mirror of
https://github.com/github/codeql-action.git
synced 2026-05-21 11:40:14 +00:00
Merge remote-tracking branch 'origin/main' into mbg/analysis-kinds/warn-on-non-cs-advanced-setup
This commit is contained in:
Michael B. Gale
@@ -16,12 +16,23 @@ No user facing changes.
|
||||
"""
|
||||
|
||||
# NB: This exact commit message is used to find commits for reverting during backports.
|
||||
# Changing it requires a transition period where both old and new versions are supported.
|
||||
# Changing it requires a transition period where both old and new versions are supported.
|
||||
BACKPORT_COMMIT_MESSAGE = 'Update version and changelog for v'
|
||||
|
||||
# Name of the remote
|
||||
ORIGIN = 'origin'
|
||||
|
||||
# Environment variables to check for a GitHub API token.
|
||||
TOKEN_ENVIRONMENT_VARIABLES = ('GH_TOKEN', 'GITHUB_TOKEN')
|
||||
|
||||
# Gets a GitHub API token from one of the supported environment variables.
|
||||
def get_github_token():
|
||||
for variable_name in TOKEN_ENVIRONMENT_VARIABLES:
|
||||
token = os.environ.get(variable_name, '').strip()
|
||||
if token:
|
||||
return token
|
||||
raise Exception('Missing GitHub token. Set GITHUB_TOKEN or GH_TOKEN.')
|
||||
|
||||
# Runs git with the given args and returns the stdout.
|
||||
# Raises an error if git does not exit successfully (unless passed
|
||||
# allow_non_zero_exit_code=True).
|
||||
@@ -270,12 +281,6 @@ def update_changelog(version):
|
||||
def main():
|
||||
parser = argparse.ArgumentParser('update-release-branch.py')
|
||||
|
||||
parser.add_argument(
|
||||
'--github-token',
|
||||
type=str,
|
||||
required=True,
|
||||
help='GitHub token, typically from GitHub Actions.'
|
||||
)
|
||||
parser.add_argument(
|
||||
'--repository-nwo',
|
||||
type=str,
|
||||
@@ -313,7 +318,7 @@ def main():
|
||||
target_branch = args.target_branch
|
||||
is_primary_release = args.is_primary_release
|
||||
|
||||
repo = Github(args.github_token).get_repo(args.repository_nwo)
|
||||
repo = Github(get_github_token()).get_repo(args.repository_nwo)
|
||||
|
||||
# the target branch will be of the form releases/vN, where N is the major version number
|
||||
target_branch_major_version = target_branch.strip('releases/v')
|
||||
|
||||
+4
-4
@@ -49,10 +49,6 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.17.6
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.18.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.19.4
|
||||
- os: ubuntu-latest
|
||||
@@ -61,6 +57,10 @@ jobs:
|
||||
version: stable-v2.21.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.22.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.23.9
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.24.3
|
||||
- os: ubuntu-latest
|
||||
version: default
|
||||
- os: ubuntu-latest
|
||||
|
||||
+4
-4
@@ -49,10 +49,6 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.17.6
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.18.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.19.4
|
||||
- os: ubuntu-latest
|
||||
@@ -61,6 +57,10 @@ jobs:
|
||||
version: stable-v2.21.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.22.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.23.9
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.24.3
|
||||
- os: ubuntu-latest
|
||||
version: default
|
||||
- os: ubuntu-latest
|
||||
|
||||
+4
-4
@@ -49,10 +49,6 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.17.6
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.18.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.19.4
|
||||
- os: ubuntu-latest
