github/codeql-action
0
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-05-04 12:50:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3149 from github/update-v3.30.4-e4b85ab65

Browse Source 
Merge main into releases/v3
This commit is contained in:
Ian Lynagh
2025-09-25 11:18:49 +01:00
committed by GitHub
parent 192325c861 333a673809
commit 397b4764c5
179 changed files with 7661 additions and 2579 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/actions/check-codescanning-config/index.ts
+12 -2
View File
@@ -6,6 +6,16 @@ import * as assert from 'assert'
const actualConfig = loadActualConfig()
function sortConfigArrays(config) {
for (const key of Object.keys(config)) {
const value = config[key];
if (key === 'queries' && Array.isArray(value)) {
config[key] = value.sort();
}
}
return config;
}
const rawExpectedConfig = process.argv[3].trim()
if (!rawExpectedConfig) {
core.setFailed('No expected configuration provided')
@@ -18,8 +28,8 @@ if (!rawExpectedConfig) {
const expectedConfig = rawExpectedConfig ? JSON.parse(rawExpectedConfig) : undefined;
assert.deepStrictEqual(
actualConfig,
expectedConfig,
sortConfigArrays(actualConfig),
sortConfigArrays(expectedConfig),
'Expected configuration does not match actual configuration'
);
.github/actions/prepare-test/action.yml
+10 -16
View File
@@ -2,7 +2,7 @@ name: "Prepare test"
description: Performs some preparation to run tests
inputs:
version:
description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'nightly', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
required: true
use-all-platform-bundle:
description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
@@ -35,7 +35,10 @@ runs:
run: |
set -e # Fail this Action if `gh release list` fails.
if [[ "$VERSION" == "linked" ]]; then
if [[ "$VERSION" == "nightly" || "$VERSION" == "nightly-latest" ]]; then
echo "tools-url=nightly" >> "$GITHUB_OUTPUT"
exit 0
elif [[ "$VERSION" == "linked" ]]; then
echo "tools-url=linked" >> "$GITHUB_OUTPUT"
exit 0
elif [[ "$VERSION" == "default" ]]; then
@@ -43,29 +46,20 @@ runs:
exit 0
fi
if [[ "$VERSION" == "nightly-latest" && "$RUNNER_OS" != "Windows" ]]; then
extension="tar.zst"
else
extension="tar.gz"
fi
if [[ "$USE_ALL_PLATFORM_BUNDLE" == "true" ]]; then
artifact_name="codeql-bundle.$extension"
artifact_name="codeql-bundle.tar.gz"
elif [[ "$RUNNER_OS" == "Linux" ]]; then
artifact_name="codeql-bundle-linux64.$extension"
artifact_name="codeql-bundle-linux64.tar.gz"
elif [[ "$RUNNER_OS" == "macOS" ]]; then
artifact_name="codeql-bundle-osx64.$extension"
artifact_name="codeql-bundle-osx64.tar.gz"
elif [[ "$RUNNER_OS" == "Windows" ]]; then
artifact_name="codeql-bundle-win64.$extension"
artifact_name="codeql-bundle-win64.tar.gz"
else
echo "::error::Unrecognized OS $RUNNER_OS"
exit 1
fi
if [[ "$VERSION" == "nightly-latest" ]]; then
tag=`gh release list --repo dsp-testing/codeql-cli-nightlies -L 1 | cut -f 3`
echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/$tag/$artifact_name" >> $GITHUB_OUTPUT
elif [[ "$VERSION" == *"nightly"* ]]; then
if [[ "$VERSION" == *"nightly"* ]]; then
version=`echo "$VERSION" | sed -e 's/^.*\-//'`
echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-$version/$artifact_name" >> $GITHUB_OUTPUT
elif [[ "$VERSION" == *"stable"* ]]; then
.github/codeql/codeql-actions-config.yml
-4
View File
@@ -1,4 +0,0 @@
# Configuration for the CodeQL Actions Queries
name: "CodeQL Actions Queries config"
queries:
- uses: security-and-quality
.github/codeql/codeql-config.yml → .github/codeql/codeql-config-javascript.yml
+2 -2
View File
@@ -7,9 +7,9 @@ queries:
# we include both even though one is a superset of the
# other, because we're testing the parsing logic and
# that the suites exist in the codeql bundle.
- uses: security-and-quality
- uses: security-experimental
- uses: security-extended
- uses: security-and-quality
paths-ignore:
- tests
- lib
- tests
.github/dependabot.yml
+5 -9
View File
@@ -20,18 +20,14 @@ updates:
patterns:
- "*"
- package-ecosystem: github-actions
directory: "/"
directories:
- "/.github/workflows"
- "/.github/actions"
schedule:
interval: weekly
labels:
- Rebuild
groups:
actions:
patterns:
- "*"
- package-ecosystem: github-actions
directory: "/.github/actions/setup-swift/" # All subdirectories outside of "/.github/workflows" must be explicitly included.
schedule:
interval: weekly
groups:
actions-setup-swift:
patterns:
- "*"
.github/workflows/__all-platform-bundle.yml
Generated
+8 -2
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
all-platform-bundle:
strategy:
@@ -43,6 +49,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: All-platform bundle
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -59,7 +66,7 @@ jobs:
use-all-platform-bundle: 'true'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -70,7 +77,6 @@ jobs:
languages: cpp,csharp,go,java,javascript,python,ruby
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
env:
.github/workflows/__analyze-ref-input.yml
Generated
+8 -2
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
analyze-ref-input:
strategy:
@@ -47,6 +53,7 @@ jobs:
- os: windows-latest
version: default
name: "Analyze: 'ref' and 'sha' from inputs"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -63,7 +70,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -74,7 +81,6 @@ jobs:
config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
github.sha }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
.github/workflows/__autobuild-action.yml
Generated
+7 -1
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
autobuild-action:
strategy:
@@ -37,6 +43,7 @@ jobs:
- os: windows-latest
version: linked
name: autobuild-action
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -67,7 +74,6 @@ jobs:
CORECLR_PROFILER_PATH_64: ''
- uses: ./../action/analyze
- name: Check database
shell: bash
run: |
cd "$RUNNER_TEMP/codeql_databases"
if [[ ! -d csharp ]]; then
.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
Generated
+7 -2
View File
@@ -34,6 +34,12 @@ on:
description: The version of Java to install
required: false
default: '17'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
autobuild-direct-tracing-with-working-dir:
strategy:
@@ -49,6 +55,7 @@ jobs:
- os: windows-latest
version: nightly-latest
name: Autobuild direct tracing (custom working directory)
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -70,7 +77,6 @@ jobs:
java-version: ${{ inputs.java-version || '17' }}
distribution: temurin
- name: Test setup
shell: bash
run: |
# Make sure that Gradle build succeeds in autobuild-dir ...
cp -a ../action/tests/java-repo autobuild-dir
@@ -82,7 +88,6 @@ jobs:
languages: java
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Check that indirect tracing is disabled
shell: bash
run: |
if [[ ! -z "${CODEQL_RUNNER}" ]]; then
echo "Expected indirect tracing to be disabled, but the" \
.github/workflows/__autobuild-direct-tracing.yml
Generated
+7 -2
View File
@@ -34,6 +34,12 @@ on:
description: The version of Java to install
required: false
default: '17'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
autobuild-direct-tracing:
strategy:
@@ -49,6 +55,7 @@ jobs:
- os: windows-latest
version: nightly-latest
name: Autobuild direct tracing
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -70,7 +77,6 @@ jobs:
java-version: ${{ inputs.java-version || '17' }}
distribution: temurin
- name: Set up Java test repo configuration
shell: bash
run: |
mv * .github ../action/tests/multi-language-repo/
mv ../action/tests/multi-language-repo/.github/workflows .github
@@ -85,7 +91,6 @@ jobs:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Check that indirect tracing is disabled
shell: bash
run: |
if [[ ! -z "${CODEQL_RUNNER}" ]]; then
echo "Expected indirect tracing to be disabled, but the" \
.github/workflows/__build-mode-autobuild.yml
Generated
+7
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
build-mode-autobuild:
strategy:
@@ -33,6 +39,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Build mode autobuild
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
.github/workflows/__build-mode-manual.yml
Generated
+8 -2
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
build-mode-manual:
strategy:
@@ -43,6 +49,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Build mode manual
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -59,7 +66,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -81,7 +88,6 @@ jobs:
fi
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
.github/workflows/__build-mode-none.yml
Generated
+7
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
build-mode-none:
strategy:
@@ -35,6 +41,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Build mode none
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
.github/workflows/__build-mode-rollback.yml
Generated
+7
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
build-mode-rollback:
strategy:
@@ -33,6 +39,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Build mode rollback
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
.github/workflows/__bundle-toolcache.yml
Generated
+10 -3
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
bundle-toolcache:
strategy:
@@ -37,6 +43,7 @@ jobs:
- os: windows-latest
version: linked
name: 'Bundle: Caching checks'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -53,7 +60,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Remove CodeQL from toolcache
uses: actions/github-script@v7
uses: actions/github-script@v8
with:
script: |
const fs = require('fs');
@@ -63,7 +70,7 @@ jobs:
- name: Install @actions/tool-cache
run: npm install @actions/tool-cache
- name: Check toolcache does not contain CodeQL
uses: actions/github-script@v7
uses: actions/github-script@v8
with:
script: |
const toolcache = require('@actions/tool-cache');
@@ -82,7 +89,7 @@ jobs:
output: ${{ runner.temp }}/results
upload-database: false
- name: Check CodeQL is installed within the toolcache
uses: actions/github-script@v7
uses: actions/github-script@v8
with:
script: |
const toolcache = require('@actions/tool-cache');
.github/workflows/__bundle-zstd.yml
Generated
+9 -2
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
bundle-zstd:
strategy:
@@ -37,6 +43,7 @@ jobs:
- os: windows-latest
version: linked
name: 'Bundle: Zstandard checks'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -53,7 +60,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Remove CodeQL from toolcache
uses: actions/github-script@v7
uses: actions/github-script@v8
with:
script: |
const fs = require('fs');
@@ -78,7 +85,7 @@ jobs:
path: ${{ runner.temp }}/results/javascript.sarif
retention-days: 7
- name: Check diagnostic with expected tools URL appears in SARIF
uses: actions/github-script@v7
uses: actions/github-script@v8
env:
SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
with:
.github/workflows/__cleanup-db-cluster-dir.yml
Generated
+7
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
cleanup-db-cluster-dir:
strategy:
@@ -33,6 +39,7 @@ jobs:
- os: ubuntu-latest
version: linked
name: Clean up database cluster directory
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
.github/workflows/__config-export.yml
Generated
+8 -1
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
config-export:
strategy:
@@ -43,6 +49,7 @@ jobs:
- os: windows-latest
version: nightly-latest
name: Config export
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -74,7 +81,7 @@ jobs:
path: ${{ runner.temp }}/results/javascript.sarif
retention-days: 7
- name: Check config properties appear in SARIF
uses: actions/github-script@v7
uses: actions/github-script@v8
env:
SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
with:
.github/workflows/__config-input.yml
Generated
+8 -1
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
config-input:
strategy:
@@ -33,6 +39,7 @@ jobs:
- os: ubuntu-latest
version: linked
name: Config input
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -42,7 +49,7 @@ jobs:
- name: Check out repository
uses: actions/checkout@v5
- name: Install Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v5
with:
node-version: 20.x
cache: npm
.github/workflows/__cpp-deptrace-disabled.yml
Generated
+8 -3
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
cpp-deptrace-disabled:
strategy:
@@ -37,6 +43,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: 'C/C++: disabling autoinstalling dependencies (Linux)'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -53,7 +60,6 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Test setup
shell: bash
run: |
cp -a ../action/tests/cpp-autobuild autobuild-dir
- uses: ./../action/init
@@ -65,8 +71,7 @@ jobs:
working-directory: autobuild-dir
env:
CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: false
- shell: bash
run: |
- run: |
if ls /usr/bin/errno; then
echo "C/C++ autobuild installed errno, but it should not have since auto-install dependencies is disabled."
exit 1
.github/workflows/__cpp-deptrace-enabled-on-macos.yml
Generated
+8 -3
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
cpp-deptrace-enabled-on-macos:
strategy:
@@ -35,6 +41,7 @@ jobs:
- os: macos-latest
version: nightly-latest
name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -51,7 +58,6 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Test setup
shell: bash
run: |
cp -a ../action/tests/cpp-autobuild autobuild-dir
- uses: ./../action/init
@@ -63,8 +69,7 @@ jobs:
working-directory: autobuild-dir
env:
CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: true
- shell: bash
run: |
- run: |
if ! ls /usr/bin/errno; then
echo "As expected, CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES is a no-op on macOS"
else
.github/workflows/__cpp-deptrace-enabled.yml
Generated
+8 -3
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
cpp-deptrace-enabled:
strategy:
@@ -37,6 +43,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: 'C/C++: autoinstalling dependencies (Linux)'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -53,7 +60,6 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Test setup
shell: bash
run: |
cp -a ../action/tests/cpp-autobuild autobuild-dir
- uses: ./../action/init
@@ -65,8 +71,7 @@ jobs:
working-directory: autobuild-dir
env:
CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: true
- shell: bash
run: |
- run: |
if ! ls /usr/bin/errno; then
echo "Did not autoinstall errno"
exit 1
.github/workflows/__diagnostics-export.yml
Generated
+8 -2
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
diagnostics-export:
strategy:
@@ -43,6 +49,7 @@ jobs:
- os: windows-latest
version: nightly-latest
name: Diagnostic export
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -64,7 +71,6 @@ jobs:
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Add test diagnostics
shell: bash
env:
CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
run: |
@@ -86,7 +92,7 @@ jobs:
path: ${{ runner.temp }}/results/javascript.sarif
retention-days: 7
- name: Check diagnostics appear in SARIF
uses: actions/github-script@v7
uses: actions/github-script@v8
env:
SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
with:
.github/workflows/__export-file-baseline-information.yml
Generated
+8 -3
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
export-file-baseline-information:
strategy:
@@ -47,6 +53,7 @@ jobs:
- os: windows-latest
version: nightly-latest
name: Export file baseline information
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -63,7 +70,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -73,7 +80,6 @@ jobs:
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
@@ -85,7 +91,6 @@ jobs:
path: ${{ runner.temp }}/results/javascript.sarif
retention-days: 7
- name: Check results
shell: bash
run: |
cd "$RUNNER_TEMP/results"
expected_baseline_languages="c csharp go java kotlin javascript python ruby"
.github/workflows/__extractor-ram-threads.yml
Generated
+7 -1
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
extractor-ram-threads:
strategy:
@@ -33,6 +39,7 @@ jobs:
- os: ubuntu-latest
version: linked
name: Extractor ram and threads options test
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -54,7 +61,6 @@ jobs:
ram: 230
threads: 1
- name: Assert Results
shell: bash
run: |
if [ "${CODEQL_RAM}" != "230" ]; then
echo "CODEQL_RAM is '${CODEQL_RAM}' instead of 230"
.github/workflows/__go-custom-queries.yml
Generated
+8 -2
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
go-custom-queries:
strategy:
@@ -45,6 +51,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: 'Go: Custom queries'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -61,7 +68,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -71,7 +78,6 @@ jobs:
config-file: ./.github/codeql/custom-queries.yml
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
env:
.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
Generated
+10 -4
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
go-indirect-tracing-workaround-diagnostic:
strategy:
@@ -43,6 +49,7 @@ jobs:
- os: ubuntu-latest
version: default
name: 'Go: diagnostic when Go is changed after init step'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -59,7 +66,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -68,18 +75,17 @@ jobs:
languages: go
tools: ${{ steps.prepare-test.outputs.tools-url }}
# Deliberately change Go after the `init` step
- uses: actions/setup-go@v5
- uses: actions/setup-go@v6
with:
go-version: '1.20'
- name: Build code
shell: bash
run: go build main.go
- uses: ./../action/analyze
with:
output: ${{ runner.temp }}/results
upload-database: false
- name: Check diagnostic appears in SARIF
uses: actions/github-script@v7
uses: actions/github-script@v8
env:
SARIF_PATH: ${{ runner.temp }}/results/go.sarif
with:
.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
Generated
+9 -3
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
go-indirect-tracing-workaround-no-file-program:
strategy:
@@ -43,6 +49,7 @@ jobs:
- os: ubuntu-latest
version: default
name: 'Go: diagnostic when `file` is not installed'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -59,7 +66,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -73,14 +80,13 @@ jobs:
languages: go
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: go build main.go
- uses: ./../action/analyze
with:
output: ${{ runner.temp }}/results
upload-database: false
- name: Check diagnostic appears in SARIF
uses: actions/github-script@v7
uses: actions/github-script@v8
env:
SARIF_PATH: ${{ runner.temp }}/results/go.sarif
with:
.github/workflows/__go-indirect-tracing-workaround.yml
Generated
+9 -4
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
go-indirect-tracing-workaround:
strategy:
@@ -43,6 +49,7 @@ jobs:
- os: ubuntu-latest
version: default
name: 'Go: workaround for indirect tracing'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -59,7 +66,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -68,11 +75,9 @@ jobs:
languages: go
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: go build main.go
- uses: ./../action/analyze
- shell: bash
run: |
- run: |
if [[ -z "${CODEQL_ACTION_GO_BINARY}" ]]; then
echo "Expected the workaround for indirect tracing of static binaries to trigger, but the" \
"CODEQL_ACTION_GO_BINARY environment variable is not set."
.github/workflows/__go-tracing-autobuilder.yml
Generated
+13 -3
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
go-tracing-autobuilder:
strategy:
@@ -60,6 +66,10 @@ jobs:
version: stable-v2.21.4
- os: macos-latest
version: stable-v2.21.4
- os: ubuntu-latest
version: stable-v2.22.4
- os: macos-latest
version: stable-v2.22.4
- os: ubuntu-latest
version: default
- os: macos-latest
@@ -73,6 +83,7 @@ jobs:
- os: macos-latest
version: nightly-latest
name: 'Go: tracing with autobuilder step'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -89,7 +100,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -99,8 +110,7 @@ jobs:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/autobuild
- uses: ./../action/analyze
- shell: bash
run: |
- run: |
if [[ "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" != true ]]; then
echo "Expected the Go autobuilder to be run, but the" \
"CODEQL_ACTION_DID_AUTOBUILD_GOLANG environment variable was not true."
.github/workflows/__go-tracing-custom-build-steps.yml
Generated
+13 -4
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
go-tracing-custom-build-steps:
strategy:
@@ -60,6 +66,10 @@ jobs:
version: stable-v2.21.4
- os: macos-latest
version: stable-v2.21.4
- os: ubuntu-latest
version: stable-v2.22.4
- os: macos-latest
version: stable-v2.22.4
- os: ubuntu-latest
version: default
- os: macos-latest
@@ -73,6 +83,7 @@ jobs:
- os: macos-latest
version: nightly-latest
name: 'Go: tracing with custom build steps'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -89,7 +100,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -98,11 +109,9 @@ jobs:
