Allow generated user config file to be outside the workspace

lib/config-utils.js

@@ -257,9 +257,15 @@ async function downloadCacheWithTime(trapCachingEnabled, codeQL, languages, logg
 async function loadConfig({ languagesInput, queriesInput, packsInput, buildModeInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeql, workspacePath, githubVersion, apiDetails, features, logger, }) {
     let parsedYAML;
     if (isLocal(configFile)) {
-        // Treat the config file as relative to the workspace
-        configFile = path.resolve(workspacePath, configFile);
-        parsedYAML = getLocalConfig(configFile, workspacePath);
+        if (configFile !== userConfigFromActionPath(tempDir)) {
+            // If the config file is not generated by the Action, it should be relative to the workspace.
+            configFile = path.resolve(workspacePath, configFile);
+            // Error if the config file is now outside of the workspace
+            if (!(configFile + path.sep).startsWith(workspacePath + path.sep)) {
+                throw new util_1.ConfigurationError(getConfigFileOutsideWorkspaceErrorMessage(configFile));
+            }
+        }
+        parsedYAML = getLocalConfig(configFile);
     }
     else {
         parsedYAML = await getRemoteConfig(configFile, apiDetails);
@@ -457,6 +463,9 @@ function shouldCombine(inputValue) {
 function dbLocationOrDefault(dbLocation, tempDir) {
     return dbLocation || path.resolve(tempDir, "codeql_databases");
 }
+function userConfigFromActionPath(tempDir) {
+    return path.resolve(tempDir, "user-config-from-action.yml");
+}
 /**
  * Load and return the config.
  *
@@ -471,7 +480,7 @@ async function initConfig(inputs) {
         if (inputs.configFile) {
             logger.warning(`Both a config file and config input were provided. Ignoring config file.`);
         }
-        inputs.configFile = path.resolve(tempDir, "user-config-from-action.yml");
+        inputs.configFile = userConfigFromActionPath(tempDir);
         fs.writeFileSync(inputs.configFile, inputs.configInput);
         logger.debug(`Using config from action input: ${inputs.configFile}`);
     }
@@ -506,11 +515,7 @@ function isLocal(configPath) {
     }
     return configPath.indexOf("@") === -1;
 }
-function getLocalConfig(configFile, workspacePath) {
-    // Error if the config file is now outside of the workspace
-    if (!(configFile + path.sep).startsWith(workspacePath + path.sep)) {
-        throw new util_1.ConfigurationError(getConfigFileOutsideWorkspaceErrorMessage(configFile));
-    }
+function getLocalConfig(configFile) {
     // Error if the file does not exist
     if (!fs.existsSync(configFile)) {
         throw new util_1.ConfigurationError(getConfigFileDoesNotExistErrorMessage(configFile));

src/config-utils.ts

@@ -543,9 +543,17 @@ async function loadConfig({
   let parsedYAML: UserConfig;
 
   if (isLocal(configFile)) {
-    // Treat the config file as relative to the workspace
-    configFile = path.resolve(workspacePath, configFile);
-    parsedYAML = getLocalConfig(configFile, workspacePath);
+    if (configFile !== userConfigFromActionPath(tempDir)) {
+      // If the config file is not generated by the Action, it should be relative to the workspace.
+      configFile = path.resolve(workspacePath, configFile);
+      // Error if the config file is now outside of the workspace
+      if (!(configFile + path.sep).startsWith(workspacePath + path.sep)) {
+        throw new ConfigurationError(
+          getConfigFileOutsideWorkspaceErrorMessage(configFile),
+        );
+      }
+    }
+    parsedYAML = getLocalConfig(configFile);
   } else {
     parsedYAML = await getRemoteConfig(configFile, apiDetails);
   }
@@ -823,6 +831,10 @@ function dbLocationOrDefault(
   return dbLocation || path.resolve(tempDir, "codeql_databases");
 }
 
+function userConfigFromActionPath(tempDir: string): string {
+  return path.resolve(tempDir, "user-config-from-action.yml");
+}
+
 /**
  * Load and return the config.
  *
@@ -841,7 +853,7 @@ export async function initConfig(inputs: InitConfigInputs): Promise<Config> {
         `Both a config file and config input were provided. Ignoring config file.`,
       );
     }
-    inputs.configFile = path.resolve(tempDir, "user-config-from-action.yml");
+    inputs.configFile = userConfigFromActionPath(tempDir);
     fs.writeFileSync(inputs.configFile, inputs.configInput);
     logger.debug(`Using config from action input: ${inputs.configFile}`);
   }
@@ -883,14 +895,7 @@ function isLocal(configPath: string): boolean {
   return configPath.indexOf("@") === -1;
 }
 
-function getLocalConfig(configFile: string, workspacePath: string): UserConfig {
-  // Error if the config file is now outside of the workspace
-  if (!(configFile + path.sep).startsWith(workspacePath + path.sep)) {
-    throw new ConfigurationError(
-      getConfigFileOutsideWorkspaceErrorMessage(configFile),
-    );
-  }
-
+function getLocalConfig(configFile: string): UserConfig {
   // Error if the file does not exist
   if (!fs.existsSync(configFile)) {
     throw new ConfigurationError(