|
||||
@@ -61,6 +57,10 @@ jobs:
|
||||
version: stable-v2.21.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.22.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.23.9
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.24.3
|
||||
- os: ubuntu-latest
|
||||
version: default
|
||||
- os: ubuntu-latest
|
||||
|
||||
+15
-15
@@ -59,41 +59,41 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.17.6
|
||||
- os: macos-latest
|
||||
version: stable-v2.17.6
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.18.4
|
||||
- os: macos-latest
|
||||
version: stable-v2.18.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.19.4
|
||||
- os: macos-latest
|
||||
- os: macos-latest-xlarge
|
||||
version: stable-v2.19.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.20.7
|
||||
- os: macos-latest
|
||||
- os: macos-latest-xlarge
|
||||
version: stable-v2.20.7
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.21.4
|
||||
- os: macos-latest
|
||||
- os: macos-latest-xlarge
|
||||
version: stable-v2.21.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.22.4
|
||||
- os: macos-latest
|
||||
- os: macos-latest-xlarge
|
||||
version: stable-v2.22.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.23.9
|
||||
- os: macos-latest-xlarge
|
||||
version: stable-v2.23.9
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.24.3
|
||||
- os: macos-latest-xlarge
|
||||
version: stable-v2.24.3
|
||||
- os: ubuntu-latest
|
||||
version: default
|
||||
- os: macos-latest
|
||||
- os: macos-latest-xlarge
|
||||
version: default
|
||||
- os: ubuntu-latest
|
||||
version: linked
|
||||
- os: macos-latest
|
||||
- os: macos-latest-xlarge
|
||||
version: linked
|
||||
- os: ubuntu-latest
|
||||
version: nightly-latest
|
||||
- os: macos-latest
|
||||
- os: macos-latest-xlarge
|
||||
version: nightly-latest
|
||||
name: Multi-language repository
|
||||
if: github.triggering_actor != 'dependabot[bot]'
|
||||
|
||||
Generated
+1
-1
@@ -40,7 +40,7 @@ jobs:
|
||||
matrix:
|
||||
include:
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.19.3
|
||||
version: stable-v2.19.4
|
||||
- os: ubuntu-latest
|
||||
version: stable-v2.22.1
|
||||
- os: ubuntu-latest
|
||||
|
||||
Generated
+1
-1
@@ -39,7 +39,7 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- os: macos-latest
|
||||
- os: macos-latest-xlarge
|
||||
version: nightly-latest
|
||||
name: Swift analysis using autobuild
|
||||
if: github.triggering_actor != 'dependabot[bot]'
|
||||
|
||||
@@ -77,7 +77,7 @@ jobs:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14,macos-15]
|
||||
os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14-xlarge,macos-15-xlarge]
|
||||
tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
|
||||
runs-on: ${{ matrix.os }}
|
||||
|
||||
|
||||
@@ -6,13 +6,6 @@ env:
|
||||
# Diff informed queries add an additional query filter which is not yet
|
||||
# taken into account by these tests.
|
||||
CODEQL_ACTION_DIFF_INFORMED_QUERIES: false
|
||||
# Specify overlay enablement manually to ensure stability around the exclude-from-incremental
|
||||
# query filter. Here we only enable for the default code scanning suite.
|
||||
CODEQL_ACTION_OVERLAY_ANALYSIS: true
|
||||
CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT: false
|
||||
CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVASCRIPT: true
|
||||
CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK: false
|
||||
CODEQL_ACTION_OVERLAY_ANALYSIS_SKIP_RESOURCE_CHECKS: true
|
||||
|
||||
on:
|
||||
push:
|
||||
@@ -79,33 +72,13 @@ jobs:
|
||||
with:
|
||||
version: ${{ matrix.version }}
|
||||
|
||||
# On PRs, overlay analysis may change the config that is passed to the CLI.
|
||||
# Therefore, we have two variants of the following test, one for PRs and one for other events.
|
||||
- name: Empty file (non-PR)
|
||||
if: github.event_name != 'pull_request'
|
||||
- name: Empty file
|
||||
uses: ./../action/.github/actions/check-codescanning-config
|
||||
with:
|
||||
expected-config-file-contents: "{}"
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
|
||||
- name: Empty file (PR)
|
||||
if: github.event_name == 'pull_request'
|
||||
uses: ./../action/.github/actions/check-codescanning-config
|
||||
with:
|
||||
expected-config-file-contents: |
|
||||
{
|
||||
"query-filters": [
|
||||
{
|
||||
"exclude": {
|
||||
"tags": "exclude-from-incremental"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
|
||||
- name: Packs from input
|
||||
if: success() || failure()
|
||||
uses: ./../action/.github/actions/check-codescanning-config
|
||||
|
||||
@@ -131,7 +131,7 @@ jobs:
|
||||
echo "::endgroup::"
|
||||
|
||||
- name: Generate token
|
||||
uses: actions/create-github-app-token@v3.1.1
|
||||
uses: actions/create-github-app-token@v3.2.0
|
||||
id: app-token
|
||||
with:
|
||||
app-id: ${{ vars.AUTOMATION_APP_ID }}
|
||||
|
||||
@@ -136,7 +136,7 @@ jobs:
|
||||
|
||||
- name: Generate token
|
||||
if: github.event_name == 'workflow_dispatch'
|
||||
uses: actions/create-github-app-token@v3.1.1
|
||||
uses: actions/create-github-app-token@v3.2.0
|
||||
id: app-token
|
||||
with:
|
||||
app-id: ${{ vars.AUTOMATION_APP_ID }}
|
||||
|
||||
@@ -64,11 +64,12 @@ jobs:
|
||||
|
||||
- name: Update current release branch
|
||||
if: github.event_name == 'workflow_dispatch'
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
echo SOURCE_BRANCH=${REF_NAME}
|
||||
echo TARGET_BRANCH=releases/${MAJOR_VERSION}
|
||||
python .github/update-release-branch.py \
|
||||
--github-token ${{ secrets.GITHUB_TOKEN }} \
|
||||
--repository-nwo ${{ github.repository }} \
|
||||
--source-branch '${{ env.REF_NAME }}' \
|
||||
--target-branch 'releases/${{ env.MAJOR_VERSION }}' \
|
||||
@@ -93,7 +94,7 @@ jobs:
|
||||
pull-requests: write # needed to create pull request
|
||||
steps:
|
||||
- name: Generate token
|
||||
uses: actions/create-github-app-token@v3.1.1
|
||||
uses: actions/create-github-app-token@v3.2.0
|
||||
id: app-token
|
||||
with:
|
||||
app-id: ${{ vars.AUTOMATION_APP_ID }}
|
||||
@@ -107,11 +108,12 @@ jobs:
|
||||
- uses: ./.github/actions/release-initialise
|
||||
|
||||
- name: Update older release branch
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
echo SOURCE_BRANCH=${SOURCE_BRANCH}
|
||||
echo TARGET_BRANCH=${TARGET_BRANCH}
|
||||
python .github/update-release-branch.py \
|
||||
--github-token ${{ secrets.GITHUB_TOKEN }} \
|
||||
--repository-nwo ${{ github.repository }} \
|
||||
--source-branch ${SOURCE_BRANCH} \
|
||||
--target-branch ${TARGET_BRANCH} \
|
||||
|
||||
@@ -4,6 +4,13 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
|
||||
|
||||
## [UNRELEASED]
|
||||
|
||||
- _Breaking change_: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://github.com/github/codeql-action/pull/3894)
|
||||
- Add support for SHA-256 Git object IDs. [#3893](https://github.com/github/codeql-action/pull/3893)
|
||||
|
||||
## 4.35.5 - 15 May 2026
|
||||
|
||||
- We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://github.com/github/codeql-action/pull/3899)
|
||||
- For performance and accuracy reasons, [improved incremental analysis](https://github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://github.com/github/codeql-action/pull/3791)
|
||||
- If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://github.com/github/codeql-action/pull/3892)
|
||||
- Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://github.com/github/codeql-action/pull/3880)
|
||||
|
||||
|
||||
+1
-1
@@ -71,7 +71,7 @@ Once the mergeback and backport pull request have been merged, the release is co
|
||||
|
||||
Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred required jobs that need to pass in order for a PR to turn green. It would be too tedious to maintain that list manually. You can regenerate the set of required checks automatically by running the [sync-checks.ts](pr-checks/sync-checks.ts) script:
|
||||
|
||||
- At a minimum, you must provide an argument for the `--token` input. For example, `--token "$(gh auth token)"` to use the same token that `gh` uses. If no token is provided or the token has insufficient permissions, the script will fail.