languages: go
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: go build main.go
- uses: ./../action/analyze
- shell: bash
run: |
- run: |
# Once we start running Bash 4.2 in all environments, we can replace the
# `! -z` flag with the more elegant `-v` which confirms that the variable
# is actually unset and not potentially set to a blank value.
.github/workflows/__go-tracing-legacy-workflow.yml
Generated
+13 -3
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
go-tracing-legacy-workflow:
strategy:
@@ -60,6 +66,10 @@ jobs:
version: stable-v2.21.4
- os: macos-latest
version: stable-v2.21.4
- os: ubuntu-latest
version: stable-v2.22.4
- os: macos-latest
version: stable-v2.22.4
- os: ubuntu-latest
version: default
- os: macos-latest
@@ -73,6 +83,7 @@ jobs:
- os: macos-latest
version: nightly-latest
name: 'Go: tracing with legacy workflow'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -89,7 +100,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -98,8 +109,7 @@ jobs:
languages: go
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
- shell: bash
run: |
- run: |
cd "$RUNNER_TEMP/codeql_databases"
if [[ ! -d go ]]; then
echo "Did not find a Go database"
.github/workflows/__init-with-registries.yml
Generated
+7 -3
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
init-with-registries:
strategy:
@@ -49,6 +55,7 @@ jobs:
- os: windows-latest
version: nightly-latest
name: 'Packaging: Download using registries'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
packages: read
@@ -78,7 +85,6 @@ jobs:
token: "${{ secrets.GITHUB_TOKEN }}"
- name: Verify packages installed
shell: bash
run: |
PRIVATE_PACK="$HOME/.codeql/packages/codeql-testing/private-pack"
CODEQL_PACK1="$HOME/.codeql/packages/codeql-testing/codeql-pack1"
@@ -100,7 +106,6 @@ jobs:
fi
- name: Verify qlconfig.yml file was created
shell: bash
run: |
QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
echo "Expected qlconfig.yml file to be created at $QLCONFIG_PATH"
@@ -115,7 +120,6 @@ jobs:
- name: Verify contents of qlconfig.yml
# yq is not available on windows
if: runner.os != 'Windows'
shell: bash
run: |
QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
cat $QLCONFIG_PATH | yq -e '.registries[] | select(.url == "https://ghcr.io/v2/") | select(.packages == "*/*")'
.github/workflows/__javascript-source-root.yml
Generated
+7 -2
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
javascript-source-root:
strategy:
@@ -37,6 +43,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Custom source root
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -53,7 +60,6 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Move codeql-action
shell: bash
run: |
mkdir ../new-source-root
mv * ../new-source-root
@@ -66,7 +72,6 @@ jobs:
with:
skip-queries: true
- name: Assert database exists
shell: bash
run: |
cd "$RUNNER_TEMP/codeql_databases"
if [[ ! -d javascript ]]; then
.github/workflows/__job-run-uuid-sarif.yml
Generated
+7 -1
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
job-run-uuid-sarif:
strategy:
@@ -33,6 +39,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Job run UUID added to SARIF
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -63,7 +70,6 @@ jobs:
path: ${{ runner.temp }}/results/javascript.sarif
retention-days: 7
- name: Check results
shell: bash
run: |
cd "$RUNNER_TEMP/results"
actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)
.github/workflows/__language-aliases.yml
Generated
+7
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
language-aliases:
strategy:
@@ -33,6 +39,7 @@ jobs:
- os: ubuntu-latest
version: linked
name: Language aliases
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
.github/workflows/__multi-language-autodetect.yml
Generated
+13 -5
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
multi-language-autodetect:
strategy:
@@ -60,6 +66,10 @@ jobs:
version: stable-v2.21.4
- os: ubuntu-latest
version: stable-v2.21.4
- os: macos-latest
version: stable-v2.22.4
- os: ubuntu-latest
version: stable-v2.22.4
- os: macos-latest
version: default
- os: ubuntu-latest
@@ -73,6 +83,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Multi-language repository
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -89,12 +100,11 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
- name: Use Xcode 16
shell: bash
if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
run: sudo xcode-select -s "/Applications/Xcode_16.app"
@@ -107,7 +117,6 @@ jobs:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
@@ -116,7 +125,6 @@ jobs:
upload-database: false
- name: Check language autodetect for all languages excluding Swift
shell: bash
run: |
CPP_DB=${{ fromJson(steps.analysis.outputs.db-locations).cpp }}
if [[ ! -d $CPP_DB ]] || [[ ! $CPP_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
@@ -156,7 +164,6 @@ jobs:
- name: Check language autodetect for Swift on macOS
if: runner.os == 'macOS'
shell: bash
run: |
SWIFT_DB=${{ fromJson(steps.analysis.outputs.db-locations).swift }}
if [[ ! -d $SWIFT_DB ]] || [[ ! $SWIFT_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
@@ -164,4 +171,5 @@ jobs:
exit 1
fi
env:
CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
CODEQL_ACTION_TEST_MODE: true
.github/workflows/__overlay-init-fallback.yml
Generated
+7 -1
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
overlay-init-fallback:
strategy:
@@ -35,6 +41,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Overlay database init fallback
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -61,7 +68,6 @@ jobs:
with:
upload-database: false
- name: Check database
shell: bash
run: |
cd "$RUNNER_TEMP/codeql_databases/actions"
if ! grep -q 'overlayBaseDatabase: false' codeql-database.yml ; then
.github/workflows/__packaging-codescanning-config-inputs-js.yml
Generated
+9 -4
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
packaging-codescanning-config-inputs-js:
strategy:
@@ -59,6 +65,7 @@ jobs:
- os: windows-latest
version: nightly-latest
name: 'Packaging: Config and input passed to the CLI'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -68,7 +75,7 @@ jobs:
- name: Check out repository
uses: actions/checkout@v5
- name: Install Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v5
with:
node-version: 20.x
cache: npm
@@ -82,7 +89,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -93,7 +100,6 @@ jobs:
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
@@ -109,7 +115,6 @@ jobs:
queries-not-run: foo,bar
- name: Assert Results
shell: bash
run: |
cd "$RUNNER_TEMP/results"
# We should have 4 hits from these rules
.github/workflows/__packaging-config-inputs-js.yml
Generated
+9 -4
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
packaging-config-inputs-js:
strategy:
@@ -59,6 +65,7 @@ jobs:
- os: windows-latest
version: nightly-latest
name: 'Packaging: Config and input'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -68,7 +75,7 @@ jobs:
- name: Check out repository
uses: actions/checkout@v5
- name: Install Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v5
with:
node-version: 20.x
cache: npm
@@ -82,7 +89,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -93,7 +100,6 @@ jobs:
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
@@ -109,7 +115,6 @@ jobs:
queries-not-run: foo,bar
- name: Assert Results
shell: bash
run: |
cd "$RUNNER_TEMP/results"
# We should have 4 hits from these rules
.github/workflows/__packaging-config-js.yml
Generated
+9 -4
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
packaging-config-js:
strategy:
@@ -59,6 +65,7 @@ jobs:
- os: windows-latest
version: nightly-latest
name: 'Packaging: Config file'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -68,7 +75,7 @@ jobs:
- name: Check out repository
uses: actions/checkout@v5
- name: Install Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v5
with:
node-version: 20.x
cache: npm
@@ -82,7 +89,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -92,7 +99,6 @@ jobs:
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
@@ -108,7 +114,6 @@ jobs:
queries-not-run: foo,bar
- name: Assert Results
shell: bash
run: |
cd "$RUNNER_TEMP/results"
# We should have 4 hits from these rules
.github/workflows/__packaging-inputs-js.yml
Generated
+9 -4
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
packaging-inputs-js:
strategy:
@@ -59,6 +65,7 @@ jobs:
- os: windows-latest
version: nightly-latest
name: 'Packaging: Action input'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -68,7 +75,7 @@ jobs:
- name: Check out repository
uses: actions/checkout@v5
- name: Install Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v5
with:
node-version: 20.x
cache: npm
@@ -82,7 +89,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -93,7 +100,6 @@ jobs:
packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
@@ -108,7 +114,6 @@ jobs:
queries-not-run: foo,bar
- name: Assert Results
shell: bash
run: |
cd "$RUNNER_TEMP/results"
# We should have 4 hits from these rules
.github/workflows/__quality-queries.yml
Generated
+9 -2
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
quality-queries:
strategy:
@@ -85,6 +91,7 @@ jobs:
version: nightly-latest
analysis-kinds: code-scanning,code-quality
name: Quality queries input
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -127,7 +134,7 @@ jobs:
retention-days: 7
- name: Check quality query does not appear in security SARIF
if: contains(matrix.analysis-kinds, 'code-scanning')
uses: actions/github-script@v7
uses: actions/github-script@v8
env:
SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
EXPECT_PRESENT: 'false'
@@ -135,7 +142,7 @@ jobs:
script: ${{ env.CHECK_SCRIPT }}
- name: Check quality query appears in quality SARIF
if: contains(matrix.analysis-kinds, 'code-quality')
uses: actions/github-script@v7
uses: actions/github-script@v8
env:
SARIF_PATH: ${{ runner.temp }}/results/javascript.quality.sarif
EXPECT_PRESENT: 'true'
.github/workflows/__remote-config.yml
Generated
+8 -2
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
remote-config:
strategy:
@@ -45,6 +51,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Remote config file
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -61,7 +68,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -72,7 +79,6 @@ jobs:
config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
github.sha }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
env:
.github/workflows/__resolve-environment-action.yml
Generated
+7
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
resolve-environment-action:
strategy:
@@ -49,6 +55,7 @@ jobs:
- os: windows-latest
version: nightly-latest
name: Resolve environment
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
.github/workflows/__rubocop-multi-language.yml
Generated
+8 -4
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
rubocop-multi-language:
strategy:
@@ -33,6 +39,7 @@ jobs:
- os: ubuntu-latest
version: default
name: RuboCop multi-language
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -49,17 +56,14 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Set up Ruby
uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
with:
ruby-version: 2.6
- name: Install Code Scanning integration
shell: bash
run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
- name: Install dependencies
shell: bash
run: bundle install
- name: RuboCop run
shell: bash
run: |
bash -c "
bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
.github/workflows/__ruby.yml
Generated
+7 -1
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
ruby:
strategy:
@@ -43,6 +49,7 @@ jobs:
- os: macos-latest
version: nightly-latest
name: Ruby analysis
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -67,7 +74,6 @@ jobs:
with:
upload-database: false
- name: Check database
shell: bash
run: |
RUBY_DB="${{ fromJson(steps.analysis.outputs.db-locations).ruby }}"
if [[ ! -d "$RUBY_DB" ]]; then
.github/workflows/__rust.yml
Generated
+7 -1
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
rust:
strategy:
@@ -41,6 +47,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Rust analysis
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -65,7 +72,6 @@ jobs:
with:
upload-database: false
- name: Check database
shell: bash
run: |
RUST_DB="${{ fromJson(steps.analysis.outputs.db-locations).rust }}"
if [[ ! -d "$RUST_DB" ]]; then
.github/workflows/__split-workflow.yml
Generated
+8 -4
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
split-workflow:
strategy:
@@ -53,6 +59,7 @@ jobs:
- os: macos-latest
version: nightly-latest
name: Split workflow
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -69,7 +76,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -80,7 +87,6 @@ jobs:
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
@@ -89,7 +95,6 @@ jobs:
upload-database: false
- name: Assert No Results
shell: bash
run: |
if [ "$(ls -A $RUNNER_TEMP/results)" ]; then
echo "Expected results directory to be empty after skipping query execution!"
@@ -100,7 +105,6 @@ jobs:
output: ${{ runner.temp }}/results
upload-database: false
- name: Assert Results
shell: bash
run: |
cd "$RUNNER_TEMP/results"
# We should have 4 hits from these rules
.github/workflows/__start-proxy.yml
Generated
+7
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
start-proxy:
strategy:
@@ -37,6 +43,7 @@ jobs:
- os: windows-latest
version: linked
name: Start proxy
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
.github/workflows/__submit-sarif-failure.yml
Generated
+7
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
submit-sarif-failure:
strategy:
@@ -37,6 +43,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Submit SARIF after failure
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: write # needed to upload the SARIF file
.github/workflows/__swift-autobuild.yml
Generated
+7 -2
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
swift-autobuild:
strategy:
@@ -33,6 +39,7 @@ jobs:
- os: macos-latest
version: nightly-latest
name: Swift analysis using autobuild
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -55,7 +62,6 @@ jobs:
build-mode: autobuild
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Check working directory
shell: bash
run: pwd
- uses: ./../action/autobuild
timeout-minutes: 30
@@ -64,7 +70,6 @@ jobs:
with:
upload-database: false
- name: Check database
shell: bash
run: |
SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
if [[ ! -d "$SWIFT_DB" ]]; then
.github/workflows/__swift-custom-build.yml
Generated
+8 -5
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
swift-custom-build:
strategy:
@@ -47,6 +53,7 @@ jobs:
- os: macos-latest
version: nightly-latest
name: Swift analysis using a custom build command
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -63,12 +70,11 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
- name: Use Xcode 16
shell: bash
if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
run: sudo xcode-select -s "/Applications/Xcode_16.app"
- uses: ./../action/init
@@ -77,17 +83,14 @@ jobs:
languages: swift
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Check working directory
shell: bash
run: pwd
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
id: analysis
with:
upload-database: false
- name: Check database
shell: bash
run: |
SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
if [[ ! -d "$SWIFT_DB" ]]; then
.github/workflows/__test-autobuild-working-dir.yml
Generated
+7 -2
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
test-autobuild-working-dir:
strategy:
@@ -33,6 +39,7 @@ jobs:
- os: ubuntu-latest
version: linked
name: Autobuild working directory
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -49,7 +56,6 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Test setup
shell: bash
run: |
# Make sure that Gradle build succeeds in autobuild-dir ...
cp -a ../action/tests/java-repo autobuild-dir
@@ -64,7 +70,6 @@ jobs:
working-directory: autobuild-dir
- uses: ./../action/analyze
- name: Check database
shell: bash
run: |
cd "$RUNNER_TEMP/codeql_databases"
if [[ ! -d java ]]; then
.github/workflows/__test-local-codeql.yml
Generated
+11 -8
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
test-local-codeql:
strategy:
@@ -41,8 +47,9 @@ jobs:
matrix:
include:
- os: ubuntu-latest
version: nightly-latest
version: linked
name: Local CodeQL bundle
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -59,16 +66,13 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
- name: Fetch a CodeQL bundle
shell: bash
env:
CODEQL_URL: ${{ steps.prepare-test.outputs.tools-url }}
- name: Fetch latest CodeQL bundle
run: |
wget "$CODEQL_URL"
wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst
- id: init
uses: ./../action/init
with:
@@ -76,7 +80,6 @@ jobs:
languages: cpp,csharp,go,java,javascript,python,ruby
tools: ./codeql-bundle-linux64.tar.zst
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
env:
.github/workflows/__test-proxy.yml
Generated
+7
View File
@@ -24,6 +24,12 @@ on:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
test-proxy:
strategy:
@@ -35,6 +41,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Proxy test
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
.github/workflows/__unset-environment.yml
Generated
+9 -4
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
unset-environment:
strategy:
@@ -45,6 +51,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: Test unsetting environment variables
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -61,7 +68,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -73,14 +80,12 @@ jobs:
languages: cpp,csharp,go,java,javascript,python,ruby
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: env -i PATH="$PATH" HOME="$HOME" ./build.sh
- uses: ./../action/analyze
id: analysis
with:
upload-database: false
- shell: bash
run: |
- run: |
CPP_DB="${{ fromJson(steps.analysis.outputs.db-locations).cpp }}"
if [[ ! -d "$CPP_DB" ]] || [[ ! "$CPP_DB" == "${RUNNER_TEMP}/customDbLocation/cpp" ]]; then
echo "::error::Did not create a database for CPP, or created it in the wrong location." \
.github/workflows/__upload-quality-sarif.yml
Generated
+14 -6
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
upload-quality-sarif:
strategy:
@@ -47,6 +53,7 @@ jobs:
- os: windows-latest
version: default
name: 'Upload-sarif: code quality endpoint'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -63,19 +70,16 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
- uses: ./../action/init
with:
tools: ${{ steps.prepare-test.outputs.tools-url }}
languages: cpp,csharp,java,javascript,python
config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
github.sha }}
analysis-kinds: code-scanning,code-quality
languages: csharp,java,javascript,python
analysis-kinds: code-quality
- name: Build code
shell: bash
run: ./build.sh
# Generate some SARIF we can upload with the upload-sarif step
- uses: ./../action/analyze
@@ -84,8 +88,12 @@ jobs:
sha: 5e235361806c361d4d3f8859e3c897658025a9a2
upload: never
- uses: ./../action/upload-sarif
id: upload-sarif
with:
ref: refs/heads/main
sha: 5e235361806c361d4d3f8859e3c897658025a9a2
- name: Check output from `upload-sarif` step
if: fromJSON(steps.upload-sarif.outputs.sarif-ids)[0].analysis != 'code-quality'
run: exit 1
env:
CODEQL_ACTION_TEST_MODE: true
.github/workflows/__upload-ref-sha-input.yml
Generated
+8 -2
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
upload-ref-sha-input:
strategy:
@@ -47,6 +53,7 @@ jobs:
- os: windows-latest
version: default
name: "Upload-sarif: 'ref' and 'sha' from inputs"
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -63,7 +70,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
@@ -74,7 +81,6 @@ jobs:
config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
github.sha }}
- name: Build code
shell: bash
run: ./build.sh
# Generate some SARIF we can upload with the upload-sarif step
- uses: ./../action/analyze
.github/workflows/__with-checkout-path.yml
Generated
+8 -4
View File
@@ -34,6 +34,12 @@ on:
description: The version of Go to install
required: false
default: '>=1.21.0'
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
group: ${{ github.workflow }}-${{ github.ref }}
jobs:
with-checkout-path:
strategy:
@@ -47,6 +53,7 @@ jobs:
- os: windows-latest
version: linked
name: Use a custom `checkout_path`
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -63,12 +70,11 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
uses: actions/setup-go@v6
with:
go-version: ${{ inputs.go-version || '>=1.21.0' }}
cache: false
- name: Delete original checkout
shell: bash
run: |
# delete the original checkout so we don't accidentally use it.
# Actions does not support deleting the current working directory, so we
@@ -89,7 +95,6 @@ jobs:
source-root: x/y/z/some-path/tests/multi-language-repo
- name: Build code
shell: bash
working-directory: x/y/z/some-path/tests/multi-language-repo
run: |
./build.sh
@@ -101,7 +106,6 @@ jobs:
sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
- name: Verify SARIF after upload
shell: bash
run: |
EXPECTED_COMMIT_OID="474bbf07f9247ffe1856c6a0f94aeeb10e7afee6"
EXPECTED_REF="v1.1.0"
.github/workflows/check-expected-release-files.yml
+4
View File
@@ -9,6 +9,10 @@ on:
# by other workflows.
types: [opened, synchronize, reopened, ready_for_review]
defaults:
run:
shell: bash
jobs:
check-expected-release-files:
runs-on: ubuntu-latest
.github/workflows/codeql.yml
+27 -7
View File
@@ -13,12 +13,17 @@ on:
- cron: '30 1 * * 0'
workflow_dispatch:
defaults:
run:
shell: bash
env:
CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
jobs:
# Identify the CodeQL tool versions to use in the analysis job.
check-codeql-versions:
if: github.triggering_actor != 'dependabot[bot]'
runs-on: ubuntu-latest
outputs:
versions: ${{ steps.compare.outputs.versions }}
@@ -71,6 +76,7 @@ jobs:
echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
analyze-javascript:
if: github.triggering_actor != 'dependabot[bot]'
needs: [check-codeql-versions]
strategy:
fail-fast: false
@@ -91,22 +97,30 @@ jobs:
id: init
with:
languages: javascript
config-file: ./.github/codeql/codeql-config.yml
config-file: ./.github/codeql/codeql-config-javascript.yml
tools: ${{ matrix.tools }}
# confirm steps.init.outputs.codeql-path points to the codeql binary
- name: Print CodeQL Version
run: ${{steps.init.outputs.codeql-path}} version --format=json
run: >
"$CODEQL" version --format=json
env:
CODEQL: ${{steps.init.outputs.codeql-path}}
- name: Perform CodeQL Analysis
uses: ./analyze
with:
category: "/language:javascript"
upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && 'always') || 'never' }}
analyze-actions:
analyze-other:
if: github.triggering_actor != 'dependabot[bot]'
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
include:
- language: actions
- language: python
permissions:
contents: read
@@ -118,9 +132,15 @@ jobs:
- name: Initialize CodeQL
uses: ./init
with:
languages: actions
config-file: ./.github/codeql/codeql-actions-config.yml
languages: ${{ matrix.language }}
build-mode: none
config: >
paths-ignore:
- lib
- tests
queries:
- uses: security-and-quality
- name: Perform CodeQL Analysis
uses: ./analyze
with:
category: "/language:actions"
category: "/language:${{ matrix.language }}"
.github/workflows/codescanning-config-cli.yml
+11 -6
View File
@@ -22,8 +22,13 @@ on:
- cron: '0 5 * * *'
workflow_dispatch: {}
defaults:
run:
shell: bash
jobs:
code-scanning-config-tests:
if: github.triggering_actor != 'dependabot[bot]'
continue-on-error: true
permissions:
@@ -57,7 +62,7 @@ jobs:
uses: actions/checkout@v5
- name: Set up Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v5
with:
node-version: '20'
cache: 'npm'
@@ -176,13 +181,13 @@ jobs:
with:
expected-config-file-contents: |
{
"queries": [
{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" },
{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }
],
"packs": {
"javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
}
},
"queries": [
{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
]
}
languages: javascript
queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
.github/workflows/debug-artifacts-failure-safe.yml
+8 -3
View File
@@ -17,8 +17,14 @@ on:
schedule:
- cron: '0 5 * * *'
workflow_dispatch: {}
defaults:
run:
shell: bash
jobs:
upload-artifacts:
if: github.triggering_actor != 'dependabot[bot]'
strategy:
fail-fast: false
matrix:
@@ -45,7 +51,7 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
- uses: actions/setup-go@v5
- uses: actions/setup-go@v6
with:
go-version: ^1.13.1
- uses: ./../action/init
@@ -55,7 +61,6 @@ jobs:
debug-artifact-name: my-debug-artifacts
debug-database-name: my-db
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
id: analysis
@@ -66,6 +71,7 @@ jobs:
expect-error: true
download-and-check-artifacts:
name: Download and check debug artifacts after failure in analyze
if: github.triggering_actor != 'dependabot[bot]'
needs: upload-artifacts
timeout-minutes: 45
permissions:
@@ -75,7 +81,6 @@ jobs:
- name: Download all artifacts
uses: actions/download-artifact@v5
- name: Check expected artifacts exist
shell: bash
run: |
LANGUAGES="cpp csharp go java javascript python"
for version in $VERSIONS; do
.github/workflows/debug-artifacts-safe.yml
+8 -3
View File
@@ -16,8 +16,14 @@ on:
schedule:
- cron: '0 5 * * *'
workflow_dispatch: {}
defaults:
run:
shell: bash
jobs:
upload-artifacts:
if: github.triggering_actor != 'dependabot[bot]'
strategy:
fail-fast: false
matrix:
@@ -41,7 +47,7 @@ jobs:
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
- uses: actions/setup-go@v5
- uses: actions/setup-go@v6
with:
go-version: ^1.13.1
- uses: ./../action/init
@@ -54,12 +60,12 @@ jobs:
# We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
languages: cpp,csharp,go,java,javascript,python,ruby
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
id: analysis
download-and-check-artifacts:
name: Download and check debug artifacts
if: github.triggering_actor != 'dependabot[bot]'
needs: upload-artifacts
timeout-minutes: 45
permissions:
@@ -69,7 +75,6 @@ jobs:
- name: Download all artifacts
uses: actions/download-artifact@v5
- name: Check expected artifacts exist
shell: bash
run: |
VERSIONS="stable-v2.20.3 default linked nightly-latest"
LANGUAGES="cpp csharp go java javascript python"
.github/workflows/post-release-mergeback.yml
+6 -2
View File
@@ -18,6 +18,10 @@ on:
branches:
- releases/v*
defaults:
run:
shell: bash
jobs:
merge-back:
runs-on: ubuntu-latest
@@ -43,7 +47,7 @@ jobs:
- uses: actions/checkout@v5
with:
fetch-depth: 0 # ensure we have all tags and can push commits
- uses: actions/setup-node@v4
- uses: actions/setup-node@v5
- name: Update git config
run: |
@@ -135,7 +139,7 @@ jobs:
token: "${{ secrets.GITHUB_TOKEN }}"
- name: Generate token
uses: actions/create-github-app-token@v2.1.1
uses: actions/create-github-app-token@v2.1.4
id: app-token
with:
app-id: ${{ vars.AUTOMATION_APP_ID }}
.github/workflows/pr-checks.yml
+17 -4
View File
@@ -8,9 +8,14 @@ on:
types: [opened, synchronize, reopened, ready_for_review]
workflow_dispatch:
defaults:
run:
shell: bash
jobs:
unit-tests:
name: Unit Tests
if: github.triggering_actor != 'dependabot[bot]'
strategy:
fail-fast: false
matrix:
@@ -22,16 +27,20 @@ jobs:
timeout-minutes: 45
steps:
- name: Prepare git (Windows)
if: runner.os == 'Windows'
run: git config --global core.autocrlf false
- uses: actions/checkout@v5
- name: Set up Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v5
with:
node-version: '20.x'
cache: 'npm'
- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@v6
with:
python-version: 3.11
@@ -51,6 +60,10 @@ jobs:
- name: Run unit tests
run: npm test
- name: Run pr-checks tests
working-directory: pr-checks
run: python -m unittest discover
- name: Lint
if: matrix.os != 'windows-latest'
run: npm run lint-ci
@@ -63,7 +76,7 @@ jobs:
category: eslint
check-node-version:
if: github.event.pull_request
if: github.event.pull_request && github.triggering_actor != 'dependabot[bot]'
name: Check Action Node versions
runs-on: ubuntu-latest
timeout-minutes: 45
.github/workflows/prepare-release.yml
+4
View File
@@ -22,6 +22,10 @@ on:
paths:
- .github/workflows/prepare-release.yml
defaults:
run:
shell: bash
jobs:
prepare:
name: "Prepare release"
.github/workflows/publish-immutable-action.yml
+4
View File
@@ -4,6 +4,10 @@ on:
release:
types: [published]
defaults:
run:
shell: bash
jobs:
publish:
runs-on: ubuntu-latest
.github/workflows/python312-windows.yml
+6 -1
View File
@@ -12,8 +12,13 @@ on:
- cron: '0 0 * * 1'
workflow_dispatch:
defaults:
run:
shell: bash
jobs:
test-setup-python-scripts:
if: github.triggering_actor != 'dependabot[bot]'
env:
CODEQL_ACTION_TEST_MODE: true
timeout-minutes: 45
@@ -22,7 +27,7 @@ jobs:
runs-on: windows-latest
steps:
- uses: actions/setup-python@v5
- uses: actions/setup-python@v6
with:
python-version: 3.12
.github/workflows/query-filters.yml
+6 -1
View File
@@ -15,9 +15,14 @@ on:
- cron: '0 5 * * *'
workflow_dispatch: {}
defaults:
run:
shell: bash
jobs:
query-filters:
name: Query Filters Tests
if: github.triggering_actor != 'dependabot[bot]'
timeout-minutes: 45
runs-on: ubuntu-latest
permissions:
@@ -27,7 +32,7 @@ jobs:
uses: actions/checkout@v5
- name: Install Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v5
with:
node-version: 20.x
cache: npm
.github/workflows/rebuild.yml
+19 -6
View File
@@ -5,12 +5,20 @@ on:
types: [labeled]
workflow_dispatch:
defaults:
run:
shell: bash
jobs:
rebuild:
name: Rebuild Action
runs-on: ubuntu-latest
if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
env:
HEAD_REF: ${{ github.event.pull_request.head.ref || github.event.ref }}
BASE_BRANCH: ${{ github.event.pull_request.base.ref || 'main' }}
permissions:
contents: write # needed to push rebuilt commit
pull-requests: write # needed to comment on the PR
@@ -19,7 +27,7 @@ jobs:
uses: actions/checkout@v5
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.ref || github.event.ref }}
ref: ${{ env.HEAD_REF }}
- name: Remove label
if: github.event_name == 'pull_request'
@@ -37,8 +45,6 @@ jobs:
- name: Merge in changes from base branch
id: merge
env:
BASE_BRANCH: ${{ github.event.pull_request.base.ref || 'main' }}
run: |
git fetch origin "$BASE_BRANCH"
@@ -68,13 +74,20 @@ jobs:
npm run build
- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@v6
with:
python-version: 3.11
- name: Generate workflows
- name: Sync back version updates to generated workflows
# Only sync back versions on Dependabot update PRs
if: startsWith(env.HEAD_REF, 'dependabot/')
working-directory: pr-checks
run: |
python3 sync_back.py -v
- name: Generate workflows
working-directory: pr-checks
run: |
cd pr-checks
python -m pip install --upgrade pip
pip install ruamel.yaml==0.17.31
python3 sync.py
.github/workflows/rollback-release.yml
+5 -5
View File
@@ -14,6 +14,10 @@ on:
- .github/workflows/rollback-release.yml
- .github/actions/prepare-mergeback-branch/**
defaults:
run:
shell: bash
jobs:
prepare:
name: "Prepare release"
@@ -53,7 +57,6 @@ jobs:
- name: Create tag for testing
if: github.event_name != 'workflow_dispatch'
shell: bash
run: git tag v0.0.0
# We start by preparing the mergeback branch, mainly so that we have the updated changelog
@@ -96,7 +99,6 @@ jobs:
echo "::endgroup::"
- name: Create tags
shell: bash
env:
# We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
# but use `v0.0.0` for testing.
@@ -111,7 +113,6 @@ jobs:
- name: Push tags
# skip when testing
if: github.event_name == 'workflow_dispatch'
shell: bash
env:
RELEASE_TAG: ${{ needs.prepare.outputs.version }}
MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
@@ -132,7 +133,7 @@ jobs:
- name: Generate token
if: github.event_name == 'workflow_dispatch'
uses: actions/create-github-app-token@v2.1.1
uses: actions/create-github-app-token@v2.1.4
id: app-token
with:
app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -160,7 +161,6 @@ jobs:
echo "Created draft rollback release at $RELEASE_URL" >> $GITHUB_STEP_SUMMARY
- name: Update changelog
shell: bash
env:
NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
NEW_BRANCH: "${{ steps.mergeback-branch.outputs.new-branch }}"
.github/workflows/script/update-required-checks.sh
+8
View File
@@ -1,6 +1,8 @@
#!/usr/bin/env bash
# Update the required checks based on the current branch.
set -euo pipefail
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
REPO_DIR="$(dirname "$SCRIPT_DIR")"
GRANDPARENT_DIR="$(dirname "$REPO_DIR")"
@@ -31,6 +33,12 @@ CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs -
echo "$CHECKS" | jq
# Fail if there are no checks
if [ -z "$CHECKS" ] || [ "$(echo "$CHECKS" | jq '. | length')" -eq 0 ]; then
echo "No checks found for $GITHUB_SHA"
exit 1
fi
echo "{\"contexts\": ${CHECKS}}" > checks.json
echo "Updating main"
.github/workflows/test-codeql-bundle-all.yml
+5 -2
View File
@@ -16,6 +16,9 @@ on:
schedule:
- cron: '0 5 * * *'
workflow_dispatch: {}
defaults:
run:
shell: bash
jobs:
test-codeql-bundle-all:
strategy:
@@ -25,6 +28,7 @@ jobs:
- os: ubuntu-latest
version: nightly-latest
name: 'CodeQL Bundle All'
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
@@ -43,10 +47,9 @@ jobs:
uses: ./../action/init
with:
# We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
languages: cpp,csharp,go,java,javascript,python,ruby
languages: cpp,csharp,go,java,javascript,python,ruby
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze
env:
.github/workflows/update-bundle.yml
+5 -1
View File
@@ -13,6 +13,10 @@ on:
# to filter pre-release attribute.
types: [published]
defaults:
run:
shell: bash
jobs:
update-bundle:
if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
@@ -37,7 +41,7 @@ jobs:
git config --global user.name "github-actions[bot]"
- name: Set up Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v5
with:
node-version: '20.x'
cache: 'npm'
.github/workflows/update-proxy-release.yml
+5 -7
View File
@@ -7,6 +7,10 @@ on:
type: string
required: true
defaults:
run:
shell: bash
jobs:
update:
name: Update code and create PR
@@ -20,7 +24,6 @@ jobs:
steps:
- name: Check release tag format
id: checks
shell: bash
run: |
if ! [[ $RELEASE_TAG =~ ^codeql-bundle-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "Invalid release tag: expected a CodeQL bundle tag in the 'codeql-bundle-vM.N.P' format."
@@ -30,14 +33,13 @@ jobs:
echo "target_branch=dependency-proxy/$RELEASE_TAG" >> $GITHUB_OUTPUT
- name: Check that the release exists
shell: bash
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
run: |
(gh release view --repo "$GITHUB_REPOSITORY" --json "assets" "$RELEASE_TAG" && echo "Release found.") || exit 1
- name: Install Node
uses: actions/setup-node@v4
uses: actions/setup-node@v5
- name: Checkout repository
uses: actions/checkout@v5
@@ -46,20 +48,17 @@ jobs:
ref: main
- name: Update git config
shell: bash
run: |
git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
- name: Update release tag and version
shell: bash
run: |
NOW=$(date +"%Y%m%d%H%M%S") # only used to make sure we don't fetch stale binaries from the toolcache
sed -i "s|https://github.com/github/codeql-action/releases/download/codeql-bundle-v[0-9.]\+/|https://github.com/github/codeql-action/releases/download/$RELEASE_TAG/|g" ./src/start-proxy-action.ts
sed -i "s/\"v2.0.[0-9]\+\"/\"v2.0.$NOW\"/g" ./src/start-proxy-action.ts
- name: Compile TypeScript and commit changes
shell: bash
env:
TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
run: |
@@ -72,7 +71,6 @@ jobs:
git commit -m "Update release used by \`start-proxy\` action"
- name: Push changes and open PR
shell: bash
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
.github/workflows/update-release-branch.yml
+5 -1
View File
@@ -11,6 +11,10 @@ on:
branches:
- releases/*
defaults:
run:
shell: bash
jobs:
prepare:
@@ -89,7 +93,7 @@ jobs:
pull-requests: write # needed to create pull request
steps:
- name: Generate token
uses: actions/create-github-app-token@v2.1.1
uses: actions/create-github-app-token@v2.1.4
id: app-token
with:
app-id: ${{ vars.AUTOMATION_APP_ID }}
.github/workflows/update-supported-enterprise-server-versions.yml
+1 -1
View File
@@ -17,7 +17,7 @@ jobs:
steps:
- name: Setup Python
uses: actions/setup-python@v5
uses: actions/setup-python@v6
with:
python-version: "3.13"
- name: Checkout CodeQL Action
CHANGELOG.md
+7
View File
@@ -2,6 +2,13 @@
See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
## 3.30.4 - 25 Sep 2025
- We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the `codeql-action/init` step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the `codeql-action/init` step. [#3099](https://github.com/github/codeql-action/pull/3099) and [#3100](https://github.com/github/codeql-action/pull/3100)
- We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. [#3107](https://github.com/github/codeql-action/pull/3107)
- You can now run the latest CodeQL nightly bundle by passing `tools: nightly` to the `init` action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. [#3130](https://github.com/github/codeql-action/pull/3130)
- Update default CodeQL bundle version to 2.23.1. [#3118](https://github.com/github/codeql-action/pull/3118)
## 3.30.3 - 10 Sep 2025
No user facing changes.
analyze/action.yml
+1 -1
View File
@@ -58,7 +58,7 @@ inputs:
# If changing this, make sure to update workflow.ts accordingly.
default: ${{ github.workspace }}
ref:
description: "The ref where results will be uploaded. If not provided, the Action will use the GITHUB_REF environment variable. If provided, the sha input must be provided as well. This input is ignored for pull requests from forks."
description: "The ref where results will be uploaded. If not provided, the Action will use the GITHUB_REF environment variable. If provided, the sha input must be provided as well. This input is ignored for pull requests from forks. Expected format: refs/heads/<branch name>, refs/tags/<tag>, refs/pull/<number>/merge, or refs/pull/<number>/head."
required: false
sha:
description: "The sha of the HEAD of the ref where results will be uploaded. If not provided, the Action will use the GITHUB_SHA environment variable. If provided, the ref input must be provided as well. This input is ignored for pull requests from forks."
init/action.yml
+3
View File
@@ -12,6 +12,9 @@ inputs:
- The URL of a CodeQL Bundle tarball GitHub release asset, or
- A special value `linked` which uses the version of the CodeQL tools
that the Action has been bundled with.
- A special value `nightly` which uses the latest nightly version of the
CodeQL tools. Note that this is unstable and not recommended for
production use.
If not specified, the Action will check in several places until it finds
the CodeQL tools.
justfile
+1 -1
View File
@@ -22,7 +22,7 @@ test: build
# Run the tests for a single file
test_file filename: build
npx ava --verbose {{filename}}
npx ava --serial --verbose {{filename}}
[doc("Refresh the .js build artefacts in the lib directory")]
[confirm]
lib/analyze-action-post.js
Generated
+113 -42
View File
@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
"package.json"(exports2, module2) {
module2.exports = {
name: "codeql",
version: "3.30.3",
version: "3.30.4",
private: true,
description: "CodeQL action",
scripts: {
@@ -26447,7 +26447,7 @@ var require_package = __commonJS({
lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
"lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
"lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
test: "npm run transpile && ava src/**.test.ts --serial --verbose",
test: "npm run transpile && ava src/ --serial --verbose",
"test-debug": "npm run test -- --timeout=20m",
transpile: "tsc --build --verbose"
},
@@ -26463,7 +26463,7 @@ var require_package = __commonJS({
dependencies: {
"@actions/artifact": "^2.3.1",
"@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
"@actions/cache": "^4.0.5",
"@actions/cache": "^4.1.0",
"@actions/core": "^1.11.1",
"@actions/exec": "^1.1.1",
"@actions/github": "^6.0.0",
@@ -26486,15 +26486,15 @@ var require_package = __commonJS({
"node-forge": "^1.3.1",
octokit: "^5.0.3",
semver: "^7.7.2",
uuid: "^12.0.0"
uuid: "^13.0.0"
},
devDependencies: {
"@ava/typescript": "6.0.0",
"@eslint/compat": "^1.3.2",
"@eslint/compat": "^1.4.0",
"@eslint/eslintrc": "^3.3.1",
"@eslint/js": "^9.35.0",
"@eslint/js": "^9.36.0",
"@microsoft/eslint-formatter-sarif": "^3.1.0",
"@octokit/types": "^14.1.0",
"@octokit/types": "^15.0.0",
"@types/archiver": "^6.0.3",
"@types/console-log-level": "^1.4.5",
"@types/follow-redirects": "^1.14.4",
@@ -26503,10 +26503,10 @@ var require_package = __commonJS({
"@types/node-forge": "^1.3.14",
"@types/semver": "^7.7.1",
"@types/sinon": "^17.0.4",
"@typescript-eslint/eslint-plugin": "^8.43.0",
"@typescript-eslint/eslint-plugin": "^8.44.1",
"@typescript-eslint/parser": "^8.41.0",
ava: "^6.4.1",
esbuild: "^0.25.9",
esbuild: "^0.25.10",
eslint: "^8.57.1",
"eslint-import-resolver-typescript": "^3.8.7",
"eslint-plugin-filenames": "^1.3.2",
@@ -26536,7 +26536,8 @@ var require_package = __commonJS({
},
"eslint-plugin-jsx-a11y": {
semver: ">=6.3.1"
}
},
"brace-expansion@2.0.1": "2.0.2"
}
};
}
@@ -67281,7 +67282,7 @@ var require_package2 = __commonJS({
"node_modules/@actions/cache/package.json"(exports2, module2) {
module2.exports = {
name: "@actions/cache",
version: "4.0.5",
version: "4.1.0",
preview: true,
description: "Actions cache lib",
keywords: [
@@ -72090,11 +72091,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 9
/*ScalarType.STRING*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, signedUploadUrl: "" };
const message = { ok: false, signedUploadUrl: "", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72113,6 +72121,10 @@ var require_cache2 = __commonJS({
2:
message.signedUploadUrl = reader.string();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -72129,6 +72141,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.signedUploadUrl !== "")
writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -72234,11 +72248,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 3
/*ScalarType.INT64*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, entryId: "0" };
const message = { ok: false, entryId: "0", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72257,6 +72278,10 @@ var require_cache2 = __commonJS({
2:
message.entryId = reader.int64().toString();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -72273,6 +72298,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.entryId !== "0")
writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -73036,7 +73063,7 @@ var require_cache3 = __commonJS({
});
};
Object.defineProperty(exports2, "__esModule", { value: true });
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
var core14 = __importStar4(require_core());
var path6 = __importStar4(require("path"));
var utils = __importStar4(require_cacheUtils());
@@ -73044,7 +73071,6 @@ var require_cache3 = __commonJS({
var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
var config_1 = require_config();
var tar_1 = require_tar();
var constants_1 = require_constants7();
var http_client_1 = require_lib();
var ValidationError = class _ValidationError extends Error {
constructor(message) {
@@ -73062,6 +73088,14 @@ var require_cache3 = __commonJS({
}
};
exports2.ReserveCacheError = ReserveCacheError2;
var FinalizeCacheError = class _FinalizeCacheError extends Error {
constructor(message) {
super(message);
this.name = "FinalizeCacheError";
Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
}
};
exports2.FinalizeCacheError = FinalizeCacheError;
function checkPaths(paths) {
if (!paths || paths.length === 0) {
throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -73333,9 +73367,6 @@ var require_cache3 = __commonJS({
}
const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
core14.debug(`File Size: ${archiveFileSize}`);
if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
}
options.archiveSizeBytes = archiveFileSize;
core14.debug("Reserving Cache");
const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -73347,7 +73378,10 @@ var require_cache3 = __commonJS({
try {
const response = yield twirpClient.CreateCacheEntry(request);
if (!response.ok) {
throw new Error("Response was not ok");
if (response.message) {
core14.warning(`Cache reservation failed: ${response.message}`);
}
throw new Error(response.message || "Response was not ok");
}
signedUploadUrl = response.signedUploadUrl;
} catch (error2) {
@@ -73364,6 +73398,9 @@ var require_cache3 = __commonJS({
const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
if (!finalizeResponse.ok) {
if (finalizeResponse.message) {
throw new FinalizeCacheError(finalizeResponse.message);
}
throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
}
cacheId = parseInt(finalizeResponse.entryId);
@@ -73373,6 +73410,8 @@ var require_cache3 = __commonJS({
throw error2;
} else if (typedError.name === ReserveCacheError2.name) {
core14.info(`Failed to save: ${typedError.message}`);
} else if (typedError.name === FinalizeCacheError.name) {
core14.warning(typedError.message);
} else {
if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
core14.error(`Failed to save: ${typedError.message}`);
@@ -77685,7 +77724,7 @@ var require_brace_expansion2 = __commonJS({
var isSequence = isNumericSequence || isAlphaSequence;
var isOptions = m.body.indexOf(",") >= 0;
if (!isSequence && !isOptions) {
if (m.post.match(/,.*\}/)) {
if (m.post.match(/,(?!,).*\}/)) {
str2 = m.pre + "{" + m.body + escClose + m.post;
return expand(str2);
}
@@ -94795,7 +94834,7 @@ var require_commonjs16 = __commonJS({
var TYPEMASK = 1023;
var entToType = (s) => s.isFile() ? IFREG : s.isDirectory() ? IFDIR : s.isSymbolicLink() ? IFLNK : s.isCharacterDevice() ? IFCHR : s.isBlockDevice() ? IFBLK : s.isSocket() ? IFSOCK : s.isFIFO() ? IFIFO : UNKNOWN;
var normalizeCache = /* @__PURE__ */ new Map();
var normalize3 = (s) => {
var normalize2 = (s) => {
const c = normalizeCache.get(s);
if (c)
return c;
@@ -94808,7 +94847,7 @@ var require_commonjs16 = __commonJS({
const c = normalizeNocaseCache.get(s);
if (c)
return c;
const n = normalize3(s.toLowerCase());
const n = normalize2(s.toLowerCase());
normalizeNocaseCache.set(s, n);
return n;
};
@@ -94977,7 +95016,7 @@ var require_commonjs16 = __commonJS({
*/
constructor(name, type2 = UNKNOWN, root, roots, nocase, children, opts) {
this.name = name;
this.#matchName = nocase ? normalizeNocase(name) : normalize3(name);
this.#matchName = nocase ? normalizeNocase(name) : normalize2(name);
this.#type = type2 & TYPEMASK;
this.nocase = nocase;
this.roots = roots;
@@ -95070,7 +95109,7 @@ var require_commonjs16 = __commonJS({
return this.parent || this;
}
const children = this.children();
const name = this.nocase ? normalizeNocase(pathPart) : normalize3(pathPart);
const name = this.nocase ? normalizeNocase(pathPart) : normalize2(pathPart);
for (const p of children) {
if (p.#matchName === name) {
return p;
@@ -95315,7 +95354,7 @@ var require_commonjs16 = __commonJS({
* directly.
*/
isNamed(n) {
return !this.nocase ? this.#matchName === normalize3(n) : this.#matchName === normalizeNocase(n);
return !this.nocase ? this.#matchName === normalize2(n) : this.#matchName === normalizeNocase(n);
}
/**
* Return the Path object corresponding to the target of a symbolic link.
