'
-        key: bazel-pr-${{ github.sha }}
-        restore-keys: |
-          bazel-${{ github.base_ref }}-${{ env.merge_base }}
-          bazel-${{ github.base_ref }}-
-          bazel-main-
-    - name: Fill cache (push)
-      if: ${{ github.event_name != 'pull_request' }}
-      uses: actions/cache@v3
-      with:
-        path: 'bazel-cache'
-        key: bazel-${{ github.ref_name }}-${{ github.sha }} # just fill on main
-        restore-keys: | # restore the latest cache if the exact cache is unavailable, to speed up compilation.
-          bazel-${{ github.ref_name }}-
-          bazel-main-
     - name: Configure bazel
       shell: bash
       run: |
-        mkdir -p bazel-cache/{repository,disk}
-        echo build --repository_cache=bazel-cache/repository --disk_cache=bazel-cache/disk > local.bazelrc
+        echo > local.bazelrc
         echo test --test_output=errors >> local.bazelrc
-    # - name: Print unextracted entities
-    #   shell: bash
-    #   run: |
-    #     bazel run //swift/extractor/print_unextracted
     - uses: ./swift/actions/share-extractor-pack
     - name: Build Swift extractor
       shell: bash
@@ -63,10 +31,6 @@ runs:
       shell: bash
       run: |
         bazel test //swift/...
-    - name: Evict bazel cache
-      if: ${{ github.event_name != 'pull_request' }}
-      shell: bash
-      run: |
-        du -sh bazel-cache/*
-        find bazel-cache -atime +0 -type f -delete
-        du -sh bazel-cache/*
+    - name: Upload
+      if: inputs.upload == 'true'
+      uses: ./swift/actions/upload-extractor-pack

swift/actions/download-extractor-pack/action.yml

@@ -0,0 +1,13 @@
+name: Download Swift CodeQL pack
+description: Downloads the Swift CodeQL pack
+runs:
+  using: composite
+  steps:
+    - name: Download
+      uses: actions/download-artifact@v4
+      with:
+        name: swift-extractor-pack-${{ runner.os }}
+    - name: Extract
+      shell: bash
+      run: |
+        zstd -cd swift-extractor-pack-${{ runner.os }}.tar.zst | tar xvf -

swift/actions/run-integration-tests/action.yml

@@ -3,7 +3,7 @@ description: Builds the Swift CodeQL pack
 runs:
   using: composite
   steps:
-    - uses: ./swift/actions/share-extractor-pack
+    - uses: ./swift/actions/download-extractor-pack
     - uses: actions/setup-python@v4
       with:
         python-version-file: 'swift/.python-version'

swift/actions/run-ql-tests/action.yml

@@ -8,7 +8,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: ./swift/actions/share-extractor-pack
+    - uses: ./swift/actions/download-extractor-pack
     - uses: ./.github/actions/fetch-codeql
     - id: query-cache
       uses: ./.github/actions/cache-query-compilation

swift/actions/upload-extractor-pack/action.yml

@@ -0,0 +1,16 @@
+name: Upload Swift CodeQL pack
+description: Uploads the Swift CodeQL pack
+runs:
+  using: composite
+  steps:
+    - name: Compress
+      shell: bash
+      run: |
+        tar cf - swift/extractor-pack | zstd > swift-extractor-pack-${{ runner.os }}.tar.zst
+    - name: Upload
+      uses: actions/upload-artifact@v4
+      with:
+        name: swift-extractor-pack-${{ runner.os }}
+        path: swift-extractor-pack-${{ runner.os }}.tar.zst
+        compression-level: 0
+        retention-days: 3