|
||||
- At a minimum, you must provide a token with permissions to update branch protection rules. For example, `gh auth token | pr-checks/sync-checks.ts --token-stdin` uses the same token that `gh` uses. You can also set the `GH_TOKEN` or `GITHUB_TOKEN` environment variable. If no token is provided or the token has insufficient permissions, the script will fail.
|
||||
- By default, the script performs a dry run and outputs information about the changes it would make to the branch protection rules. To actually apply the changes, specify the `--apply` flag.
|
||||
- If you run the script without any other arguments, it will retrieve the set of workflows that ran for the latest commit on `main`.
|
||||
- You can specify a different git ref with the `--ref` input. You will likely want to use this if you have a PR that removes or adds PR checks. For example, `--ref "some/branch/name"` to use the HEAD of the `some/branch/name` branch.
|
||||
|
||||
@@ -78,8 +78,6 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
|
||||
| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
|
||||
| `v3.28.12` | `2.20.7` | Enterprise Server 3.17 | |
|
||||
| `v3.28.6` | `2.20.3` | Enterprise Server 3.16 | |
|
||||
| `v3.28.6` | `2.20.3` | Enterprise Server 3.15 | |
|
||||
| `v3.28.6` | `2.20.3` | Enterprise Server 3.14 | |
|
||||
|
||||
See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).
|
||||
|
||||
|
||||
+2
-2
@@ -95,5 +95,5 @@ outputs:
|
||||
description: The ID of the uploaded SARIF file.
|
||||
runs:
|
||||
using: node24
|
||||
main: "../lib/analyze-action.js"
|
||||
post: "../lib/analyze-action-post.js"
|
||||
main: "../lib/analyze-entry.js"
|
||||
post: "../lib/analyze-post-entry.js"
|
||||
|
||||
@@ -16,4 +16,4 @@ inputs:
|
||||
required: false
|
||||
runs:
|
||||
using: node24
|
||||
main: '../lib/autobuild-action.js'
|
||||
main: '../lib/autobuild-entry.js'
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import { copyFile, rm, writeFile } from "node:fs/promises";
|
||||
import { dirname, join } from "node:path";
|
||||
import { copyFile, readFile, rm, writeFile } from "node:fs/promises";
|
||||
import { basename, dirname, join } from "node:path";
|
||||
import { fileURLToPath } from "node:url";
|
||||
|
||||
import * as esbuild from "esbuild";
|
||||
@@ -62,18 +62,123 @@ const onEndPlugin = {
|
||||
},
|
||||
};
|
||||
|
||||
/** The name of the virtual `entry-points` module. */
|
||||
const SHARED_ENTRYPOINT = "entry-points";
|
||||
|
||||
/**
|
||||
* This plugin finds all source files that contain Action entry points.
|
||||
* It then generates the virtual `entry-points` module which imports all identified files,
|
||||
* and re-exports their `runWrapper` functions with suitable aliases.
|
||||
* A tiny stub file is emitted for each Action entrypoint. Each stub imports the shared bundle
|
||||
* and calls the respective entry point.
|
||||
*
|
||||
* @type {esbuild.Plugin}
|
||||
*/
|
||||
const entryPointsPlugin = {
|
||||
name: "entry-points",
|
||||
setup(build) {
|
||||
const namespace = "actions";
|
||||
const actions = [];
|
||||
|
||||
const toPascal = (s) =>
|
||||
s.replace(/(^|-)([a-z0-9])/gi, (_, __, c) => c.toUpperCase());
|
||||
|
||||
// Find the source files containing Action entry points.