@@ -95454,7 +95493,7 @@ var require_commonjs16 = __commonJS({
#readdirMaybePromoteChild(e, c) {
for (let p = c.provisional; p < c.length; p++) {
const pchild = c[p];
const name = this.nocase ? normalizeNocase(e.name) : normalize3(e.name);
const name = this.nocase ? normalizeNocase(e.name) : normalize2(e.name);
if (name !== pchild.#matchName) {
continue;
}
@@ -103285,7 +103324,7 @@ var require_tr46 = __commonJS({
TRANSITIONAL: 0,
NONTRANSITIONAL: 1
};
function normalize3(str2) {
function normalize2(str2) {
return str2.split("\0").map(function(s) {
return s.normalize("NFC");
}).join("\0");
@@ -103365,7 +103404,7 @@ var require_tr46 = __commonJS({
processing_option = PROCESSING_OPTIONS.NONTRANSITIONAL;
}
var error2 = false;
if (normalize3(label) !== label || label[3] === "-" && label[4] === "-" || label[0] === "-" || label[label.length - 1] === "-" || label.indexOf(".") !== -1 || label.search(combiningMarksRegex) === 0) {
if (normalize2(label) !== label || label[3] === "-" && label[4] === "-" || label[0] === "-" || label[label.length - 1] === "-" || label.indexOf(".") !== -1 || label.search(combiningMarksRegex) === 0) {
error2 = true;
}
var len = countSymbols(label);
@@ -103383,7 +103422,7 @@ var require_tr46 = __commonJS({
}
function processing(domain_name, useSTD3, processing_option) {
var result = mapChars(domain_name, useSTD3, processing_option);
result.string = normalize3(result.string);
result.string = normalize2(result.string);
var labels = result.string.split(".");
for (var i = 0; i < labels.length; ++i) {
try {
@@ -117486,7 +117525,6 @@ function wrapCliConfigurationError(cliError) {
// src/config-utils.ts
var fs3 = __toESM(require("fs"));
var path3 = __toESM(require("path"));
var semver4 = __toESM(require_semver2());
// src/analyses.ts
var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
@@ -117499,8 +117537,17 @@ var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
// src/caching-utils.ts
var core6 = __toESM(require_core());
// src/config/db-config.ts
var semver2 = __toESM(require_semver2());
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
// src/feature-flags.ts
var semver3 = __toESM(require_semver2());
var semver4 = __toESM(require_semver2());
// src/overlay-database-utils.ts
var fs2 = __toESM(require("fs"));
@@ -117685,7 +117732,7 @@ function withGroup(groupName, f) {
}
// src/overlay-database-utils.ts
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -117746,13 +117793,13 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
}
// src/tools-features.ts
var semver2 = __toESM(require_semver2());
var semver3 = __toESM(require_semver2());
function isSupportedToolsFeature(versionInfo, feature) {
return !!versionInfo.features && versionInfo.features[feature];
}
var SafeArtifactUploadVersion = "2.20.3";
function isSafeArtifactUpload(codeQlVersion) {
return !codeQlVersion ? true : semver2.gte(codeQlVersion, SafeArtifactUploadVersion);
return !codeQlVersion ? true : semver3.gte(codeQlVersion, SafeArtifactUploadVersion);
}
// src/feature-flags.ts
@@ -117796,6 +117843,12 @@ var featureConfig = {
legacyApi: true,
minimumVersion: void 0
},
["resolve_supported_languages_using_cli" /* ResolveSupportedLanguagesUsingCli */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI",
minimumVersion: void 0,
toolsFeature: "builtinExtractorsSpecifyDefaultQueries" /* BuiltinExtractorsSpecifyDefaultQueries */
},
["overlay_analysis" /* OverlayAnalysis */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -117907,11 +117960,21 @@ var featureConfig = {
minimumVersion: void 0,
toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
},
["use_repository_properties" /* UseRepositoryProperties */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
minimumVersion: void 0
},
["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_QA_TELEMETRY",
legacyApi: true,
minimumVersion: void 0
},
["java_minimize_dependency_jars" /* JavaMinimizeDependencyJars */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_JAVA_MINIMIZE_DEPENDENCY_JARS",
minimumVersion: "2.23.0"
}
};
@@ -117943,12 +118006,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
};
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
function getPathToParsedConfigFile(tempDir) {
return path3.join(tempDir, "config");
}
@@ -117960,7 +118017,18 @@ async function getConfig(tempDir, logger) {
const configString = fs3.readFileSync(configFile, "utf8");
logger.debug("Loaded config:");
logger.debug(configString);
return JSON.parse(configString);
const config = JSON.parse(configString);
if (config.version === void 0) {
throw new ConfigurationError(
`Loaded configuration file, but it does not contain the expected 'version' field.`
);
}
if (config.version !== getActionVersion()) {
throw new ConfigurationError(
`Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
);
}
return config;
}
function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
const augmentedConfig = cloneObject(cliConfig);
@@ -118206,13 +118274,16 @@ async function getCodeQLForCmd(cmd, checkVersion) {
);
}
},
async betterResolveLanguages() {
async betterResolveLanguages({
filterToLanguagesWithQueries
} = { filterToLanguagesWithQueries: false }) {
const codeqlArgs = [
"resolve",
"languages",
"--format=betterjson",
"--extractor-options-verbosity=4",
"--extractor-include-aliases",
...filterToLanguagesWithQueries ? ["--filter-to-languages-with-queries"] : [],
...getExtraOptionsFromEnv(["resolve", "languages"])
];
const output = await runCli(cmd, codeqlArgs);
lib/analyze-action.js
Generated
+180 -56
View File
@@ -27722,7 +27722,7 @@ var require_pattern = __commonJS({
const absolute = [];
const relative2 = [];
for (const pattern of patterns) {
if (isAbsolute3(pattern)) {
if (isAbsolute2(pattern)) {
absolute.push(pattern);
} else {
relative2.push(pattern);
@@ -27731,10 +27731,10 @@ var require_pattern = __commonJS({
return [absolute, relative2];
}
exports2.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
function isAbsolute3(pattern) {
function isAbsolute2(pattern) {
return path20.isAbsolute(pattern);
}
exports2.isAbsolute = isAbsolute3;
exports2.isAbsolute = isAbsolute2;
}
});
@@ -32287,7 +32287,7 @@ var require_package = __commonJS({
"package.json"(exports2, module2) {
module2.exports = {
name: "codeql",
version: "3.30.3",
version: "3.30.4",
private: true,
description: "CodeQL action",
scripts: {
@@ -32296,7 +32296,7 @@ var require_package = __commonJS({
lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
"lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
"lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
test: "npm run transpile && ava src/**.test.ts --serial --verbose",
test: "npm run transpile && ava src/ --serial --verbose",
"test-debug": "npm run test -- --timeout=20m",
transpile: "tsc --build --verbose"
},
@@ -32312,7 +32312,7 @@ var require_package = __commonJS({
dependencies: {
"@actions/artifact": "^2.3.1",
"@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
"@actions/cache": "^4.0.5",
"@actions/cache": "^4.1.0",
"@actions/core": "^1.11.1",
"@actions/exec": "^1.1.1",
"@actions/github": "^6.0.0",
@@ -32335,15 +32335,15 @@ var require_package = __commonJS({
"node-forge": "^1.3.1",
octokit: "^5.0.3",
semver: "^7.7.2",
uuid: "^12.0.0"
uuid: "^13.0.0"
},
devDependencies: {
"@ava/typescript": "6.0.0",
"@eslint/compat": "^1.3.2",
"@eslint/compat": "^1.4.0",
"@eslint/eslintrc": "^3.3.1",
"@eslint/js": "^9.35.0",
"@eslint/js": "^9.36.0",
"@microsoft/eslint-formatter-sarif": "^3.1.0",
"@octokit/types": "^14.1.0",
"@octokit/types": "^15.0.0",
"@types/archiver": "^6.0.3",
"@types/console-log-level": "^1.4.5",
"@types/follow-redirects": "^1.14.4",
@@ -32352,10 +32352,10 @@ var require_package = __commonJS({
"@types/node-forge": "^1.3.14",
"@types/semver": "^7.7.1",
"@types/sinon": "^17.0.4",
"@typescript-eslint/eslint-plugin": "^8.43.0",
"@typescript-eslint/eslint-plugin": "^8.44.1",
"@typescript-eslint/parser": "^8.41.0",
ava: "^6.4.1",
esbuild: "^0.25.9",
esbuild: "^0.25.10",
eslint: "^8.57.1",
"eslint-import-resolver-typescript": "^3.8.7",
"eslint-plugin-filenames": "^1.3.2",
@@ -32385,7 +32385,8 @@ var require_package = __commonJS({
},
"eslint-plugin-jsx-a11y": {
semver: ">=6.3.1"
}
},
"brace-expansion@2.0.1": "2.0.2"
}
};
}
@@ -73130,7 +73131,7 @@ var require_package2 = __commonJS({
"node_modules/@actions/cache/package.json"(exports2, module2) {
module2.exports = {
name: "@actions/cache",
version: "4.0.5",
version: "4.1.0",
preview: true,
description: "Actions cache lib",
keywords: [
@@ -77939,11 +77940,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 9
/*ScalarType.STRING*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, signedUploadUrl: "" };
const message = { ok: false, signedUploadUrl: "", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -77962,6 +77970,10 @@ var require_cache2 = __commonJS({
2:
message.signedUploadUrl = reader.string();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -77978,6 +77990,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.signedUploadUrl !== "")
writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78083,11 +78097,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 3
/*ScalarType.INT64*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, entryId: "0" };
const message = { ok: false, entryId: "0", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -78106,6 +78127,10 @@ var require_cache2 = __commonJS({
2:
message.entryId = reader.int64().toString();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -78122,6 +78147,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.entryId !== "0")
writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78885,7 +78912,7 @@ var require_cache3 = __commonJS({
});
};
Object.defineProperty(exports2, "__esModule", { value: true });
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
var core15 = __importStar4(require_core());
var path20 = __importStar4(require("path"));
var utils = __importStar4(require_cacheUtils());
@@ -78893,7 +78920,6 @@ var require_cache3 = __commonJS({
var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
var config_1 = require_config();
var tar_1 = require_tar();
var constants_1 = require_constants10();
var http_client_1 = require_lib();
var ValidationError = class _ValidationError extends Error {
constructor(message) {
@@ -78911,6 +78937,14 @@ var require_cache3 = __commonJS({
}
};
exports2.ReserveCacheError = ReserveCacheError2;
var FinalizeCacheError = class _FinalizeCacheError extends Error {
constructor(message) {
super(message);
this.name = "FinalizeCacheError";
Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
}
};
exports2.FinalizeCacheError = FinalizeCacheError;
function checkPaths(paths) {
if (!paths || paths.length === 0) {
throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -79182,9 +79216,6 @@ var require_cache3 = __commonJS({
}
const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
core15.debug(`File Size: ${archiveFileSize}`);
if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
}
options.archiveSizeBytes = archiveFileSize;
core15.debug("Reserving Cache");
const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -79196,7 +79227,10 @@ var require_cache3 = __commonJS({
try {
const response = yield twirpClient.CreateCacheEntry(request);
if (!response.ok) {
throw new Error("Response was not ok");
if (response.message) {
core15.warning(`Cache reservation failed: ${response.message}`);
}
throw new Error(response.message || "Response was not ok");
}
signedUploadUrl = response.signedUploadUrl;
} catch (error2) {
@@ -79213,6 +79247,9 @@ var require_cache3 = __commonJS({
const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
core15.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
if (!finalizeResponse.ok) {
if (finalizeResponse.message) {
throw new FinalizeCacheError(finalizeResponse.message);
}
throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
}
cacheId = parseInt(finalizeResponse.entryId);
@@ -79222,6 +79259,8 @@ var require_cache3 = __commonJS({
throw error2;
} else if (typedError.name === ReserveCacheError2.name) {
core15.info(`Failed to save: ${typedError.message}`);
} else if (typedError.name === FinalizeCacheError.name) {
core15.warning(typedError.message);
} else {
if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
core15.error(`Failed to save: ${typedError.message}`);
@@ -89753,7 +89792,7 @@ async function tryGetFolderBytes(cacheDir, logger, quiet = false) {
}
}
var hadTimeout = false;
async function withTimeout(timeoutMs, promise, onTimeout) {
async function waitForResultWithTimeLimit(timeoutMs, promise, onTimeout) {
let finished2 = false;
const mainTask = async () => {
const result = await promise;
@@ -90197,6 +90236,14 @@ function getApiDetails() {
function getApiClient() {
return createApiClientWithDetails(getApiDetails());
}
function getAuthorizationHeaderFor(logger, apiDetails, url2) {
if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
logger.debug(`Providing an authorization token.`);
return `token ${apiDetails.auth}`;
}
logger.debug(`Not using an authorization token.`);
return void 0;
}
var cachedGitHubVersion = void 0;
async function getGitHubVersionFromApi(apiClient, apiDetails) {
if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
@@ -90554,7 +90601,6 @@ function wrapCliConfigurationError(cliError) {
// src/config-utils.ts
var fs9 = __toESM(require("fs"));
var path10 = __toESM(require("path"));
var semver4 = __toESM(require_semver2());
// src/caching-utils.ts
var core6 = __toESM(require_core());
@@ -90568,6 +90614,15 @@ function shouldStoreCache(kind) {
return kind === "full" /* Full */ || kind === "store" /* Store */;
}
// src/config/db-config.ts
var semver2 = __toESM(require_semver2());
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
// src/diff-informed-analysis-utils.ts
var fs8 = __toESM(require("fs"));
var path9 = __toESM(require("path"));
@@ -90575,11 +90630,11 @@ var path9 = __toESM(require("path"));
// src/feature-flags.ts
var fs7 = __toESM(require("fs"));
var path8 = __toESM(require("path"));
var semver3 = __toESM(require_semver2());
var semver4 = __toESM(require_semver2());
// src/defaults.json
var bundleVersion = "codeql-bundle-v2.23.0";
var cliVersion = "2.23.0";
var bundleVersion = "codeql-bundle-v2.23.1";
var cliVersion = "2.23.1";
// src/overlay-database-utils.ts
var crypto = __toESM(require("crypto"));
@@ -90810,7 +90865,7 @@ function formatDuration(durationMs) {
}
// src/overlay-database-utils.ts
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -90871,7 +90926,7 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
}
var CACHE_VERSION = 1;
var CACHE_PREFIX = "codeql-overlay-base-database";
var MAX_CACHE_OPERATION_MS = 12e4;
var MAX_CACHE_OPERATION_MS = 6e5;
function checkOverlayBaseDatabase(config, logger, warningPrefix) {
const baseDatabaseOidsFilePath = getBaseDatabaseOidsFilePath(config);
if (!fs6.existsSync(baseDatabaseOidsFilePath)) {
@@ -90939,7 +90994,7 @@ async function uploadOverlayBaseDatabaseToCache(codeql, config, logger) {
`Uploading overlay-base database to Actions cache with key ${cacheSaveKey}`
);
try {
const cacheId = await withTimeout(
const cacheId = await waitForResultWithTimeLimit(
MAX_CACHE_OPERATION_MS,
actionsCache.saveCache([dbLocation], cacheSaveKey),
() => {
@@ -90981,7 +91036,7 @@ function createCacheKeyHash(components) {
}
// src/tools-features.ts
var semver2 = __toESM(require_semver2());
var semver3 = __toESM(require_semver2());
function isSupportedToolsFeature(versionInfo, feature) {
return !!versionInfo.features && versionInfo.features[feature];
}
@@ -91030,6 +91085,12 @@ var featureConfig = {
legacyApi: true,
minimumVersion: void 0
},
["resolve_supported_languages_using_cli" /* ResolveSupportedLanguagesUsingCli */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI",
minimumVersion: void 0,
toolsFeature: "builtinExtractorsSpecifyDefaultQueries" /* BuiltinExtractorsSpecifyDefaultQueries */
},
["overlay_analysis" /* OverlayAnalysis */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -91141,11 +91202,21 @@ var featureConfig = {
minimumVersion: void 0,
toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
},
["use_repository_properties" /* UseRepositoryProperties */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
minimumVersion: void 0
},
["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_QA_TELEMETRY",
legacyApi: true,
minimumVersion: void 0
},
["java_minimize_dependency_jars" /* JavaMinimizeDependencyJars */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_JAVA_MINIMIZE_DEPENDENCY_JARS",
minimumVersion: "2.23.0"
}
};
var FEATURE_FLAGS_FILE_NAME = "cached-feature-flags.json";
@@ -91254,7 +91325,7 @@ var GitHubFeatureFlags = class {
DEFAULT_VERSION_FEATURE_FLAG_PREFIX.length,
f.length - DEFAULT_VERSION_FEATURE_FLAG_SUFFIX.length
).replace(/_/g, ".");
if (!semver3.valid(version)) {
if (!semver4.valid(version)) {
this.logger.warning(
`Ignoring feature flag ${f} as it does not specify a valid CodeQL version.`
);
@@ -91486,7 +91557,7 @@ async function uploadTrapCaches(codeql, config, logger) {
process.env.GITHUB_SHA || "unknown"
);
logger.info(`Uploading TRAP cache to Actions cache with key ${key}`);
await withTimeout(
await waitForResultWithTimeLimit(
MAX_CACHE_OPERATION_MS2,
actionsCache2.saveCache([cacheDir], key),
() => {
@@ -91603,12 +91674,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
};
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
function getPathToParsedConfigFile(tempDir) {
return path10.join(tempDir, "config");
}
@@ -91620,7 +91685,18 @@ async function getConfig(tempDir, logger) {
const configString = fs9.readFileSync(configFile, "utf8");
logger.debug("Loaded config:");
logger.debug(configString);
return JSON.parse(configString);
const config = JSON.parse(configString);
if (config.version === void 0) {
throw new ConfigurationError(
`Loaded configuration file, but it does not contain the expected 'version' field.`
);
}
if (config.version !== getActionVersion()) {
throw new ConfigurationError(
`Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
);
}
return config;
}
function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
const augmentedConfig = cloneObject(cliConfig);
@@ -91660,7 +91736,7 @@ var toolcache3 = __toESM(require_tool_cache());
var import_fast_deep_equal = __toESM(require_fast_deep_equal());
var semver7 = __toESM(require_semver2());
// node_modules/uuid/dist/stringify.js
// node_modules/uuid/dist-node/stringify.js
var byteToHex = [];
for (let i = 0; i < 256; ++i) {
byteToHex.push((i + 256).toString(16).slice(1));
@@ -91669,7 +91745,7 @@ function unsafeStringify(arr, offset = 0) {
return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase();
}
// node_modules/uuid/dist/rng.js
// node_modules/uuid/dist-node/rng.js
var import_node_crypto = require("node:crypto");
var rnds8Pool = new Uint8Array(256);
var poolPtr = rnds8Pool.length;
@@ -91681,11 +91757,11 @@ function rng() {
return rnds8Pool.slice(poolPtr, poolPtr += 16);
}
// node_modules/uuid/dist/native.js
// node_modules/uuid/dist-node/native.js
var import_node_crypto2 = require("node:crypto");
var native_default = { randomUUID: import_node_crypto2.randomUUID };
// node_modules/uuid/dist/v4.js
// node_modules/uuid/dist-node/v4.js
function _v4(options, buf, offset) {
options = options || {};
const rnds = options.random ?? options.rng?.() ?? rng();
@@ -92028,7 +92104,10 @@ function sanitizeUrlForStatusReport(url2) {
// src/setup-codeql.ts
var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
var CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing";
var CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";
var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"];
var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
function getCodeQLBundleExtension(compressionMethod) {
switch (compressionMethod) {
case "gzip":
@@ -92171,7 +92250,7 @@ async function findOverridingToolsInCache(humanReadableVersion, logger) {
return void 0;
}
async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, variant, tarSupportsZstd, logger) {
if (toolsInput && !CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput) && !toolsInput.startsWith("http")) {
if (toolsInput && !isReservedToolsValue(toolsInput) && !toolsInput.startsWith("http")) {
logger.info(`Using CodeQL CLI from local path ${toolsInput}`);
const compressionMethod2 = inferCompressionMethod(toolsInput);
if (compressionMethod2 === void 0) {
@@ -92200,6 +92279,12 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
let cliVersion2;
let tagName;
let url2;
if (toolsInput !== void 0 && CODEQL_NIGHTLY_TOOLS_INPUTS.includes(toolsInput)) {
logger.info(
`Using the latest CodeQL CLI nightly, as requested by 'tools: ${toolsInput}'.`
);
toolsInput = await getNightlyToolsUrl(logger);
}
if (forceShippedTools) {
cliVersion2 = cliVersion;
tagName = bundleVersion;
@@ -92352,11 +92437,12 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer
let authorization = void 0;
if (searchParams.has("token")) {
logger.debug("CodeQL tools URL contains an authorization token.");
} else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) {
logger.debug("Providing an authorization token to download CodeQL tools.");
authorization = `token ${apiDetails.auth}`;
} else {
logger.debug("Downloading CodeQL tools without an authorization token.");
authorization = getAuthorizationHeaderFor(
logger,
apiDetails,
codeqlURL
);
}
const toolcacheInfo = getToolcacheDestinationInfo(
maybeBundleVersion,
@@ -92483,6 +92569,34 @@ async function useZstdBundle(cliVersion2, tarSupportsZstd) {
function getTempExtractionDir(tempDir) {
return path12.join(tempDir, v4_default());
}
async function getNightlyToolsUrl(logger) {
const zstdAvailability = await isZstdAvailable(logger);
const compressionMethod = await useZstdBundle(
CODEQL_VERSION_ZSTD_BUNDLE,
zstdAvailability.available
) ? "zstd" : "gzip";
try {
const release3 = await getApiClient().rest.repos.listReleases({
owner: CODEQL_NIGHTLIES_REPOSITORY_OWNER,
repo: CODEQL_NIGHTLIES_REPOSITORY_NAME,
per_page: 1,
page: 1,
prerelease: true
});
const latestRelease = release3.data[0];
if (!latestRelease) {
throw new Error("Could not find the latest nightly release.");
}
return `https://github.com/${CODEQL_NIGHTLIES_REPOSITORY_OWNER}/${CODEQL_NIGHTLIES_REPOSITORY_NAME}/releases/download/${latestRelease.tag_name}/${getCodeQLBundleName(compressionMethod)}`;
} catch (e) {
throw new Error(
`Failed to retrieve the latest nightly release: ${wrapError(e)}`
);
}
}
function isReservedToolsValue(tools) {
return CODEQL_BUNDLE_VERSION_ALIAS.includes(tools) || CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools);
}
// src/tracer-config.ts
var fs13 = __toESM(require("fs"));
@@ -92769,13 +92883,16 @@ async function getCodeQLForCmd(cmd, checkVersion) {
);
}
},
async betterResolveLanguages() {
async betterResolveLanguages({
filterToLanguagesWithQueries
} = { filterToLanguagesWithQueries: false }) {
const codeqlArgs = [
"resolve",
"languages",
"--format=betterjson",
"--extractor-options-verbosity=4",
"--extractor-include-aliases",
...filterToLanguagesWithQueries ? ["--filter-to-languages-with-queries"] : [],
...getExtraOptionsFromEnv(["resolve", "languages"])
];
const output = await runCli(cmd, codeqlArgs);
@@ -93221,7 +93338,7 @@ function getDefaultCacheConfig() {
async function makeGlobber(patterns) {
return glob.create(patterns.join("\n"));
}
async function uploadDependencyCaches(config, logger) {
async function uploadDependencyCaches(config, logger, minimizeJavaJars) {
for (const language of config.languages) {
const cacheConfig = getDefaultCacheConfig()[language];
if (cacheConfig === void 0) {
@@ -93244,7 +93361,7 @@ async function uploadDependencyCaches(config, logger) {
);
continue;
}
const key = await cacheKey2(language, cacheConfig);
const key = await cacheKey2(language, cacheConfig, minimizeJavaJars);
logger.info(
`Uploading cache of size ${size} for ${language} with key ${key}...`
);
@@ -93262,17 +93379,20 @@ async function uploadDependencyCaches(config, logger) {
}
}
}
async function cacheKey2(language, cacheConfig) {
async function cacheKey2(language, cacheConfig, minimizeJavaJars = false) {
const hash2 = await glob.hashFiles(cacheConfig.hash.join("\n"));
return `${await cachePrefix2(language)}${hash2}`;
return `${await cachePrefix2(language, minimizeJavaJars)}${hash2}`;
}
async function cachePrefix2(language) {
async function cachePrefix2(language, minimizeJavaJars) {
const runnerOs = getRequiredEnvParam("RUNNER_OS");
const customPrefix = process.env["CODEQL_ACTION_DEPENDENCY_CACHE_PREFIX" /* DEPENDENCY_CACHING_PREFIX */];
let prefix = CODEQL_DEPENDENCY_CACHE_PREFIX;
if (customPrefix !== void 0 && customPrefix.length > 0) {
prefix = `${prefix}-${customPrefix}`;
}
if (language === "java" /* java */ && minimizeJavaJars) {
prefix = `minify-${prefix}`;
}
return `${prefix}-${CODEQL_DEPENDENCY_CACHE_VERSION}-${runnerOs}-${language}-`;
}
@@ -96054,7 +96174,11 @@ async function run() {
logger
);
if (shouldStoreCache(config.dependencyCachingEnabled)) {
await uploadDependencyCaches(config, logger);
const minimizeJavaJars = await features.getValue(
"java_minimize_dependency_jars" /* JavaMinimizeDependencyJars */,
codeql
);
await uploadDependencyCaches(config, logger, minimizeJavaJars);
}
if (isInTestMode()) {
logger.debug("In test mode. Waiting for processing is disabled.");
lib/autobuild-action.js
Generated
+105 -34
View File
@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
"package.json"(exports2, module2) {
module2.exports = {
name: "codeql",
version: "3.30.3",
version: "3.30.4",
private: true,
description: "CodeQL action",
scripts: {
@@ -26447,7 +26447,7 @@ var require_package = __commonJS({
lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
"lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
"lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
test: "npm run transpile && ava src/**.test.ts --serial --verbose",
test: "npm run transpile && ava src/ --serial --verbose",
"test-debug": "npm run test -- --timeout=20m",
transpile: "tsc --build --verbose"
},
@@ -26463,7 +26463,7 @@ var require_package = __commonJS({
dependencies: {
"@actions/artifact": "^2.3.1",
"@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
"@actions/cache": "^4.0.5",
"@actions/cache": "^4.1.0",
"@actions/core": "^1.11.1",
"@actions/exec": "^1.1.1",
"@actions/github": "^6.0.0",
@@ -26486,15 +26486,15 @@ var require_package = __commonJS({
"node-forge": "^1.3.1",
octokit: "^5.0.3",
semver: "^7.7.2",
uuid: "^12.0.0"
uuid: "^13.0.0"
},
devDependencies: {
"@ava/typescript": "6.0.0",
"@eslint/compat": "^1.3.2",
"@eslint/compat": "^1.4.0",
"@eslint/eslintrc": "^3.3.1",
"@eslint/js": "^9.35.0",
"@eslint/js": "^9.36.0",
"@microsoft/eslint-formatter-sarif": "^3.1.0",
"@octokit/types": "^14.1.0",
"@octokit/types": "^15.0.0",
"@types/archiver": "^6.0.3",
"@types/console-log-level": "^1.4.5",
"@types/follow-redirects": "^1.14.4",
@@ -26503,10 +26503,10 @@ var require_package = __commonJS({
"@types/node-forge": "^1.3.14",
"@types/semver": "^7.7.1",
"@types/sinon": "^17.0.4",
"@typescript-eslint/eslint-plugin": "^8.43.0",
"@typescript-eslint/eslint-plugin": "^8.44.1",
"@typescript-eslint/parser": "^8.41.0",
ava: "^6.4.1",
esbuild: "^0.25.9",
esbuild: "^0.25.10",
eslint: "^8.57.1",
"eslint-import-resolver-typescript": "^3.8.7",
"eslint-plugin-filenames": "^1.3.2",
@@ -26536,7 +26536,8 @@ var require_package = __commonJS({
},
"eslint-plugin-jsx-a11y": {
semver: ">=6.3.1"
}
},
"brace-expansion@2.0.1": "2.0.2"
}
};
}
@@ -67281,7 +67282,7 @@ var require_package2 = __commonJS({
"node_modules/@actions/cache/package.json"(exports2, module2) {
module2.exports = {
name: "@actions/cache",
version: "4.0.5",
version: "4.1.0",
preview: true,
description: "Actions cache lib",
keywords: [
@@ -72090,11 +72091,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 9
/*ScalarType.STRING*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, signedUploadUrl: "" };
const message = { ok: false, signedUploadUrl: "", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72113,6 +72121,10 @@ var require_cache2 = __commonJS({
2:
message.signedUploadUrl = reader.string();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -72129,6 +72141,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.signedUploadUrl !== "")
writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -72234,11 +72248,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 3
/*ScalarType.INT64*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, entryId: "0" };
const message = { ok: false, entryId: "0", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72257,6 +72278,10 @@ var require_cache2 = __commonJS({
2:
message.entryId = reader.int64().toString();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -72273,6 +72298,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.entryId !== "0")
writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -73036,7 +73063,7 @@ var require_cache3 = __commonJS({
});
};
Object.defineProperty(exports2, "__esModule", { value: true });
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
var core14 = __importStar4(require_core());
var path7 = __importStar4(require("path"));
var utils = __importStar4(require_cacheUtils());
@@ -73044,7 +73071,6 @@ var require_cache3 = __commonJS({
var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
var config_1 = require_config();
var tar_1 = require_tar();
var constants_1 = require_constants7();
var http_client_1 = require_lib();
var ValidationError = class _ValidationError extends Error {
constructor(message) {
@@ -73062,6 +73088,14 @@ var require_cache3 = __commonJS({
}
};
exports2.ReserveCacheError = ReserveCacheError;
var FinalizeCacheError = class _FinalizeCacheError extends Error {
constructor(message) {
super(message);
this.name = "FinalizeCacheError";
Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
}
};
exports2.FinalizeCacheError = FinalizeCacheError;
function checkPaths(paths) {
if (!paths || paths.length === 0) {
throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -73333,9 +73367,6 @@ var require_cache3 = __commonJS({
}
const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
core14.debug(`File Size: ${archiveFileSize}`);
if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
}
options.archiveSizeBytes = archiveFileSize;
core14.debug("Reserving Cache");
const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -73347,7 +73378,10 @@ var require_cache3 = __commonJS({
try {
const response = yield twirpClient.CreateCacheEntry(request);
if (!response.ok) {
throw new Error("Response was not ok");
if (response.message) {
core14.warning(`Cache reservation failed: ${response.message}`);
}
throw new Error(response.message || "Response was not ok");
}
signedUploadUrl = response.signedUploadUrl;
} catch (error2) {
@@ -73364,6 +73398,9 @@ var require_cache3 = __commonJS({
const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
if (!finalizeResponse.ok) {
if (finalizeResponse.message) {
throw new FinalizeCacheError(finalizeResponse.message);
}
throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
}
cacheId = parseInt(finalizeResponse.entryId);
@@ -73373,6 +73410,8 @@ var require_cache3 = __commonJS({
throw error2;
} else if (typedError.name === ReserveCacheError.name) {
core14.info(`Failed to save: ${typedError.message}`);
} else if (typedError.name === FinalizeCacheError.name) {
core14.warning(typedError.message);
} else {
if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
core14.error(`Failed to save: ${typedError.message}`);
@@ -78228,7 +78267,6 @@ function wrapCliConfigurationError(cliError) {
// src/config-utils.ts
var fs4 = __toESM(require("fs"));
var path4 = __toESM(require("path"));
var semver4 = __toESM(require_semver2());
// src/analyses.ts
var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
@@ -78241,14 +78279,23 @@ var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
// src/caching-utils.ts
var core6 = __toESM(require_core());
// src/config/db-config.ts
var semver2 = __toESM(require_semver2());
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
// src/feature-flags.ts
var fs3 = __toESM(require("fs"));
var path3 = __toESM(require("path"));
var semver3 = __toESM(require_semver2());
var semver4 = __toESM(require_semver2());
// src/defaults.json
var bundleVersion = "codeql-bundle-v2.23.0";
var cliVersion = "2.23.0";
var bundleVersion = "codeql-bundle-v2.23.1";
var cliVersion = "2.23.1";
// src/overlay-database-utils.ts
var fs2 = __toESM(require("fs"));
@@ -78425,7 +78472,7 @@ function getActionsLogger() {
}
// src/overlay-database-utils.ts
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -78486,7 +78533,7 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
}
// src/tools-features.ts
var semver2 = __toESM(require_semver2());
var semver3 = __toESM(require_semver2());
function isSupportedToolsFeature(versionInfo, feature) {
return !!versionInfo.features && versionInfo.features[feature];
}
@@ -78534,6 +78581,12 @@ var featureConfig = {
legacyApi: true,
minimumVersion: void 0
},
["resolve_supported_languages_using_cli" /* ResolveSupportedLanguagesUsingCli */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI",
minimumVersion: void 0,
toolsFeature: "builtinExtractorsSpecifyDefaultQueries" /* BuiltinExtractorsSpecifyDefaultQueries */
},
["overlay_analysis" /* OverlayAnalysis */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -78645,11 +78698,21 @@ var featureConfig = {
minimumVersion: void 0,
toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
},
["use_repository_properties" /* UseRepositoryProperties */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
minimumVersion: void 0
},
["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_QA_TELEMETRY",
legacyApi: true,
minimumVersion: void 0
},
["java_minimize_dependency_jars" /* JavaMinimizeDependencyJars */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_JAVA_MINIMIZE_DEPENDENCY_JARS",
minimumVersion: "2.23.0"
}
};
var FEATURE_FLAGS_FILE_NAME = "cached-feature-flags.json";
@@ -78758,7 +78821,7 @@ var GitHubFeatureFlags = class {
DEFAULT_VERSION_FEATURE_FLAG_PREFIX.length,
f.length - DEFAULT_VERSION_FEATURE_FLAG_SUFFIX.length
).replace(/_/g, ".");
if (!semver3.valid(version)) {
if (!semver4.valid(version)) {
this.logger.warning(
`Ignoring feature flag ${f} as it does not specify a valid CodeQL version.`
);
@@ -78945,12 +79008,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
};
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
function getPathToParsedConfigFile(tempDir) {
return path4.join(tempDir, "config");
}
@@ -78962,7 +79019,18 @@ async function getConfig(tempDir, logger) {
const configString = fs4.readFileSync(configFile, "utf8");
logger.debug("Loaded config:");
logger.debug(configString);
return JSON.parse(configString);
const config = JSON.parse(configString);
if (config.version === void 0) {
throw new ConfigurationError(
`Loaded configuration file, but it does not contain the expected 'version' field.`
);
}
if (config.version !== getActionVersion()) {
throw new ConfigurationError(
`Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
);
}
return config;
}
function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
const augmentedConfig = cloneObject(cliConfig);
@@ -79241,13 +79309,16 @@ async function getCodeQLForCmd(cmd, checkVersion) {
);
}
},
async betterResolveLanguages() {
async betterResolveLanguages({
filterToLanguagesWithQueries
} = { filterToLanguagesWithQueries: false }) {
const codeqlArgs = [
"resolve",
"languages",
"--format=betterjson",
"--extractor-options-verbosity=4",
"--extractor-include-aliases",
...filterToLanguagesWithQueries ? ["--filter-to-languages-with-queries"] : [],
...getExtraOptionsFromEnv(["resolve", "languages"])
];
const output = await runCli(cmd, codeqlArgs);
lib/defaults.json
+4 -4
View File
@@ -1,6 +1,6 @@
{
"bundleVersion": "codeql-bundle-v2.23.0",
"cliVersion": "2.23.0",
"priorBundleVersion": "codeql-bundle-v2.22.4",
"priorCliVersion": "2.22.4"
"bundleVersion": "codeql-bundle-v2.23.1",
"cliVersion": "2.23.1",
"priorBundleVersion": "codeql-bundle-v2.23.0",
"priorCliVersion": "2.23.0"
}
lib/init-action-post.js
Generated
+176 -58
View File
@@ -27722,7 +27722,7 @@ var require_pattern = __commonJS({
const absolute = [];
const relative2 = [];
for (const pattern of patterns) {
if (isAbsolute3(pattern)) {
if (isAbsolute2(pattern)) {
absolute.push(pattern);
} else {
relative2.push(pattern);
@@ -27731,10 +27731,10 @@ var require_pattern = __commonJS({
return [absolute, relative2];
}
exports2.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
function isAbsolute3(pattern) {
function isAbsolute2(pattern) {
return path19.isAbsolute(pattern);
}
exports2.isAbsolute = isAbsolute3;
exports2.isAbsolute = isAbsolute2;
}
});
@@ -32287,7 +32287,7 @@ var require_package = __commonJS({
"package.json"(exports2, module2) {
module2.exports = {
name: "codeql",
version: "3.30.3",
version: "3.30.4",
private: true,
description: "CodeQL action",
scripts: {
@@ -32296,7 +32296,7 @@ var require_package = __commonJS({
lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
"lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
"lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
test: "npm run transpile && ava src/**.test.ts --serial --verbose",
test: "npm run transpile && ava src/ --serial --verbose",
"test-debug": "npm run test -- --timeout=20m",
transpile: "tsc --build --verbose"
},
@@ -32312,7 +32312,7 @@ var require_package = __commonJS({
dependencies: {
"@actions/artifact": "^2.3.1",
"@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
"@actions/cache": "^4.0.5",
"@actions/cache": "^4.1.0",
"@actions/core": "^1.11.1",
"@actions/exec": "^1.1.1",
"@actions/github": "^6.0.0",
@@ -32335,15 +32335,15 @@ var require_package = __commonJS({
"node-forge": "^1.3.1",
octokit: "^5.0.3",
semver: "^7.7.2",
uuid: "^12.0.0"
uuid: "^13.0.0"
},
devDependencies: {
"@ava/typescript": "6.0.0",
"@eslint/compat": "^1.3.2",
"@eslint/compat": "^1.4.0",
"@eslint/eslintrc": "^3.3.1",
"@eslint/js": "^9.35.0",
"@eslint/js": "^9.36.0",
"@microsoft/eslint-formatter-sarif": "^3.1.0",
"@octokit/types": "^14.1.0",
"@octokit/types": "^15.0.0",
"@types/archiver": "^6.0.3",
"@types/console-log-level": "^1.4.5",
"@types/follow-redirects": "^1.14.4",
@@ -32352,10 +32352,10 @@ var require_package = __commonJS({
"@types/node-forge": "^1.3.14",
"@types/semver": "^7.7.1",
"@types/sinon": "^17.0.4",
"@typescript-eslint/eslint-plugin": "^8.43.0",
"@typescript-eslint/eslint-plugin": "^8.44.1",
"@typescript-eslint/parser": "^8.41.0",
ava: "^6.4.1",
esbuild: "^0.25.9",
esbuild: "^0.25.10",
eslint: "^8.57.1",
"eslint-import-resolver-typescript": "^3.8.7",
"eslint-plugin-filenames": "^1.3.2",
@@ -32385,7 +32385,8 @@ var require_package = __commonJS({
},
"eslint-plugin-jsx-a11y": {
semver: ">=6.3.1"
}
},
"brace-expansion@2.0.1": "2.0.2"
}
};
}
@@ -73130,7 +73131,7 @@ var require_package2 = __commonJS({
"node_modules/@actions/cache/package.json"(exports2, module2) {
module2.exports = {
name: "@actions/cache",
version: "4.0.5",
version: "4.1.0",
preview: true,
description: "Actions cache lib",
keywords: [
@@ -77939,11 +77940,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 9
/*ScalarType.STRING*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, signedUploadUrl: "" };
const message = { ok: false, signedUploadUrl: "", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -77962,6 +77970,10 @@ var require_cache2 = __commonJS({
2:
message.signedUploadUrl = reader.string();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -77978,6 +77990,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.signedUploadUrl !== "")
writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78083,11 +78097,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 3
/*ScalarType.INT64*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, entryId: "0" };
const message = { ok: false, entryId: "0", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -78106,6 +78127,10 @@ var require_cache2 = __commonJS({
2:
message.entryId = reader.int64().toString();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -78122,6 +78147,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.entryId !== "0")
writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78885,7 +78912,7 @@ var require_cache3 = __commonJS({
});
};
Object.defineProperty(exports2, "__esModule", { value: true });
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
var core18 = __importStar4(require_core());
var path19 = __importStar4(require("path"));
var utils = __importStar4(require_cacheUtils());
@@ -78893,7 +78920,6 @@ var require_cache3 = __commonJS({
var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
var config_1 = require_config();
var tar_1 = require_tar();
var constants_1 = require_constants10();
var http_client_1 = require_lib();
var ValidationError = class _ValidationError extends Error {
constructor(message) {
@@ -78911,6 +78937,14 @@ var require_cache3 = __commonJS({
}
};
exports2.ReserveCacheError = ReserveCacheError2;
var FinalizeCacheError = class _FinalizeCacheError extends Error {
constructor(message) {
super(message);
this.name = "FinalizeCacheError";
Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
}
};
exports2.FinalizeCacheError = FinalizeCacheError;
function checkPaths(paths) {
if (!paths || paths.length === 0) {
throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -79182,9 +79216,6 @@ var require_cache3 = __commonJS({
}
const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
core18.debug(`File Size: ${archiveFileSize}`);
if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
}
options.archiveSizeBytes = archiveFileSize;
core18.debug("Reserving Cache");
const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -79196,7 +79227,10 @@ var require_cache3 = __commonJS({
try {
const response = yield twirpClient.CreateCacheEntry(request);
if (!response.ok) {
throw new Error("Response was not ok");
if (response.message) {
core18.warning(`Cache reservation failed: ${response.message}`);
}
throw new Error(response.message || "Response was not ok");
}
signedUploadUrl = response.signedUploadUrl;
} catch (error2) {
@@ -79213,6 +79247,9 @@ var require_cache3 = __commonJS({
const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
core18.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
if (!finalizeResponse.ok) {
if (finalizeResponse.message) {
throw new FinalizeCacheError(finalizeResponse.message);
}
throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
}
cacheId = parseInt(finalizeResponse.entryId);
@@ -79222,6 +79259,8 @@ var require_cache3 = __commonJS({
throw error2;
} else if (typedError.name === ReserveCacheError2.name) {
core18.info(`Failed to save: ${typedError.message}`);
} else if (typedError.name === FinalizeCacheError.name) {
core18.warning(typedError.message);
} else {
if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
core18.error(`Failed to save: ${typedError.message}`);
@@ -83534,7 +83573,7 @@ var require_brace_expansion2 = __commonJS({
var isSequence = isNumericSequence || isAlphaSequence;
var isOptions = m.body.indexOf(",") >= 0;
if (!isSequence && !isOptions) {
if (m.post.match(/,.*\}/)) {
if (m.post.match(/,(?!,).*\}/)) {
str2 = m.pre + "{" + m.body + escClose + m.post;
return expand(str2);
}
@@ -100644,7 +100683,7 @@ var require_commonjs16 = __commonJS({
var TYPEMASK = 1023;
var entToType = (s) => s.isFile() ? IFREG : s.isDirectory() ? IFDIR : s.isSymbolicLink() ? IFLNK : s.isCharacterDevice() ? IFCHR : s.isBlockDevice() ? IFBLK : s.isSocket() ? IFSOCK : s.isFIFO() ? IFIFO : UNKNOWN;
var normalizeCache = /* @__PURE__ */ new Map();
var normalize4 = (s) => {
var normalize3 = (s) => {
const c = normalizeCache.get(s);
if (c)
return c;
@@ -100657,7 +100696,7 @@ var require_commonjs16 = __commonJS({
const c = normalizeNocaseCache.get(s);
if (c)
return c;
const n = normalize4(s.toLowerCase());
const n = normalize3(s.toLowerCase());
normalizeNocaseCache.set(s, n);
return n;
};
@@ -100826,7 +100865,7 @@ var require_commonjs16 = __commonJS({
*/
constructor(name, type2 = UNKNOWN, root, roots, nocase, children, opts) {
this.name = name;
this.#matchName = nocase ? normalizeNocase(name) : normalize4(name);
this.#matchName = nocase ? normalizeNocase(name) : normalize3(name);
this.#type = type2 & TYPEMASK;
this.nocase = nocase;
this.roots = roots;
@@ -100919,7 +100958,7 @@ var require_commonjs16 = __commonJS({
return this.parent || this;
}
const children = this.children();
const name = this.nocase ? normalizeNocase(pathPart) : normalize4(pathPart);
const name = this.nocase ? normalizeNocase(pathPart) : normalize3(pathPart);
for (const p of children) {
if (p.#matchName === name) {
return p;
@@ -101164,7 +101203,7 @@ var require_commonjs16 = __commonJS({
* directly.
*/
isNamed(n) {
return !this.nocase ? this.#matchName === normalize4(n) : this.#matchName === normalizeNocase(n);
return !this.nocase ? this.#matchName === normalize3(n) : this.#matchName === normalizeNocase(n);
}
/**
* Return the Path object corresponding to the target of a symbolic link.
@@ -101303,7 +101342,7 @@ var require_commonjs16 = __commonJS({
#readdirMaybePromoteChild(e, c) {
for (let p = c.provisional; p < c.length; p++) {
const pchild = c[p];
const name = this.nocase ? normalizeNocase(e.name) : normalize4(e.name);
const name = this.nocase ? normalizeNocase(e.name) : normalize3(e.name);
if (name !== pchild.#matchName) {
continue;
}
@@ -109134,7 +109173,7 @@ var require_tr46 = __commonJS({
TRANSITIONAL: 0,
NONTRANSITIONAL: 1
};
function normalize4(str2) {
function normalize3(str2) {
return str2.split("\0").map(function(s) {
return s.normalize("NFC");
}).join("\0");
@@ -109214,7 +109253,7 @@ var require_tr46 = __commonJS({
processing_option = PROCESSING_OPTIONS.NONTRANSITIONAL;
}
var error2 = false;
if (normalize4(label) !== label || label[3] === "-" && label[4] === "-" || label[0] === "-" || label[label.length - 1] === "-" || label.indexOf(".") !== -1 || label.search(combiningMarksRegex) === 0) {
if (normalize3(label) !== label || label[3] === "-" && label[4] === "-" || label[0] === "-" || label[label.length - 1] === "-" || label.indexOf(".") !== -1 || label.search(combiningMarksRegex) === 0) {
error2 = true;
}
var len = countSymbols(label);
@@ -109232,7 +109271,7 @@ var require_tr46 = __commonJS({
}
function processing(domain_name, useSTD3, processing_option) {
var result = mapChars(domain_name, useSTD3, processing_option);
result.string = normalize4(result.string);
result.string = normalize3(result.string);
var labels = result.string.split(".");
for (var i = 0; i < labels.length; ++i) {
try {
@@ -128416,6 +128455,14 @@ function getApiDetails() {
function getApiClient() {
return createApiClientWithDetails(getApiDetails());
}
function getAuthorizationHeaderFor(logger, apiDetails, url2) {
if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
logger.debug(`Providing an authorization token.`);
return `token ${apiDetails.auth}`;
}
logger.debug(`Not using an authorization token.`);
return void 0;
}
var cachedGitHubVersion = void 0;
async function getGitHubVersionFromApi(apiClient, apiDetails) {
if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
@@ -128745,7 +128792,6 @@ function wrapCliConfigurationError(cliError) {
// src/config-utils.ts
var fs9 = __toESM(require("fs"));
var path10 = __toESM(require("path"));
var semver4 = __toESM(require_semver2());
// src/analyses.ts
var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
@@ -128774,6 +128820,15 @@ var CodeQuality = {
// src/caching-utils.ts
var core6 = __toESM(require_core());
// src/config/db-config.ts
var semver2 = __toESM(require_semver2());
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
// src/diff-informed-analysis-utils.ts
var fs8 = __toESM(require("fs"));
var path9 = __toESM(require("path"));
@@ -128781,11 +128836,11 @@ var path9 = __toESM(require("path"));
// src/feature-flags.ts
var fs7 = __toESM(require("fs"));
var path8 = __toESM(require("path"));
var semver3 = __toESM(require_semver2());
var semver4 = __toESM(require_semver2());
// src/defaults.json
var bundleVersion = "codeql-bundle-v2.23.0";
var cliVersion = "2.23.0";
var bundleVersion = "codeql-bundle-v2.23.1";
var cliVersion = "2.23.1";
// src/overlay-database-utils.ts
var fs6 = __toESM(require("fs"));
@@ -129015,7 +129070,7 @@ function formatDuration(durationMs) {
}
// src/overlay-database-utils.ts
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -129076,13 +129131,13 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
}
// src/tools-features.ts
var semver2 = __toESM(require_semver2());
var semver3 = __toESM(require_semver2());
function isSupportedToolsFeature(versionInfo, feature) {
return !!versionInfo.features && versionInfo.features[feature];
}
var SafeArtifactUploadVersion = "2.20.3";
function isSafeArtifactUpload(codeQlVersion) {
return !codeQlVersion ? true : semver2.gte(codeQlVersion, SafeArtifactUploadVersion);
return !codeQlVersion ? true : semver3.gte(codeQlVersion, SafeArtifactUploadVersion);
}
// src/feature-flags.ts
@@ -129129,6 +129184,12 @@ var featureConfig = {
legacyApi: true,
minimumVersion: void 0
},
["resolve_supported_languages_using_cli" /* ResolveSupportedLanguagesUsingCli */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI",
minimumVersion: void 0,
toolsFeature: "builtinExtractorsSpecifyDefaultQueries" /* BuiltinExtractorsSpecifyDefaultQueries */
},
["overlay_analysis" /* OverlayAnalysis */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -129240,11 +129301,21 @@ var featureConfig = {
minimumVersion: void 0,
toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
},
["use_repository_properties" /* UseRepositoryProperties */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
minimumVersion: void 0
},
["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_QA_TELEMETRY",
legacyApi: true,
minimumVersion: void 0
},
["java_minimize_dependency_jars" /* JavaMinimizeDependencyJars */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_JAVA_MINIMIZE_DEPENDENCY_JARS",
minimumVersion: "2.23.0"
}
};
var FEATURE_FLAGS_FILE_NAME = "cached-feature-flags.json";
@@ -129353,7 +129424,7 @@ var GitHubFeatureFlags = class {
DEFAULT_VERSION_FEATURE_FLAG_PREFIX.length,
f.length - DEFAULT_VERSION_FEATURE_FLAG_SUFFIX.length