|
||||
build.onStart(() => {
|
||||
const actionFiles = globSync("src/*-action{,-post}.ts");
|
||||
for (const actionFile of actionFiles) {
|
||||
const match = basename(actionFile).match(/(.*)-action(-post)?/);
|
||||
|
||||
if (match.length < 2) {
|
||||
throw new Error(`'${actionFile}' didn't match expected pattern.`);
|
||||
}
|
||||
|
||||
const actionName = match[1];
|
||||
const isPost = match[2] !== undefined;
|
||||
|
||||
actions.push({
|
||||
path: actionFile,
|
||||
name: actionName,
|
||||
isPost,
|
||||
pascalCaseName: `${toPascal(actionName)}${isPost ? "Post" : ""}Action`,
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
// Resolve the virtual `entry-points` file and set the corresponding namespace.
|
||||
// Ideally, we'd `RegExp.escape` the entrypoint here, but that API isn't supported in Node 20.
|
||||
// Since we're dealing with a hardcoded string, this isn't too much of a problem.
|
||||
build.onResolve({ filter: new RegExp(`^${SHARED_ENTRYPOINT}$`) }, () => {
|
||||
return { path: SHARED_ENTRYPOINT, namespace };
|
||||
});
|
||||
|
||||
// Generate the virtual `entry-points` file based on the Actions we discovered.
|
||||
// Restrict using the namespace. The path filter does not need to discriminate any further.
|
||||
build.onLoad({ filter: /.*/, namespace }, async () => {
|
||||
const wrapperTemplatePath = "entry-wrapper.js.tpl";
|
||||
const wrapperTemplate = await readFile(
|
||||
join(SRC_DIR, wrapperTemplatePath),
|
||||
"utf-8",
|
||||
);
|
||||
|
||||
const actionsSorted = actions.sort((a, b) =>
|
||||
a.name.localeCompare(b.name),
|
||||
);
|
||||
const imports = actionsSorted
|
||||
.map(
|
||||
(action) =>
|
||||
`import * as ${action.pascalCaseName} from "./src/${basename(action.path)}";`,
|
||||
)
|
||||
.join("\n");
|
||||
const wrappers = actionsSorted
|
||||
.map((action) =>
|
||||
wrapperTemplate.replaceAll("__ACTION__", action.pascalCaseName),
|
||||
)
|
||||
.join("\n\n");
|
||||
|
||||
return {
|
||||
contents: `"use strict";\n${imports}\n\n${wrappers}\n`,
|
||||
resolveDir: ".",
|
||||
loader: "ts",
|
||||
};
|
||||
});
|
||||
|
||||
// Emit entry point stubs for each Action using the entry template.
|
||||
build.onEnd(async (result) => {
|
||||
// Read the entry point template.
|
||||
const templatePath = "action-entry.js.tpl";
|
||||
const template = await readFile(join(SRC_DIR, templatePath), "utf-8");
|
||||
|
||||
const makeHeader = (sourceFile) =>
|
||||
`// Automatically generated from '${templatePath}' for 'src/${basename(sourceFile)}'.\n\n`;
|
||||
|
||||
// Write entry point stubs for each Action.
|
||||
for (const action of actions) {
|
||||
await writeFile(
|
||||
join(
|
||||
OUT_DIR,
|
||||
`${action.name}${action.isPost ? "-post" : ""}-entry.js`,
|
||||
),
|
||||
makeHeader(action.path) +
|
||||
template.replaceAll("__ACTION__", action.pascalCaseName),
|
||||
);
|
||||
}
|
||||
});
|
||||
},
|
||||
};
|
||||
|
||||
const context = await esbuild.context({
|
||||
// Include upload-lib.ts as an entry point for use in testing environments.