).replace(/_/g, ".");
if (!semver3.valid(version)) {
if (!semver4.valid(version)) {
this.logger.warning(
`Ignoring feature flag ${f} as it does not specify a valid CodeQL version.`
);
@@ -129558,12 +129629,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
};
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
function getPathToParsedConfigFile(tempDir) {
return path10.join(tempDir, "config");
}
@@ -129575,7 +129640,18 @@ async function getConfig(tempDir, logger) {
const configString = fs9.readFileSync(configFile, "utf8");
logger.debug("Loaded config:");
logger.debug(configString);
return JSON.parse(configString);
const config = JSON.parse(configString);
if (config.version === void 0) {
throw new ConfigurationError(
`Loaded configuration file, but it does not contain the expected 'version' field.`
);
}
if (config.version !== getActionVersion()) {
throw new ConfigurationError(
`Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
);
}
return config;
}
function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
const augmentedConfig = cloneObject(cliConfig);
@@ -129603,7 +129679,7 @@ var toolcache3 = __toESM(require_tool_cache());
var import_fast_deep_equal = __toESM(require_fast_deep_equal());
var semver7 = __toESM(require_semver2());
// node_modules/uuid/dist/stringify.js
// node_modules/uuid/dist-node/stringify.js
var byteToHex = [];
for (let i = 0; i < 256; ++i) {
byteToHex.push((i + 256).toString(16).slice(1));
@@ -129612,7 +129688,7 @@ function unsafeStringify(arr, offset = 0) {
return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase();
}
// node_modules/uuid/dist/rng.js
// node_modules/uuid/dist-node/rng.js
var import_node_crypto = require("node:crypto");
var rnds8Pool = new Uint8Array(256);
var poolPtr = rnds8Pool.length;
@@ -129624,11 +129700,11 @@ function rng() {
return rnds8Pool.slice(poolPtr, poolPtr += 16);
}
// node_modules/uuid/dist/native.js
// node_modules/uuid/dist-node/native.js
var import_node_crypto2 = require("node:crypto");
var native_default = { randomUUID: import_node_crypto2.randomUUID };
// node_modules/uuid/dist/v4.js
// node_modules/uuid/dist-node/v4.js
function _v4(options, buf, offset) {
options = options || {};
const rnds = options.random ?? options.rng?.() ?? rng();
@@ -129971,7 +130047,10 @@ function sanitizeUrlForStatusReport(url2) {
// src/setup-codeql.ts
var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
var CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing";
var CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";
var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"];
var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
function getCodeQLBundleExtension(compressionMethod) {
switch (compressionMethod) {
case "gzip":
@@ -130114,7 +130193,7 @@ async function findOverridingToolsInCache(humanReadableVersion, logger) {
return void 0;
}
async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, variant, tarSupportsZstd, logger) {
if (toolsInput && !CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput) && !toolsInput.startsWith("http")) {
if (toolsInput && !isReservedToolsValue(toolsInput) && !toolsInput.startsWith("http")) {
logger.info(`Using CodeQL CLI from local path ${toolsInput}`);
const compressionMethod2 = inferCompressionMethod(toolsInput);
if (compressionMethod2 === void 0) {
@@ -130143,6 +130222,12 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
let cliVersion2;
let tagName;
let url2;
if (toolsInput !== void 0 && CODEQL_NIGHTLY_TOOLS_INPUTS.includes(toolsInput)) {
logger.info(
`Using the latest CodeQL CLI nightly, as requested by 'tools: ${toolsInput}'.`
);
toolsInput = await getNightlyToolsUrl(logger);
}
if (forceShippedTools) {
cliVersion2 = cliVersion;
tagName = bundleVersion;
@@ -130295,11 +130380,12 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer
let authorization = void 0;
if (searchParams.has("token")) {
logger.debug("CodeQL tools URL contains an authorization token.");
} else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) {
logger.debug("Providing an authorization token to download CodeQL tools.");
authorization = `token ${apiDetails.auth}`;
} else {
logger.debug("Downloading CodeQL tools without an authorization token.");
authorization = getAuthorizationHeaderFor(
logger,
apiDetails,
codeqlURL
);
}
const toolcacheInfo = getToolcacheDestinationInfo(
maybeBundleVersion,
@@ -130426,6 +130512,34 @@ async function useZstdBundle(cliVersion2, tarSupportsZstd) {
function getTempExtractionDir(tempDir) {
return path12.join(tempDir, v4_default());
}
async function getNightlyToolsUrl(logger) {
const zstdAvailability = await isZstdAvailable(logger);
const compressionMethod = await useZstdBundle(
CODEQL_VERSION_ZSTD_BUNDLE,
zstdAvailability.available
) ? "zstd" : "gzip";
try {
const release3 = await getApiClient().rest.repos.listReleases({
owner: CODEQL_NIGHTLIES_REPOSITORY_OWNER,
repo: CODEQL_NIGHTLIES_REPOSITORY_NAME,
per_page: 1,
page: 1,
prerelease: true
});
const latestRelease = release3.data[0];
if (!latestRelease) {
throw new Error("Could not find the latest nightly release.");
}
return `https://github.com/${CODEQL_NIGHTLIES_REPOSITORY_OWNER}/${CODEQL_NIGHTLIES_REPOSITORY_NAME}/releases/download/${latestRelease.tag_name}/${getCodeQLBundleName(compressionMethod)}`;
} catch (e) {
throw new Error(
`Failed to retrieve the latest nightly release: ${wrapError(e)}`
);
}
}
function isReservedToolsValue(tools) {
return CODEQL_BUNDLE_VERSION_ALIAS.includes(tools) || CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools);
}
// src/tracer-config.ts
async function shouldEnableIndirectTracing(codeql, config) {
@@ -130679,13 +130793,16 @@ async function getCodeQLForCmd(cmd, checkVersion) {
);
}
},
async betterResolveLanguages() {
async betterResolveLanguages({
filterToLanguagesWithQueries
} = { filterToLanguagesWithQueries: false }) {
const codeqlArgs = [
"resolve",
"languages",
"--format=betterjson",
"--extractor-options-verbosity=4",
"--extractor-include-aliases",
...filterToLanguagesWithQueries ? ["--filter-to-languages-with-queries"] : [],
...getExtraOptionsFromEnv(["resolve", "languages"])
];
const output = await runCli(cmd, codeqlArgs);
@@ -133274,7 +133391,8 @@ function toCodedErrors(errors) {
}
var WorkflowErrors = toCodedErrors({
MissingPushHook: `Please specify an on.push hook to analyze and see code scanning alerts from the default branch on the Security tab.`,
CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`
CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
InconsistentActionVersion: `Not all workflow steps that use \`github/codeql-action\` actions use the same version. Please ensure that all such steps use the same version to avoid compatibility issues.`
});
async function getWorkflow(logger) {
const maybeWorkflow = process.env["CODE_SCANNING_WORKFLOW_FILE"];
lib/init-action.js
Generated
+857 -538
View File
File diff suppressed because it is too large Load Diff
lib/resolve-environment-action.js
Generated
+102 -31
View File
@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
"package.json"(exports2, module2) {
module2.exports = {
name: "codeql",
version: "3.30.3",
version: "3.30.4",
private: true,
description: "CodeQL action",
scripts: {
@@ -26447,7 +26447,7 @@ var require_package = __commonJS({
lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
"lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
"lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
test: "npm run transpile && ava src/**.test.ts --serial --verbose",
test: "npm run transpile && ava src/ --serial --verbose",
"test-debug": "npm run test -- --timeout=20m",
transpile: "tsc --build --verbose"
},
@@ -26463,7 +26463,7 @@ var require_package = __commonJS({
dependencies: {
"@actions/artifact": "^2.3.1",
"@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
"@actions/cache": "^4.0.5",
"@actions/cache": "^4.1.0",
"@actions/core": "^1.11.1",
"@actions/exec": "^1.1.1",
"@actions/github": "^6.0.0",
@@ -26486,15 +26486,15 @@ var require_package = __commonJS({
"node-forge": "^1.3.1",
octokit: "^5.0.3",
semver: "^7.7.2",
uuid: "^12.0.0"
uuid: "^13.0.0"
},
devDependencies: {
"@ava/typescript": "6.0.0",
"@eslint/compat": "^1.3.2",
"@eslint/compat": "^1.4.0",
"@eslint/eslintrc": "^3.3.1",
"@eslint/js": "^9.35.0",
"@eslint/js": "^9.36.0",
"@microsoft/eslint-formatter-sarif": "^3.1.0",
"@octokit/types": "^14.1.0",
"@octokit/types": "^15.0.0",
"@types/archiver": "^6.0.3",
"@types/console-log-level": "^1.4.5",
"@types/follow-redirects": "^1.14.4",
@@ -26503,10 +26503,10 @@ var require_package = __commonJS({
"@types/node-forge": "^1.3.14",
"@types/semver": "^7.7.1",
"@types/sinon": "^17.0.4",
"@typescript-eslint/eslint-plugin": "^8.43.0",
"@typescript-eslint/eslint-plugin": "^8.44.1",
"@typescript-eslint/parser": "^8.41.0",
ava: "^6.4.1",
esbuild: "^0.25.9",
esbuild: "^0.25.10",
eslint: "^8.57.1",
"eslint-import-resolver-typescript": "^3.8.7",
"eslint-plugin-filenames": "^1.3.2",
@@ -26536,7 +26536,8 @@ var require_package = __commonJS({
},
"eslint-plugin-jsx-a11y": {
semver: ">=6.3.1"
}
},
"brace-expansion@2.0.1": "2.0.2"
}
};
}
@@ -67281,7 +67282,7 @@ var require_package2 = __commonJS({
"node_modules/@actions/cache/package.json"(exports2, module2) {
module2.exports = {
name: "@actions/cache",
version: "4.0.5",
version: "4.1.0",
preview: true,
description: "Actions cache lib",
keywords: [
@@ -72090,11 +72091,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 9
/*ScalarType.STRING*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, signedUploadUrl: "" };
const message = { ok: false, signedUploadUrl: "", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72113,6 +72121,10 @@ var require_cache2 = __commonJS({
2:
message.signedUploadUrl = reader.string();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -72129,6 +72141,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.signedUploadUrl !== "")
writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -72234,11 +72248,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 3
/*ScalarType.INT64*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, entryId: "0" };
const message = { ok: false, entryId: "0", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72257,6 +72278,10 @@ var require_cache2 = __commonJS({
2:
message.entryId = reader.int64().toString();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -72273,6 +72298,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.entryId !== "0")
writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -73036,7 +73063,7 @@ var require_cache3 = __commonJS({
});
};
Object.defineProperty(exports2, "__esModule", { value: true });
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
var core13 = __importStar4(require_core());
var path5 = __importStar4(require("path"));
var utils = __importStar4(require_cacheUtils());
@@ -73044,7 +73071,6 @@ var require_cache3 = __commonJS({
var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
var config_1 = require_config();
var tar_1 = require_tar();
var constants_1 = require_constants7();
var http_client_1 = require_lib();
var ValidationError = class _ValidationError extends Error {
constructor(message) {
@@ -73062,6 +73088,14 @@ var require_cache3 = __commonJS({
}
};
exports2.ReserveCacheError = ReserveCacheError;
var FinalizeCacheError = class _FinalizeCacheError extends Error {
constructor(message) {
super(message);
this.name = "FinalizeCacheError";
Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
}
};
exports2.FinalizeCacheError = FinalizeCacheError;
function checkPaths(paths) {
if (!paths || paths.length === 0) {
throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -73333,9 +73367,6 @@ var require_cache3 = __commonJS({
}
const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
core13.debug(`File Size: ${archiveFileSize}`);
if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
}
options.archiveSizeBytes = archiveFileSize;
core13.debug("Reserving Cache");
const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -73347,7 +73378,10 @@ var require_cache3 = __commonJS({
try {
const response = yield twirpClient.CreateCacheEntry(request);
if (!response.ok) {
throw new Error("Response was not ok");
if (response.message) {
core13.warning(`Cache reservation failed: ${response.message}`);
}
throw new Error(response.message || "Response was not ok");
}
signedUploadUrl = response.signedUploadUrl;
} catch (error2) {
@@ -73364,6 +73398,9 @@ var require_cache3 = __commonJS({
const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
core13.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
if (!finalizeResponse.ok) {
if (finalizeResponse.message) {
throw new FinalizeCacheError(finalizeResponse.message);
}
throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
}
cacheId = parseInt(finalizeResponse.entryId);
@@ -73373,6 +73410,8 @@ var require_cache3 = __commonJS({
throw error2;
} else if (typedError.name === ReserveCacheError.name) {
core13.info(`Failed to save: ${typedError.message}`);
} else if (typedError.name === FinalizeCacheError.name) {
core13.warning(typedError.message);
} else {
if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
core13.error(`Failed to save: ${typedError.message}`);
@@ -78227,7 +78266,6 @@ function wrapCliConfigurationError(cliError) {
// src/config-utils.ts
var fs3 = __toESM(require("fs"));
var path3 = __toESM(require("path"));
var semver4 = __toESM(require_semver2());
// src/analyses.ts
var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
@@ -78240,8 +78278,17 @@ var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
// src/caching-utils.ts
var core6 = __toESM(require_core());
// src/config/db-config.ts
var semver2 = __toESM(require_semver2());
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
// src/feature-flags.ts
var semver3 = __toESM(require_semver2());
var semver4 = __toESM(require_semver2());
// src/overlay-database-utils.ts
var fs2 = __toESM(require("fs"));
@@ -78418,7 +78465,7 @@ function getActionsLogger() {
}
// src/overlay-database-utils.ts
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -78479,7 +78526,7 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
}
// src/tools-features.ts
var semver2 = __toESM(require_semver2());
var semver3 = __toESM(require_semver2());
function isSupportedToolsFeature(versionInfo, feature) {
return !!versionInfo.features && versionInfo.features[feature];
}
@@ -78525,6 +78572,12 @@ var featureConfig = {
legacyApi: true,
minimumVersion: void 0
},
["resolve_supported_languages_using_cli" /* ResolveSupportedLanguagesUsingCli */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI",
minimumVersion: void 0,
toolsFeature: "builtinExtractorsSpecifyDefaultQueries" /* BuiltinExtractorsSpecifyDefaultQueries */
},
["overlay_analysis" /* OverlayAnalysis */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -78636,11 +78689,21 @@ var featureConfig = {
minimumVersion: void 0,
toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
},
["use_repository_properties" /* UseRepositoryProperties */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
minimumVersion: void 0
},
["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_QA_TELEMETRY",
legacyApi: true,
minimumVersion: void 0
},
["java_minimize_dependency_jars" /* JavaMinimizeDependencyJars */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_JAVA_MINIMIZE_DEPENDENCY_JARS",
minimumVersion: "2.23.0"
}
};
@@ -78672,12 +78735,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
};
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
function getPathToParsedConfigFile(tempDir) {
return path3.join(tempDir, "config");
}
@@ -78689,7 +78746,18 @@ async function getConfig(tempDir, logger) {
const configString = fs3.readFileSync(configFile, "utf8");
logger.debug("Loaded config:");
logger.debug(configString);
return JSON.parse(configString);
const config = JSON.parse(configString);
if (config.version === void 0) {
throw new ConfigurationError(
`Loaded configuration file, but it does not contain the expected 'version' field.`
);
}
if (config.version !== getActionVersion()) {
throw new ConfigurationError(
`Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
);
}
return config;
}
function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
const augmentedConfig = cloneObject(cliConfig);
@@ -78941,13 +79009,16 @@ async function getCodeQLForCmd(cmd, checkVersion) {
);
}
},
async betterResolveLanguages() {
async betterResolveLanguages({
filterToLanguagesWithQueries
} = { filterToLanguagesWithQueries: false }) {
const codeqlArgs = [
"resolve",
"languages",
"--format=betterjson",
"--extractor-options-verbosity=4",
"--extractor-include-aliases",
...filterToLanguagesWithQueries ? ["--filter-to-languages-with-queries"] : [],
...getExtraOptionsFromEnv(["resolve", "languages"])
];
const output = await runCli(cmd, codeqlArgs);
lib/start-proxy-action-post.js
Generated
+108 -40
View File
@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
"package.json"(exports2, module2) {
module2.exports = {
name: "codeql",
version: "3.30.3",
version: "3.30.4",
private: true,
description: "CodeQL action",
scripts: {
@@ -26447,7 +26447,7 @@ var require_package = __commonJS({
lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
"lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
"lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
test: "npm run transpile && ava src/**.test.ts --serial --verbose",
test: "npm run transpile && ava src/ --serial --verbose",
"test-debug": "npm run test -- --timeout=20m",
transpile: "tsc --build --verbose"
},
@@ -26463,7 +26463,7 @@ var require_package = __commonJS({
dependencies: {
"@actions/artifact": "^2.3.1",
"@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
"@actions/cache": "^4.0.5",
"@actions/cache": "^4.1.0",
"@actions/core": "^1.11.1",
"@actions/exec": "^1.1.1",
"@actions/github": "^6.0.0",
@@ -26486,15 +26486,15 @@ var require_package = __commonJS({
"node-forge": "^1.3.1",
octokit: "^5.0.3",
semver: "^7.7.2",
uuid: "^12.0.0"
uuid: "^13.0.0"
},
devDependencies: {
"@ava/typescript": "6.0.0",
"@eslint/compat": "^1.3.2",
"@eslint/compat": "^1.4.0",
"@eslint/eslintrc": "^3.3.1",
"@eslint/js": "^9.35.0",
"@eslint/js": "^9.36.0",
"@microsoft/eslint-formatter-sarif": "^3.1.0",
"@octokit/types": "^14.1.0",
"@octokit/types": "^15.0.0",
"@types/archiver": "^6.0.3",
"@types/console-log-level": "^1.4.5",
"@types/follow-redirects": "^1.14.4",
@@ -26503,10 +26503,10 @@ var require_package = __commonJS({
"@types/node-forge": "^1.3.14",
"@types/semver": "^7.7.1",
"@types/sinon": "^17.0.4",
"@typescript-eslint/eslint-plugin": "^8.43.0",
"@typescript-eslint/eslint-plugin": "^8.44.1",
"@typescript-eslint/parser": "^8.41.0",
ava: "^6.4.1",
esbuild: "^0.25.9",
esbuild: "^0.25.10",
eslint: "^8.57.1",
"eslint-import-resolver-typescript": "^3.8.7",
"eslint-plugin-filenames": "^1.3.2",
@@ -26536,7 +26536,8 @@ var require_package = __commonJS({
},
"eslint-plugin-jsx-a11y": {
semver: ">=6.3.1"
}
},
"brace-expansion@2.0.1": "2.0.2"
}
};
}
@@ -67281,7 +67282,7 @@ var require_package2 = __commonJS({
"node_modules/@actions/cache/package.json"(exports2, module2) {
module2.exports = {
name: "@actions/cache",
version: "4.0.5",
version: "4.1.0",
preview: true,
description: "Actions cache lib",
keywords: [
@@ -72090,11 +72091,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 9
/*ScalarType.STRING*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, signedUploadUrl: "" };
const message = { ok: false, signedUploadUrl: "", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72113,6 +72121,10 @@ var require_cache2 = __commonJS({
2:
message.signedUploadUrl = reader.string();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -72129,6 +72141,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.signedUploadUrl !== "")
writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -72234,11 +72248,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 3
/*ScalarType.INT64*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, entryId: "0" };
const message = { ok: false, entryId: "0", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72257,6 +72278,10 @@ var require_cache2 = __commonJS({
2:
message.entryId = reader.int64().toString();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -72273,6 +72298,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.entryId !== "0")
writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -73036,7 +73063,7 @@ var require_cache3 = __commonJS({
});
};
Object.defineProperty(exports2, "__esModule", { value: true });
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
var core14 = __importStar4(require_core());
var path2 = __importStar4(require("path"));
var utils = __importStar4(require_cacheUtils());
@@ -73044,7 +73071,6 @@ var require_cache3 = __commonJS({
var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
var config_1 = require_config();
var tar_1 = require_tar();
var constants_1 = require_constants7();
var http_client_1 = require_lib();
var ValidationError = class _ValidationError extends Error {
constructor(message) {
@@ -73062,6 +73088,14 @@ var require_cache3 = __commonJS({
}
};
exports2.ReserveCacheError = ReserveCacheError2;
var FinalizeCacheError = class _FinalizeCacheError extends Error {
constructor(message) {
super(message);
this.name = "FinalizeCacheError";
Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
}
};
exports2.FinalizeCacheError = FinalizeCacheError;
function checkPaths(paths) {
if (!paths || paths.length === 0) {
throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -73333,9 +73367,6 @@ var require_cache3 = __commonJS({
}
const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
core14.debug(`File Size: ${archiveFileSize}`);
if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
}
options.archiveSizeBytes = archiveFileSize;
core14.debug("Reserving Cache");
const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -73347,7 +73378,10 @@ var require_cache3 = __commonJS({
try {
const response = yield twirpClient.CreateCacheEntry(request);
if (!response.ok) {
throw new Error("Response was not ok");
if (response.message) {
core14.warning(`Cache reservation failed: ${response.message}`);
}
throw new Error(response.message || "Response was not ok");
}
signedUploadUrl = response.signedUploadUrl;
} catch (error2) {
@@ -73364,6 +73398,9 @@ var require_cache3 = __commonJS({
const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
if (!finalizeResponse.ok) {
if (finalizeResponse.message) {
throw new FinalizeCacheError(finalizeResponse.message);
}
throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
}
cacheId = parseInt(finalizeResponse.entryId);
@@ -73373,6 +73410,8 @@ var require_cache3 = __commonJS({
throw error2;
} else if (typedError.name === ReserveCacheError2.name) {
core14.info(`Failed to save: ${typedError.message}`);
} else if (typedError.name === FinalizeCacheError.name) {
core14.warning(typedError.message);
} else {
if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
core14.error(`Failed to save: ${typedError.message}`);
@@ -76345,7 +76384,7 @@ var require_brace_expansion2 = __commonJS({
var isSequence = isNumericSequence || isAlphaSequence;
var isOptions = m.body.indexOf(",") >= 0;
if (!isSequence && !isOptions) {
if (m.post.match(/,.*\}/)) {
if (m.post.match(/,(?!,).*\}/)) {
str2 = m.pre + "{" + m.body + escClose + m.post;
return expand(str2);
}
@@ -93455,7 +93494,7 @@ var require_commonjs16 = __commonJS({
var TYPEMASK = 1023;
var entToType = (s) => s.isFile() ? IFREG : s.isDirectory() ? IFDIR : s.isSymbolicLink() ? IFLNK : s.isCharacterDevice() ? IFCHR : s.isBlockDevice() ? IFBLK : s.isSocket() ? IFSOCK : s.isFIFO() ? IFIFO : UNKNOWN;
var normalizeCache = /* @__PURE__ */ new Map();
var normalize2 = (s) => {
var normalize = (s) => {
const c = normalizeCache.get(s);
if (c)
return c;
@@ -93468,7 +93507,7 @@ var require_commonjs16 = __commonJS({
const c = normalizeNocaseCache.get(s);
if (c)
return c;
const n = normalize2(s.toLowerCase());
const n = normalize(s.toLowerCase());
normalizeNocaseCache.set(s, n);
return n;
};
@@ -93637,7 +93676,7 @@ var require_commonjs16 = __commonJS({
*/
constructor(name, type2 = UNKNOWN, root, roots, nocase, children, opts) {
this.name = name;
this.#matchName = nocase ? normalizeNocase(name) : normalize2(name);
this.#matchName = nocase ? normalizeNocase(name) : normalize(name);
this.#type = type2 & TYPEMASK;
this.nocase = nocase;
this.roots = roots;
@@ -93730,7 +93769,7 @@ var require_commonjs16 = __commonJS({
return this.parent || this;
}
const children = this.children();
const name = this.nocase ? normalizeNocase(pathPart) : normalize2(pathPart);
const name = this.nocase ? normalizeNocase(pathPart) : normalize(pathPart);
for (const p of children) {
if (p.#matchName === name) {
return p;
@@ -93975,7 +94014,7 @@ var require_commonjs16 = __commonJS({
* directly.
*/
isNamed(n) {
return !this.nocase ? this.#matchName === normalize2(n) : this.#matchName === normalizeNocase(n);
return !this.nocase ? this.#matchName === normalize(n) : this.#matchName === normalizeNocase(n);
}
/**
* Return the Path object corresponding to the target of a symbolic link.
@@ -94114,7 +94153,7 @@ var require_commonjs16 = __commonJS({
#readdirMaybePromoteChild(e, c) {
for (let p = c.provisional; p < c.length; p++) {
const pchild = c[p];
const name = this.nocase ? normalizeNocase(e.name) : normalize2(e.name);
const name = this.nocase ? normalizeNocase(e.name) : normalize(e.name);
if (name !== pchild.#matchName) {
continue;
}
@@ -101945,7 +101984,7 @@ var require_tr46 = __commonJS({
TRANSITIONAL: 0,
NONTRANSITIONAL: 1
};
function normalize2(str2) {
function normalize(str2) {
return str2.split("\0").map(function(s) {
return s.normalize("NFC");
}).join("\0");
@@ -102025,7 +102064,7 @@ var require_tr46 = __commonJS({
processing_option = PROCESSING_OPTIONS.NONTRANSITIONAL;
}
var error2 = false;
if (normalize2(label) !== label || label[3] === "-" && label[4] === "-" || label[0] === "-" || label[label.length - 1] === "-" || label.indexOf(".") !== -1 || label.search(combiningMarksRegex) === 0) {
if (normalize(label) !== label || label[3] === "-" && label[4] === "-" || label[0] === "-" || label[label.length - 1] === "-" || label.indexOf(".") !== -1 || label.search(combiningMarksRegex) === 0) {
error2 = true;
}
var len = countSymbols(label);
@@ -102043,7 +102082,7 @@ var require_tr46 = __commonJS({
}
function processing(domain_name, useSTD3, processing_option) {
var result = mapChars(domain_name, useSTD3, processing_option);
result.string = normalize2(result.string);
result.string = normalize(result.string);
var labels = result.string.split(".");
for (var i = 0; i < labels.length; ++i) {
try {
@@ -117126,7 +117165,6 @@ async function getGitHubVersion() {
// src/config-utils.ts
var fs = __toESM(require("fs"));
var path = __toESM(require("path"));
var semver4 = __toESM(require_semver2());
// src/analyses.ts
var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
@@ -117139,8 +117177,17 @@ var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
// src/caching-utils.ts
var core6 = __toESM(require_core());
// src/config/db-config.ts
var semver2 = __toESM(require_semver2());
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
// src/feature-flags.ts
var semver3 = __toESM(require_semver2());
var semver4 = __toESM(require_semver2());
// src/overlay-database-utils.ts
var actionsCache = __toESM(require_cache3());
@@ -117157,12 +117204,12 @@ function getActionsLogger() {
}
// src/overlay-database-utils.ts
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
// src/tools-features.ts
var semver2 = __toESM(require_semver2());
var semver3 = __toESM(require_semver2());
// src/feature-flags.ts
var featureConfig = {
@@ -117205,6 +117252,12 @@ var featureConfig = {
legacyApi: true,
minimumVersion: void 0
},
["resolve_supported_languages_using_cli" /* ResolveSupportedLanguagesUsingCli */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI",
minimumVersion: void 0,
toolsFeature: "builtinExtractorsSpecifyDefaultQueries" /* BuiltinExtractorsSpecifyDefaultQueries */
},
["overlay_analysis" /* OverlayAnalysis */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -117316,11 +117369,21 @@ var featureConfig = {
minimumVersion: void 0,
toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
},
["use_repository_properties" /* UseRepositoryProperties */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
minimumVersion: void 0
},
["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_QA_TELEMETRY",
legacyApi: true,
minimumVersion: void 0
},
["java_minimize_dependency_jars" /* JavaMinimizeDependencyJars */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_JAVA_MINIMIZE_DEPENDENCY_JARS",
minimumVersion: "2.23.0"
}
};
@@ -117352,12 +117415,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
};
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
function getPathToParsedConfigFile(tempDir) {
return path.join(tempDir, "config");
}
@@ -117369,7 +117426,18 @@ async function getConfig(tempDir, logger) {
const configString = fs.readFileSync(configFile, "utf8");
logger.debug("Loaded config:");
logger.debug(configString);
return JSON.parse(configString);
const config = JSON.parse(configString);
if (config.version === void 0) {
throw new ConfigurationError(
`Loaded configuration file, but it does not contain the expected 'version' field.`
);
}
if (config.version !== getActionVersion()) {
throw new ConfigurationError(
`Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
);
}
return config;
}
// src/debug-artifacts.ts
lib/start-proxy-action.js
Generated
+1750 -74
View File
File diff suppressed because it is too large Load Diff
lib/upload-lib.js
Generated
+162 -45
View File
@@ -29019,7 +29019,7 @@ var require_pattern = __commonJS({
const absolute = [];
const relative2 = [];
for (const pattern of patterns) {
if (isAbsolute3(pattern)) {
if (isAbsolute2(pattern)) {
absolute.push(pattern);
} else {
relative2.push(pattern);
@@ -29028,10 +29028,10 @@ var require_pattern = __commonJS({
return [absolute, relative2];
}
exports2.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
function isAbsolute3(pattern) {
function isAbsolute2(pattern) {
return path15.isAbsolute(pattern);
}
exports2.isAbsolute = isAbsolute3;
exports2.isAbsolute = isAbsolute2;
}
});
@@ -33584,7 +33584,7 @@ var require_package = __commonJS({
"package.json"(exports2, module2) {
module2.exports = {
name: "codeql",
version: "3.30.3",
version: "3.30.4",
private: true,
description: "CodeQL action",
scripts: {
@@ -33593,7 +33593,7 @@ var require_package = __commonJS({
lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
"lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
"lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
test: "npm run transpile && ava src/**.test.ts --serial --verbose",
test: "npm run transpile && ava src/ --serial --verbose",
"test-debug": "npm run test -- --timeout=20m",
transpile: "tsc --build --verbose"
},
@@ -33609,7 +33609,7 @@ var require_package = __commonJS({
dependencies: {
"@actions/artifact": "^2.3.1",
"@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
"@actions/cache": "^4.0.5",
"@actions/cache": "^4.1.0",
"@actions/core": "^1.11.1",
"@actions/exec": "^1.1.1",
"@actions/github": "^6.0.0",
@@ -33632,15 +33632,15 @@ var require_package = __commonJS({
"node-forge": "^1.3.1",
octokit: "^5.0.3",
semver: "^7.7.2",
uuid: "^12.0.0"
uuid: "^13.0.0"
},
devDependencies: {
"@ava/typescript": "6.0.0",
"@eslint/compat": "^1.3.2",
"@eslint/compat": "^1.4.0",
"@eslint/eslintrc": "^3.3.1",
"@eslint/js": "^9.35.0",
"@eslint/js": "^9.36.0",
"@microsoft/eslint-formatter-sarif": "^3.1.0",
"@octokit/types": "^14.1.0",
"@octokit/types": "^15.0.0",
"@types/archiver": "^6.0.3",
"@types/console-log-level": "^1.4.5",
"@types/follow-redirects": "^1.14.4",
@@ -33649,10 +33649,10 @@ var require_package = __commonJS({
"@types/node-forge": "^1.3.14",
"@types/semver": "^7.7.1",
"@types/sinon": "^17.0.4",
"@typescript-eslint/eslint-plugin": "^8.43.0",
"@typescript-eslint/eslint-plugin": "^8.44.1",
"@typescript-eslint/parser": "^8.41.0",
ava: "^6.4.1",
esbuild: "^0.25.9",
esbuild: "^0.25.10",
eslint: "^8.57.1",
"eslint-import-resolver-typescript": "^3.8.7",
"eslint-plugin-filenames": "^1.3.2",
@@ -33682,7 +33682,8 @@ var require_package = __commonJS({
},
"eslint-plugin-jsx-a11y": {
semver: ">=6.3.1"
}
},
"brace-expansion@2.0.1": "2.0.2"
}
};
}
@@ -74427,7 +74428,7 @@ var require_package2 = __commonJS({
"node_modules/@actions/cache/package.json"(exports2, module2) {
module2.exports = {
name: "@actions/cache",
version: "4.0.5",
version: "4.1.0",
preview: true,
description: "Actions cache lib",
keywords: [
@@ -79236,11 +79237,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 9
/*ScalarType.STRING*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, signedUploadUrl: "" };
const message = { ok: false, signedUploadUrl: "", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -79259,6 +79267,10 @@ var require_cache2 = __commonJS({
2:
message.signedUploadUrl = reader.string();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -79275,6 +79287,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.signedUploadUrl !== "")
writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -79380,11 +79394,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 3
/*ScalarType.INT64*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, entryId: "0" };
const message = { ok: false, entryId: "0", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -79403,6 +79424,10 @@ var require_cache2 = __commonJS({
2:
message.entryId = reader.int64().toString();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -79419,6 +79444,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.entryId !== "0")
writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -80182,7 +80209,7 @@ var require_cache3 = __commonJS({
});
};
Object.defineProperty(exports2, "__esModule", { value: true });
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
var core12 = __importStar4(require_core());
var path15 = __importStar4(require("path"));
var utils = __importStar4(require_cacheUtils());
@@ -80190,7 +80217,6 @@ var require_cache3 = __commonJS({
var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
var config_1 = require_config();
var tar_1 = require_tar();
var constants_1 = require_constants10();
var http_client_1 = require_lib();
var ValidationError = class _ValidationError extends Error {
constructor(message) {
@@ -80208,6 +80234,14 @@ var require_cache3 = __commonJS({
}
};
exports2.ReserveCacheError = ReserveCacheError;
var FinalizeCacheError = class _FinalizeCacheError extends Error {
constructor(message) {
super(message);
this.name = "FinalizeCacheError";
Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
}
};
exports2.FinalizeCacheError = FinalizeCacheError;
function checkPaths(paths) {
if (!paths || paths.length === 0) {
throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -80479,9 +80513,6 @@ var require_cache3 = __commonJS({
}
const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
core12.debug(`File Size: ${archiveFileSize}`);
if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
}
options.archiveSizeBytes = archiveFileSize;
core12.debug("Reserving Cache");
const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -80493,7 +80524,10 @@ var require_cache3 = __commonJS({
try {
const response = yield twirpClient.CreateCacheEntry(request);
if (!response.ok) {
throw new Error("Response was not ok");
if (response.message) {
core12.warning(`Cache reservation failed: ${response.message}`);
}
throw new Error(response.message || "Response was not ok");
}
signedUploadUrl = response.signedUploadUrl;
} catch (error2) {
@@ -80510,6 +80544,9 @@ var require_cache3 = __commonJS({
const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
core12.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
if (!finalizeResponse.ok) {
if (finalizeResponse.message) {
throw new FinalizeCacheError(finalizeResponse.message);
}
throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
}
cacheId = parseInt(finalizeResponse.entryId);
@@ -80519,6 +80556,8 @@ var require_cache3 = __commonJS({
throw error2;
} else if (typedError.name === ReserveCacheError.name) {
core12.info(`Failed to save: ${typedError.message}`);
} else if (typedError.name === FinalizeCacheError.name) {
core12.warning(typedError.message);
} else {
if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
core12.error(`Failed to save: ${typedError.message}`);
@@ -88543,6 +88582,14 @@ function getApiDetails() {
function getApiClient() {
return createApiClientWithDetails(getApiDetails());
}
function getAuthorizationHeaderFor(logger, apiDetails, url2) {
if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
logger.debug(`Providing an authorization token.`);
return `token ${apiDetails.auth}`;
}
logger.debug(`Not using an authorization token.`);
return void 0;
}
var cachedGitHubVersion = void 0;
async function getGitHubVersionFromApi(apiClient, apiDetails) {
if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
@@ -88872,7 +88919,6 @@ function wrapCliConfigurationError(cliError) {
// src/config-utils.ts
var fs7 = __toESM(require("fs"));
var path9 = __toESM(require("path"));
var semver4 = __toESM(require_semver2());
// src/analyses.ts
var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
@@ -88885,16 +88931,25 @@ var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
// src/caching-utils.ts
var core6 = __toESM(require_core());
// src/config/db-config.ts
var semver2 = __toESM(require_semver2());
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
// src/diff-informed-analysis-utils.ts
var fs6 = __toESM(require("fs"));
var path8 = __toESM(require("path"));
// src/feature-flags.ts
var semver3 = __toESM(require_semver2());
var semver4 = __toESM(require_semver2());
// src/defaults.json
var bundleVersion = "codeql-bundle-v2.23.0";
var cliVersion = "2.23.0";
var bundleVersion = "codeql-bundle-v2.23.1";
var cliVersion = "2.23.1";
// src/overlay-database-utils.ts
var fs5 = __toESM(require("fs"));
@@ -89113,7 +89168,7 @@ function formatDuration(durationMs) {
}
// src/overlay-database-utils.ts
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -89174,7 +89229,7 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
}
// src/tools-features.ts
var semver2 = __toESM(require_semver2());
var semver3 = __toESM(require_semver2());
function isSupportedToolsFeature(versionInfo, feature) {
return !!versionInfo.features && versionInfo.features[feature];
}
@@ -89221,6 +89276,12 @@ var featureConfig = {
legacyApi: true,
minimumVersion: void 0
},
["resolve_supported_languages_using_cli" /* ResolveSupportedLanguagesUsingCli */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI",
minimumVersion: void 0,
toolsFeature: "builtinExtractorsSpecifyDefaultQueries" /* BuiltinExtractorsSpecifyDefaultQueries */
},
["overlay_analysis" /* OverlayAnalysis */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -89332,11 +89393,21 @@ var featureConfig = {
minimumVersion: void 0,
toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
},
["use_repository_properties" /* UseRepositoryProperties */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
minimumVersion: void 0
},
["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_QA_TELEMETRY",
legacyApi: true,
minimumVersion: void 0
},
["java_minimize_dependency_jars" /* JavaMinimizeDependencyJars */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_JAVA_MINIMIZE_DEPENDENCY_JARS",
minimumVersion: "2.23.0"
}
};
@@ -89386,12 +89457,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
};
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
function getPathToParsedConfigFile(tempDir) {
return path9.join(tempDir, "config");
}
@@ -89403,7 +89468,18 @@ async function getConfig(tempDir, logger) {
const configString = fs7.readFileSync(configFile, "utf8");
logger.debug("Loaded config:");
logger.debug(configString);
return JSON.parse(configString);
const config = JSON.parse(configString);
if (config.version === void 0) {
throw new ConfigurationError(
`Loaded configuration file, but it does not contain the expected 'version' field.`
);
}
if (config.version !== getActionVersion()) {
throw new ConfigurationError(
`Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
);
}
return config;
}
function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
const augmentedConfig = cloneObject(cliConfig);
@@ -89431,7 +89507,7 @@ var toolcache3 = __toESM(require_tool_cache());
var import_fast_deep_equal = __toESM(require_fast_deep_equal());
var semver7 = __toESM(require_semver2());
// node_modules/uuid/dist/stringify.js
// node_modules/uuid/dist-node/stringify.js
var byteToHex = [];
for (let i = 0; i < 256; ++i) {
byteToHex.push((i + 256).toString(16).slice(1));
@@ -89440,7 +89516,7 @@ function unsafeStringify(arr, offset = 0) {
return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase();
}
// node_modules/uuid/dist/rng.js
// node_modules/uuid/dist-node/rng.js
var import_node_crypto = require("node:crypto");
var rnds8Pool = new Uint8Array(256);
var poolPtr = rnds8Pool.length;
@@ -89452,11 +89528,11 @@ function rng() {
return rnds8Pool.slice(poolPtr, poolPtr += 16);
}
// node_modules/uuid/dist/native.js
// node_modules/uuid/dist-node/native.js
var import_node_crypto2 = require("node:crypto");
var native_default = { randomUUID: import_node_crypto2.randomUUID };
// node_modules/uuid/dist/v4.js
// node_modules/uuid/dist-node/v4.js
function _v4(options, buf, offset) {
options = options || {};
const rnds = options.random ?? options.rng?.() ?? rng();
@@ -89799,7 +89875,10 @@ function sanitizeUrlForStatusReport(url2) {
// src/setup-codeql.ts
var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
var CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing";
var CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";
var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"];
var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
function getCodeQLBundleExtension(compressionMethod) {
switch (compressionMethod) {
case "gzip":
@@ -89942,7 +90021,7 @@ async function findOverridingToolsInCache(humanReadableVersion, logger) {
return void 0;
}
async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, variant, tarSupportsZstd, logger) {
if (toolsInput && !CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput) && !toolsInput.startsWith("http")) {
if (toolsInput && !isReservedToolsValue(toolsInput) && !toolsInput.startsWith("http")) {
logger.info(`Using CodeQL CLI from local path ${toolsInput}`);
const compressionMethod2 = inferCompressionMethod(toolsInput);
if (compressionMethod2 === void 0) {
@@ -89971,6 +90050,12 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
let cliVersion2;
let tagName;
let url2;
if (toolsInput !== void 0 && CODEQL_NIGHTLY_TOOLS_INPUTS.includes(toolsInput)) {
logger.info(
`Using the latest CodeQL CLI nightly, as requested by 'tools: ${toolsInput}'.`
);
toolsInput = await getNightlyToolsUrl(logger);
}
if (forceShippedTools) {
cliVersion2 = cliVersion;
tagName = bundleVersion;
@@ -90123,11 +90208,12 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer
let authorization = void 0;
if (searchParams.has("token")) {
logger.debug("CodeQL tools URL contains an authorization token.");
} else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) {
logger.debug("Providing an authorization token to download CodeQL tools.");
authorization = `token ${apiDetails.auth}`;
} else {
logger.debug("Downloading CodeQL tools without an authorization token.");
authorization = getAuthorizationHeaderFor(
logger,
apiDetails,
codeqlURL
);
}
const toolcacheInfo = getToolcacheDestinationInfo(
maybeBundleVersion,
@@ -90254,6 +90340,34 @@ async function useZstdBundle(cliVersion2, tarSupportsZstd) {
function getTempExtractionDir(tempDir) {
return path11.join(tempDir, v4_default());
}
async function getNightlyToolsUrl(logger) {
const zstdAvailability = await isZstdAvailable(logger);
const compressionMethod = await useZstdBundle(
CODEQL_VERSION_ZSTD_BUNDLE,
zstdAvailability.available
) ? "zstd" : "gzip";
try {
const release = await getApiClient().rest.repos.listReleases({
owner: CODEQL_NIGHTLIES_REPOSITORY_OWNER,
repo: CODEQL_NIGHTLIES_REPOSITORY_NAME,
per_page: 1,
page: 1,
prerelease: true
});
const latestRelease = release.data[0];
if (!latestRelease) {
throw new Error("Could not find the latest nightly release.");
}
return `https://github.com/${CODEQL_NIGHTLIES_REPOSITORY_OWNER}/${CODEQL_NIGHTLIES_REPOSITORY_NAME}/releases/download/${latestRelease.tag_name}/${getCodeQLBundleName(compressionMethod)}`;
} catch (e) {
throw new Error(
`Failed to retrieve the latest nightly release: ${wrapError(e)}`
);
}
}
function isReservedToolsValue(tools) {
return CODEQL_BUNDLE_VERSION_ALIAS.includes(tools) || CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools);
}
// src/tracer-config.ts
async function shouldEnableIndirectTracing(codeql, config) {
@@ -90507,13 +90621,16 @@ async function getCodeQLForCmd(cmd, checkVersion) {
);
}
},
async betterResolveLanguages() {
async betterResolveLanguages({
filterToLanguagesWithQueries
} = { filterToLanguagesWithQueries: false }) {
const codeqlArgs = [
"resolve",
"languages",
"--format=betterjson",
"--extractor-options-verbosity=4",
"--extractor-include-aliases",
...filterToLanguagesWithQueries ? ["--filter-to-languages-with-queries"] : [],
...getExtraOptionsFromEnv(["resolve", "languages"])
];
const output = await runCli(cmd, codeqlArgs);
lib/upload-sarif-action-post.js
Generated
+88 -33
View File
@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
"package.json"(exports2, module2) {
module2.exports = {
name: "codeql",
version: "3.30.3",
version: "3.30.4",
private: true,
description: "CodeQL action",
scripts: {
@@ -26447,7 +26447,7 @@ var require_package = __commonJS({
lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
"lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
"lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
test: "npm run transpile && ava src/**.test.ts --serial --verbose",
test: "npm run transpile && ava src/ --serial --verbose",
"test-debug": "npm run test -- --timeout=20m",
transpile: "tsc --build --verbose"
},
@@ -26463,7 +26463,7 @@ var require_package = __commonJS({
dependencies: {
"@actions/artifact": "^2.3.1",
"@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
"@actions/cache": "^4.0.5",
"@actions/cache": "^4.1.0",
"@actions/core": "^1.11.1",
"@actions/exec": "^1.1.1",
"@actions/github": "^6.0.0",
@@ -26486,15 +26486,15 @@ var require_package = __commonJS({
"node-forge": "^1.3.1",
octokit: "^5.0.3",
semver: "^7.7.2",
uuid: "^12.0.0"
uuid: "^13.0.0"
},
devDependencies: {
"@ava/typescript": "6.0.0",
"@eslint/compat": "^1.3.2",
"@eslint/compat": "^1.4.0",
"@eslint/eslintrc": "^3.3.1",
"@eslint/js": "^9.35.0",
"@eslint/js": "^9.36.0",
"@microsoft/eslint-formatter-sarif": "^3.1.0",
"@octokit/types": "^14.1.0",
"@octokit/types": "^15.0.0",
"@types/archiver": "^6.0.3",
"@types/console-log-level": "^1.4.5",
"@types/follow-redirects": "^1.14.4",
@@ -26503,10 +26503,10 @@ var require_package = __commonJS({
"@types/node-forge": "^1.3.14",
"@types/semver": "^7.7.1",
"@types/sinon": "^17.0.4",
"@typescript-eslint/eslint-plugin": "^8.43.0",
"@typescript-eslint/eslint-plugin": "^8.44.1",
"@typescript-eslint/parser": "^8.41.0",
ava: "^6.4.1",
esbuild: "^0.25.9",
esbuild: "^0.25.10",
eslint: "^8.57.1",
"eslint-import-resolver-typescript": "^3.8.7",
"eslint-plugin-filenames": "^1.3.2",
@@ -26536,7 +26536,8 @@ var require_package = __commonJS({
},
"eslint-plugin-jsx-a11y": {
semver: ">=6.3.1"
}
},
"brace-expansion@2.0.1": "2.0.2"
}
};
}
@@ -70467,7 +70468,7 @@ var require_brace_expansion = __commonJS({
var isSequence = isNumericSequence || isAlphaSequence;
var isOptions = m.body.indexOf(",") >= 0;
if (!isSequence && !isOptions) {
if (m.post.match(/,.*\}/)) {
if (m.post.match(/,(?!,).*\}/)) {
str2 = m.pre + "{" + m.body + escClose + m.post;
return expand(str2);
}
@@ -109983,7 +109984,7 @@ var require_package3 = __commonJS({
"node_modules/@actions/cache/package.json"(exports2, module2) {
module2.exports = {
name: "@actions/cache",
version: "4.0.5",
version: "4.1.0",
preview: true,
description: "Actions cache lib",
keywords: [
@@ -110566,11 +110567,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 9
/*ScalarType.STRING*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, signedUploadUrl: "" };
const message = { ok: false, signedUploadUrl: "", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -110589,6 +110597,10 @@ var require_cache2 = __commonJS({
2:
message.signedUploadUrl = reader.string();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -110605,6 +110617,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.signedUploadUrl !== "")
writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -110710,11 +110724,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 3
/*ScalarType.INT64*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, entryId: "0" };
const message = { ok: false, entryId: "0", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -110733,6 +110754,10 @@ var require_cache2 = __commonJS({
2:
message.entryId = reader.int64().toString();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -110749,6 +110774,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.entryId !== "0")
writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -111512,7 +111539,7 @@ var require_cache3 = __commonJS({
});
};
Object.defineProperty(exports2, "__esModule", { value: true });
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
var core14 = __importStar4(require_core());
var path2 = __importStar4(require("path"));
var utils = __importStar4(require_cacheUtils());
@@ -111520,7 +111547,6 @@ var require_cache3 = __commonJS({
var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
var config_1 = require_config2();
var tar_1 = require_tar2();
var constants_1 = require_constants10();
var http_client_1 = require_lib();
var ValidationError = class _ValidationError extends Error {
constructor(message) {
@@ -111538,6 +111564,14 @@ var require_cache3 = __commonJS({
}
};
exports2.ReserveCacheError = ReserveCacheError2;
var FinalizeCacheError = class _FinalizeCacheError extends Error {
constructor(message) {
super(message);
this.name = "FinalizeCacheError";
Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
}
};
exports2.FinalizeCacheError = FinalizeCacheError;
function checkPaths(paths) {
if (!paths || paths.length === 0) {
throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -111809,9 +111843,6 @@ var require_cache3 = __commonJS({
}
const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
core14.debug(`File Size: ${archiveFileSize}`);
if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
}
options.archiveSizeBytes = archiveFileSize;
core14.debug("Reserving Cache");
const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -111823,7 +111854,10 @@ var require_cache3 = __commonJS({
try {
const response = yield twirpClient.CreateCacheEntry(request);
if (!response.ok) {
throw new Error("Response was not ok");
if (response.message) {
core14.warning(`Cache reservation failed: ${response.message}`);
}
throw new Error(response.message || "Response was not ok");
}
signedUploadUrl = response.signedUploadUrl;
} catch (error2) {
@@ -111840,6 +111874,9 @@ var require_cache3 = __commonJS({
const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
if (!finalizeResponse.ok) {
if (finalizeResponse.message) {
throw new FinalizeCacheError(finalizeResponse.message);
}
throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
}
cacheId = parseInt(finalizeResponse.entryId);
@@ -111849,6 +111886,8 @@ var require_cache3 = __commonJS({
throw error2;
} else if (typedError.name === ReserveCacheError2.name) {
core14.info(`Failed to save: ${typedError.message}`);
} else if (typedError.name === FinalizeCacheError.name) {
core14.warning(typedError.message);
} else {
if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
core14.error(`Failed to save: ${typedError.message}`);
@@ -117286,14 +117325,20 @@ var cliErrorsConfig = {
}
};
// src/config-utils.ts
var semver4 = __toESM(require_semver2());
// src/caching-utils.ts
var core6 = __toESM(require_core());
// src/config/db-config.ts
var semver2 = __toESM(require_semver2());
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
// src/feature-flags.ts
var semver3 = __toESM(require_semver2());
var semver4 = __toESM(require_semver2());
// src/overlay-database-utils.ts
var actionsCache = __toESM(require_cache3());
@@ -117318,15 +117363,15 @@ function withGroup(groupName, f) {
}
// src/overlay-database-utils.ts
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
// src/tools-features.ts
var semver2 = __toESM(require_semver2());
var semver3 = __toESM(require_semver2());
var SafeArtifactUploadVersion = "2.20.3";
function isSafeArtifactUpload(codeQlVersion) {
return !codeQlVersion ? true : semver2.gte(codeQlVersion, SafeArtifactUploadVersion);
return !codeQlVersion ? true : semver3.gte(codeQlVersion, SafeArtifactUploadVersion);
}
// src/feature-flags.ts
@@ -117370,6 +117415,12 @@ var featureConfig = {
legacyApi: true,
minimumVersion: void 0
},
["resolve_supported_languages_using_cli" /* ResolveSupportedLanguagesUsingCli */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI",
minimumVersion: void 0,
toolsFeature: "builtinExtractorsSpecifyDefaultQueries" /* BuiltinExtractorsSpecifyDefaultQueries */
},
["overlay_analysis" /* OverlayAnalysis */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -117481,11 +117532,21 @@ var featureConfig = {
minimumVersion: void 0,
toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
},
["use_repository_properties" /* UseRepositoryProperties */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
minimumVersion: void 0
},
["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_QA_TELEMETRY",
legacyApi: true,
minimumVersion: void 0
},
["java_minimize_dependency_jars" /* JavaMinimizeDependencyJars */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_JAVA_MINIMIZE_DEPENDENCY_JARS",
minimumVersion: "2.23.0"
}
};
@@ -117517,12 +117578,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
};
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
// src/setup-codeql.ts
var toolcache3 = __toESM(require_tool_cache());
lib/upload-sarif-action.js
Generated
+232 -104
View File
@@ -27722,7 +27722,7 @@ var require_pattern = __commonJS({
const absolute = [];
const relative2 = [];
for (const pattern of patterns) {
if (isAbsolute3(pattern)) {
if (isAbsolute2(pattern)) {
absolute.push(pattern);
} else {
relative2.push(pattern);
@@ -27731,10 +27731,10 @@ var require_pattern = __commonJS({
return [absolute, relative2];
}
exports2.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
function isAbsolute3(pattern) {
function isAbsolute2(pattern) {
return path16.isAbsolute(pattern);
}
exports2.isAbsolute = isAbsolute3;
exports2.isAbsolute = isAbsolute2;
}
});
@@ -32287,7 +32287,7 @@ var require_package = __commonJS({
"package.json"(exports2, module2) {
module2.exports = {
name: "codeql",
version: "3.30.3",
version: "3.30.4",
private: true,
description: "CodeQL action",
scripts: {
@@ -32296,7 +32296,7 @@ var require_package = __commonJS({
lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
"lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
"lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
test: "npm run transpile && ava src/**.test.ts --serial --verbose",
test: "npm run transpile && ava src/ --serial --verbose",
"test-debug": "npm run test -- --timeout=20m",
transpile: "tsc --build --verbose"
},
@@ -32312,7 +32312,7 @@ var require_package = __commonJS({
dependencies: {
"@actions/artifact": "^2.3.1",
"@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
"@actions/cache": "^4.0.5",
"@actions/cache": "^4.1.0",
"@actions/core": "^1.11.1",
"@actions/exec": "^1.1.1",
"@actions/github": "^6.0.0",
@@ -32335,15 +32335,15 @@ var require_package = __commonJS({
"node-forge": "^1.3.1",
octokit: "^5.0.3",
semver: "^7.7.2",
uuid: "^12.0.0"
uuid: "^13.0.0"
},
devDependencies: {
"@ava/typescript": "6.0.0",
"@eslint/compat": "^1.3.2",
"@eslint/compat": "^1.4.0",
"@eslint/eslintrc": "^3.3.1",
"@eslint/js": "^9.35.0",
"@eslint/js": "^9.36.0",
"@microsoft/eslint-formatter-sarif": "^3.1.0",
"@octokit/types": "^14.1.0",
"@octokit/types": "^15.0.0",
"@types/archiver": "^6.0.3",
"@types/console-log-level": "^1.4.5",
"@types/follow-redirects": "^1.14.4",
@@ -32352,10 +32352,10 @@ var require_package = __commonJS({
"@types/node-forge": "^1.3.14",
"@types/semver": "^7.7.1",
"@types/sinon": "^17.0.4",
"@typescript-eslint/eslint-plugin": "^8.43.0",
"@typescript-eslint/eslint-plugin": "^8.44.1",
"@typescript-eslint/parser": "^8.41.0",
ava: "^6.4.1",
esbuild: "^0.25.9",
esbuild: "^0.25.10",
eslint: "^8.57.1",
"eslint-import-resolver-typescript": "^3.8.7",
"eslint-plugin-filenames": "^1.3.2",
@@ -32385,7 +32385,8 @@ var require_package = __commonJS({
},
"eslint-plugin-jsx-a11y": {
semver: ">=6.3.1"
}
},
"brace-expansion@2.0.1": "2.0.2"
}
};
}
@@ -73130,7 +73131,7 @@ var require_package2 = __commonJS({
"node_modules/@actions/cache/package.json"(exports2, module2) {
module2.exports = {
name: "@actions/cache",
version: "4.0.5",
version: "4.1.0",
preview: true,
description: "Actions cache lib",
keywords: [
@@ -77939,11 +77940,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 9
/*ScalarType.STRING*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, signedUploadUrl: "" };
const message = { ok: false, signedUploadUrl: "", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -77962,6 +77970,10 @@ var require_cache2 = __commonJS({
2:
message.signedUploadUrl = reader.string();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -77978,6 +77990,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.signedUploadUrl !== "")
writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78083,11 +78097,18 @@ var require_cache2 = __commonJS({
kind: "scalar",
T: 3
/*ScalarType.INT64*/
},
{
no: 3,
name: "message",
kind: "scalar",
T: 9
/*ScalarType.STRING*/
}
]);
}
create(value) {
const message = { ok: false, entryId: "0" };
const message = { ok: false, entryId: "0", message: "" };
globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
if (value !== void 0)
(0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -78106,6 +78127,10 @@ var require_cache2 = __commonJS({
2:
message.entryId = reader.int64().toString();
break;
case /* string message */
3:
message.message = reader.string();
break;
default:
let u = options.readUnknownField;
if (u === "throw")
@@ -78122,6 +78147,8 @@ var require_cache2 = __commonJS({
writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
if (message.entryId !== "0")
writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
if (message.message !== "")
writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
let u = options.writeUnknownFields;
if (u !== false)
(u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78885,7 +78912,7 @@ var require_cache3 = __commonJS({
});
};
Object.defineProperty(exports2, "__esModule", { value: true });
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
var core14 = __importStar4(require_core());
var path16 = __importStar4(require("path"));
var utils = __importStar4(require_cacheUtils());
@@ -78893,7 +78920,6 @@ var require_cache3 = __commonJS({
var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
var config_1 = require_config();
var tar_1 = require_tar();
var constants_1 = require_constants10();
var http_client_1 = require_lib();
var ValidationError = class _ValidationError extends Error {
constructor(message) {
@@ -78911,6 +78937,14 @@ var require_cache3 = __commonJS({
}
};
exports2.ReserveCacheError = ReserveCacheError;
var FinalizeCacheError = class _FinalizeCacheError extends Error {
constructor(message) {
super(message);
this.name = "FinalizeCacheError";
Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
}
};
exports2.FinalizeCacheError = FinalizeCacheError;
function checkPaths(paths) {
if (!paths || paths.length === 0) {
throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -79182,9 +79216,6 @@ var require_cache3 = __commonJS({
}
const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
core14.debug(`File Size: ${archiveFileSize}`);
if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
}
options.archiveSizeBytes = archiveFileSize;
core14.debug("Reserving Cache");
const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -79196,7 +79227,10 @@ var require_cache3 = __commonJS({
try {
const response = yield twirpClient.CreateCacheEntry(request);
if (!response.ok) {
throw new Error("Response was not ok");
if (response.message) {
core14.warning(`Cache reservation failed: ${response.message}`);
}
throw new Error(response.message || "Response was not ok");
}
signedUploadUrl = response.signedUploadUrl;
} catch (error2) {
@@ -79213,6 +79247,9 @@ var require_cache3 = __commonJS({
const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
if (!finalizeResponse.ok) {
if (finalizeResponse.message) {
throw new FinalizeCacheError(finalizeResponse.message);
}
throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
}
cacheId = parseInt(finalizeResponse.entryId);
@@ -79222,6 +79259,8 @@ var require_cache3 = __commonJS({
throw error2;
} else if (typedError.name === ReserveCacheError.name) {
core14.info(`Failed to save: ${typedError.message}`);
} else if (typedError.name === FinalizeCacheError.name) {
core14.warning(typedError.message);
} else {
if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
core14.error(`Failed to save: ${typedError.message}`);
@@ -88795,6 +88834,14 @@ function getApiDetails() {
function getApiClient() {
return createApiClientWithDetails(getApiDetails());
}
function getAuthorizationHeaderFor(logger, apiDetails, url2) {
if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
logger.debug(`Providing an authorization token.`);
return `token ${apiDetails.auth}`;
}
logger.debug(`Not using an authorization token.`);
return void 0;
}
var cachedGitHubVersion = void 0;
async function getGitHubVersionFromApi(apiClient, apiDetails) {
if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
@@ -88884,8 +88931,8 @@ var path8 = __toESM(require("path"));
var semver3 = __toESM(require_semver2());
// src/defaults.json
var bundleVersion = "codeql-bundle-v2.23.0";
var cliVersion = "2.23.0";
var bundleVersion = "codeql-bundle-v2.23.1";
var cliVersion = "2.23.1";
// src/overlay-database-utils.ts
var fs5 = __toESM(require("fs"));
@@ -89107,7 +89154,7 @@ function formatDuration(durationMs) {
}
// src/overlay-database-utils.ts
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -89217,6 +89264,12 @@ var featureConfig = {
legacyApi: true,
minimumVersion: void 0
},
["resolve_supported_languages_using_cli" /* ResolveSupportedLanguagesUsingCli */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI",
minimumVersion: void 0,
toolsFeature: "builtinExtractorsSpecifyDefaultQueries" /* BuiltinExtractorsSpecifyDefaultQueries */
},
["overlay_analysis" /* OverlayAnalysis */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -89328,11 +89381,21 @@ var featureConfig = {
minimumVersion: void 0,
toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
},
["use_repository_properties" /* UseRepositoryProperties */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
minimumVersion: void 0
},
["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_QA_TELEMETRY",
legacyApi: true,
minimumVersion: void 0
},
["java_minimize_dependency_jars" /* JavaMinimizeDependencyJars */]: {
defaultValue: false,
envVar: "CODEQL_ACTION_JAVA_MINIMIZE_DEPENDENCY_JARS",
minimumVersion: "2.23.0"
}
};
var FEATURE_FLAGS_FILE_NAME = "cached-feature-flags.json";
@@ -89607,11 +89670,19 @@ var core9 = __toESM(require_core());
// src/config-utils.ts
var fs8 = __toESM(require("fs"));
var path10 = __toESM(require("path"));
var semver4 = __toESM(require_semver2());
// src/caching-utils.ts
var core8 = __toESM(require_core());
// src/config/db-config.ts
var semver4 = __toESM(require_semver2());
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
// src/diff-informed-analysis-utils.ts
var fs7 = __toESM(require("fs"));
var path9 = __toESM(require("path"));
@@ -89660,12 +89731,6 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
};
var PACK_IDENTIFIER_PATTERN = (function() {
const alphaNumeric = "[a-z0-9]";
const alphaNumericDash = "[a-z0-9-]";
const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
return new RegExp(`^${component}/${component}$`);
})();
function getPathToParsedConfigFile(tempDir) {
return path10.join(tempDir, "config");
}
@@ -89677,7 +89742,18 @@ async function getConfig(tempDir, logger) {
const configString = fs8.readFileSync(configFile, "utf8");
logger.debug("Loaded config:");
logger.debug(configString);
return JSON.parse(configString);
const config = JSON.parse(configString);
if (config.version === void 0) {
throw new ConfigurationError(
`Loaded configuration file, but it does not contain the expected 'version' field.`
);
}
if (config.version !== getActionVersion()) {
throw new ConfigurationError(
`Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
);
}
return config;
}
function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
const augmentedConfig = cloneObject(cliConfig);
@@ -90132,7 +90208,7 @@ var toolcache3 = __toESM(require_tool_cache());
var import_fast_deep_equal = __toESM(require_fast_deep_equal());
var semver7 = __toESM(require_semver2());
// node_modules/uuid/dist/stringify.js
// node_modules/uuid/dist-node/stringify.js
var byteToHex = [];
for (let i = 0; i < 256; ++i) {
byteToHex.push((i + 256).toString(16).slice(1));
@@ -90141,7 +90217,7 @@ function unsafeStringify(arr, offset = 0) {
return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase();
}
// node_modules/uuid/dist/rng.js
// node_modules/uuid/dist-node/rng.js
var import_node_crypto = require("node:crypto");
var rnds8Pool = new Uint8Array(256);
var poolPtr = rnds8Pool.length;
@@ -90153,11 +90229,11 @@ function rng() {
return rnds8Pool.slice(poolPtr, poolPtr += 16);
}
// node_modules/uuid/dist/native.js
// node_modules/uuid/dist-node/native.js
var import_node_crypto2 = require("node:crypto");
var native_default = { randomUUID: import_node_crypto2.randomUUID };
// node_modules/uuid/dist/v4.js
// node_modules/uuid/dist-node/v4.js
function _v4(options, buf, offset) {
options = options || {};
const rnds = options.random ?? options.rng?.() ?? rng();
@@ -90500,7 +90576,10 @@ function sanitizeUrlForStatusReport(url2) {
// src/setup-codeql.ts
var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
var CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing";
var CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";
var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"];
var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
function getCodeQLBundleExtension(compressionMethod) {
switch (compressionMethod) {
case "gzip":
@@ -90643,7 +90722,7 @@ async function findOverridingToolsInCache(humanReadableVersion, logger) {
return void 0;
}
async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, variant, tarSupportsZstd, logger) {
if (toolsInput && !CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput) && !toolsInput.startsWith("http")) {
if (toolsInput && !isReservedToolsValue(toolsInput) && !toolsInput.startsWith("http")) {
logger.info(`Using CodeQL CLI from local path ${toolsInput}`);
const compressionMethod2 = inferCompressionMethod(toolsInput);
if (compressionMethod2 === void 0) {
@@ -90672,6 +90751,12 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
let cliVersion2;
let tagName;
let url2;
if (toolsInput !== void 0 && CODEQL_NIGHTLY_TOOLS_INPUTS.includes(toolsInput)) {
logger.info(
`Using the latest CodeQL CLI nightly, as requested by 'tools: ${toolsInput}'.`
);
toolsInput = await getNightlyToolsUrl(logger);
}
if (forceShippedTools) {
cliVersion2 = cliVersion;
tagName = bundleVersion;
@@ -90824,11 +90909,12 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer
let authorization = void 0;
if (searchParams.has("token")) {
logger.debug("CodeQL tools URL contains an authorization token.");
} else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) {
logger.debug("Providing an authorization token to download CodeQL tools.");
authorization = `token ${apiDetails.auth}`;
} else {
logger.debug("Downloading CodeQL tools without an authorization token.");
authorization = getAuthorizationHeaderFor(
logger,
apiDetails,
codeqlURL
);
}
const toolcacheInfo = getToolcacheDestinationInfo(
maybeBundleVersion,
@@ -90955,6 +91041,34 @@ async function useZstdBundle(cliVersion2, tarSupportsZstd) {
function getTempExtractionDir(tempDir) {
return path12.join(tempDir, v4_default());
}
async function getNightlyToolsUrl(logger) {
const zstdAvailability = await isZstdAvailable(logger);
const compressionMethod = await useZstdBundle(
CODEQL_VERSION_ZSTD_BUNDLE,
zstdAvailability.available
) ? "zstd" : "gzip";
try {
const release3 = await getApiClient().rest.repos.listReleases({
owner: CODEQL_NIGHTLIES_REPOSITORY_OWNER,
repo: CODEQL_NIGHTLIES_REPOSITORY_NAME,
per_page: 1,
page: 1,
prerelease: true
});
const latestRelease = release3.data[0];
if (!latestRelease) {
throw new Error("Could not find the latest nightly release.");
}
return `https://github.com/${CODEQL_NIGHTLIES_REPOSITORY_OWNER}/${CODEQL_NIGHTLIES_REPOSITORY_NAME}/releases/download/${latestRelease.tag_name}/${getCodeQLBundleName(compressionMethod)}`;
} catch (e) {
throw new Error(
`Failed to retrieve the latest nightly release: ${wrapError(e)}`
);
}
}
function isReservedToolsValue(tools) {
return CODEQL_BUNDLE_VERSION_ALIAS.includes(tools) || CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools);
}
// src/tracer-config.ts
async function shouldEnableIndirectTracing(codeql, config) {
@@ -91208,13 +91322,16 @@ async function getCodeQLForCmd(cmd, checkVersion) {
);
}
},
async betterResolveLanguages() {
async betterResolveLanguages({
filterToLanguagesWithQueries
} = { filterToLanguagesWithQueries: false }) {
const codeqlArgs = [
"resolve",
"languages",
"--format=betterjson",
"--extractor-options-verbosity=4",
"--extractor-include-aliases",
...filterToLanguagesWithQueries ? ["--filter-to-languages-with-queries"] : [],
...getExtraOptionsFromEnv(["resolve", "languages"])
];
const output = await runCli(cmd, codeqlArgs);
@@ -92959,23 +93076,6 @@ function findSarifFilesInDir(sarifPath, isSarif) {
walkSarifFiles(sarifPath);
return sarifFiles;
}
function getSarifFilePaths(sarifPath, isSarif) {
if (!fs14.existsSync(sarifPath)) {
throw new ConfigurationError(`Path does not exist: ${sarifPath}`);
}
let sarifFiles;
if (fs14.lstatSync(sarifPath).isDirectory()) {
sarifFiles = findSarifFilesInDir(sarifPath, isSarif);
if (sarifFiles.length === 0) {
throw new ConfigurationError(
`No SARIF files found to upload in "${sarifPath}".`
);
}
} else {
sarifFiles = [sarifPath];
}
return sarifFiles;
}
function countResultsInSarif(sarif) {
let numResults = 0;
const parsedSarif = JSON.parse(sarif);
@@ -93071,20 +93171,6 @@ function buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, wo
}
return payloadObj;
}
async function uploadFiles(inputSarifPath, checkoutPath, category, features, logger, uploadTarget) {
const sarifPaths = getSarifFilePaths(
inputSarifPath,
uploadTarget.sarifPredicate
);
return uploadSpecifiedFiles(
sarifPaths,
checkoutPath,
category,
features,
logger,
uploadTarget
);
}
async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features, logger, uploadTarget) {
logger.startGroup(`Uploading ${uploadTarget.name} results`);
logger.info(`Processing sarif files: ${JSON.stringify(sarifPaths)}`);
@@ -93332,6 +93418,30 @@ function filterAlertsByDiffRange(logger, sarif) {
}
// src/upload-sarif-action.ts
async function findAndUpload(logger, features, sarifPath, pathStats, checkoutPath, analysis, category) {
let sarifFiles;
if (pathStats.isDirectory()) {
sarifFiles = findSarifFilesInDir(
sarifPath,
analysis.sarifPredicate
);
} else if (pathStats.isFile() && analysis.sarifPredicate(sarifPath)) {
sarifFiles = [sarifPath];
} else {
return void 0;
}
if (sarifFiles.length !== 0) {
return await uploadSpecifiedFiles(
sarifFiles,
checkoutPath,
category,
features,
logger,
analysis
);
}
return void 0;
}
async function sendSuccessStatusReport(startedAt, uploadStats, logger) {
const statusReportBase = await createStatusReportBase(
"upload-sarif" /* UploadSarif */,
@@ -93378,41 +93488,59 @@ async function run() {
const sarifPath = getRequiredInput("sarif_file");
const checkoutPath = getRequiredInput("checkout_path");
const category = getOptionalInput("category");
const uploadResult = await uploadFiles(
sarifPath,
checkoutPath,
category,
features,
logger,
CodeScanning
);
core13.setOutput("sarif-id", uploadResult.sarifID);
if (fs15.lstatSync(sarifPath).isDirectory()) {
const qualitySarifFiles = findSarifFilesInDir(
sarifPath,
CodeQuality.sarifPredicate
);
if (qualitySarifFiles.length !== 0) {
await uploadSpecifiedFiles(
qualitySarifFiles,
checkoutPath,
fixCodeQualityCategory(logger, category),
features,
logger,
CodeQuality
);
}
const pathStats = fs15.lstatSync(sarifPath, { throwIfNoEntry: false });
if (pathStats === void 0) {
throw new ConfigurationError(`Path does not exist: ${sarifPath}.`);
}
const sarifIds = [];
const uploadResult = await findAndUpload(
logger,
features,
sarifPath,
pathStats,
checkoutPath,
CodeScanning,
category
);
if (uploadResult !== void 0) {
core13.setOutput("sarif-id", uploadResult.sarifID);
sarifIds.push({
analysis: "code-scanning" /* CodeScanning */,
id: uploadResult.sarifID
});
}
const qualityUploadResult = await findAndUpload(
logger,
features,
sarifPath,
pathStats,
checkoutPath,
CodeQuality,
fixCodeQualityCategory(logger, category)
);
if (qualityUploadResult !== void 0) {
sarifIds.push({
analysis: "code-quality" /* CodeQuality */,
id: qualityUploadResult.sarifID
});
}
core13.setOutput("sarif-ids", JSON.stringify(sarifIds));
if (isInTestMode()) {
core13.debug("In test mode. Waiting for processing is disabled.");
} else if (getRequiredInput("wait-for-processing") === "true") {
await waitForProcessing(
getRepositoryNwo(),
uploadResult.sarifID,
logger
);
if (uploadResult !== void 0) {
await waitForProcessing(
getRepositoryNwo(),
uploadResult.sarifID,
logger
);
}
}
await sendSuccessStatusReport(startedAt, uploadResult.statusReport, logger);
await sendSuccessStatusReport(
startedAt,
uploadResult?.statusReport || {},
logger
);
} catch (unwrappedError) {
const error2 = isThirdPartyAnalysis("upload-sarif" /* UploadSarif */) && unwrappedError instanceof InvalidSarifUploadError ? new ConfigurationError(unwrappedError.message) : wrapError(unwrappedError);
const message = error2.message;
package-lock.json
Generated
+449 -242
View File
File diff suppressed because it is too large Load Diff
package.json
+11 -10
View File
@@ -1,6 +1,6 @@
{
"name": "codeql",
"version": "3.30.3",
"version": "3.30.4",
"private": true,
"description": "CodeQL action",
"scripts": {
@@ -9,7 +9,7 @@
"lint": "eslint --report-unused-disable-directives --max-warnings=0 .",
"lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
"lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
"test": "npm run transpile && ava src/**.test.ts --serial --verbose",
"test": "npm run transpile && ava src/ --serial --verbose",
"test-debug": "npm run test -- --timeout=20m",
"transpile": "tsc --build --verbose"
},
@@ -25,7 +25,7 @@
"dependencies": {
"@actions/artifact": "^2.3.1",
"@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
"@actions/cache": "^4.0.5",
"@actions/cache": "^4.1.0",
"@actions/core": "^1.11.1",
"@actions/exec": "^1.1.1",
"@actions/github": "^6.0.0",
@@ -48,15 +48,15 @@
"node-forge": "^1.3.1",
"octokit": "^5.0.3",
"semver": "^7.7.2",
"uuid": "^12.0.0"
"uuid": "^13.0.0"
},
"devDependencies": {
"@ava/typescript": "6.0.0",
"@eslint/compat": "^1.3.2",
"@eslint/compat": "^1.4.0",
"@eslint/eslintrc": "^3.3.1",
"@eslint/js": "^9.35.0",
"@eslint/js": "^9.36.0",
"@microsoft/eslint-formatter-sarif": "^3.1.0",
"@octokit/types": "^14.1.0",
"@octokit/types": "^15.0.0",
"@types/archiver": "^6.0.3",
"@types/console-log-level": "^1.4.5",
"@types/follow-redirects": "^1.14.4",
@@ -65,10 +65,10 @@
"@types/node-forge": "^1.3.14",
"@types/semver": "^7.7.1",
"@types/sinon": "^17.0.4",
"@typescript-eslint/eslint-plugin": "^8.43.0",
"@typescript-eslint/eslint-plugin": "^8.44.1",
"@typescript-eslint/parser": "^8.41.0",
"ava": "^6.4.1",
"esbuild": "^0.25.9",
"esbuild": "^0.25.10",
"eslint": "^8.57.1",
"eslint-import-resolver-typescript": "^3.8.7",
"eslint-plugin-filenames": "^1.3.2",
@@ -98,6 +98,7 @@
},
"eslint-plugin-jsx-a11y": {
"semver": ">=6.3.1"
}
},
"brace-expansion@2.0.1": "2.0.2"
}
}
pr-checks/.gitignore
+2
View File
@@ -1 +1,3 @@
env
__pycache__/
*.pyc
pr-checks/__init__.py
View File
pr-checks/checks/all-platform-bundle.yml
-1
View File
@@ -12,6 +12,5 @@ steps:
languages: cpp,csharp,go,java,javascript,python,ruby
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash
run: ./build.sh
- uses: ./../action/analyze

Some files were not shown because too many files have changed in this diff Show More