|
||||
entryPoints: globSync([
|
||||
`${SRC_DIR}/*-action.ts`,
|
||||
`${SRC_DIR}/*-action-post.ts`,
|
||||
"src/upload-lib.ts",
|
||||
]),
|
||||
entryPoints: [
|
||||
{ in: SHARED_ENTRYPOINT, out: SHARED_ENTRYPOINT },
|
||||
join(SRC_DIR, "upload-lib.ts"),
|
||||
],
|
||||
bundle: true,
|
||||
format: "cjs",
|
||||
outdir: OUT_DIR,
|
||||
platform: "node",
|
||||
plugins: [cleanPlugin, copyDefaultsPlugin, onEndPlugin],
|
||||
external: ["./entry-points"],
|
||||
plugins: [cleanPlugin, copyDefaultsPlugin, entryPointsPlugin, onEndPlugin],
|
||||
target: ["node20"],
|
||||
define: {
|
||||
__CODEQL_ACTION_VERSION__: JSON.stringify(pkg.version),
|
||||
|
||||
+2
-2
@@ -171,5 +171,5 @@ outputs:
|
||||
description: The version of the CodeQL binary used for analysis
|
||||
runs:
|
||||
using: node24
|
||||
main: '../lib/init-action.js'
|
||||
post: '../lib/init-action-post.js'
|
||||
main: '../lib/init-entry.js'
|
||||
post: '../lib/init-post-entry.js'
|
||||
|
||||
Generated
-129183
File diff suppressed because one or more lines are too long
Generated
-96038
File diff suppressed because one or more lines are too long
Generated
+6
@@ -0,0 +1,6 @@
|
||||
// Automatically generated from 'action-entry.js.tpl' for 'src/analyze-action.ts'.
|
||||
|
||||
"use strict";
|
||||
|
||||
const import_entry_points = require("./entry-points");
|
||||
void (0, import_entry_points.runAnalyzeAction)();
|
||||
Generated
+6
@@ -0,0 +1,6 @@
|
||||
// Automatically generated from 'action-entry.js.tpl' for 'src/analyze-action-post.ts'.
|
||||
|
||||
"use strict";
|
||||
|
||||
const import_entry_points = require("./entry-points");
|
||||
void (0, import_entry_points.runAnalyzePostAction)();
|
||||
Generated
-88244
File diff suppressed because one or more lines are too long
Generated
+6
@@ -0,0 +1,6 @@
|
||||
// Automatically generated from 'action-entry.js.tpl' for 'src/autobuild-action.ts'.
|
||||
|
||||
"use strict";
|
||||
|
||||
const import_entry_points = require("./entry-points");
|
||||
void (0, import_entry_points.runAutobuildAction)();
|
||||
+31405
-6977
File diff suppressed because it is too large
Load Diff
Generated
-93022
File diff suppressed because one or more lines are too long
Generated
+6
@@ -0,0 +1,6 @@
|
||||
// Automatically generated from 'action-entry.js.tpl' for 'src/init-action.ts'.
|
||||
|
||||
"use strict";
|
||||
|
||||
const import_entry_points = require("./entry-points");
|
||||
void (0, import_entry_points.runInitAction)();
|
||||
Generated
+6
@@ -0,0 +1,6 @@
|
||||
// Automatically generated from 'action-entry.js.tpl' for 'src/init-action-post.ts'.
|
||||
|
||||
"use strict";
|
||||
|
||||
const import_entry_points = require("./entry-points");
|
||||
void (0, import_entry_points.runInitPostAction)();
|
||||
Generated
-87798
File diff suppressed because one or more lines are too long
Generated
+6
@@ -0,0 +1,6 @@
|
||||
// Automatically generated from 'action-entry.js.tpl' for 'src/resolve-environment-action.ts'.
|
||||
|
||||
"use strict";
|
||||
|
||||
const import_entry_points = require("./entry-points");
|
||||
void (0, import_entry_points.runResolveEnvironmentAction)();
|
||||
Generated
-89636
File diff suppressed because one or more lines are too long
Generated
+6
@@ -0,0 +1,6 @@
|
||||
// Automatically generated from 'action-entry.js.tpl' for 'src/setup-codeql-action.ts'.
|
||||
|
||||
"use strict";
|
||||
|
||||
const import_entry_points = require("./entry-points");
|
||||
void (0, import_entry_points.runSetupCodeqlAction)();
|
||||
Generated
-127995
File diff suppressed because one or more lines are too long
Generated
-105058
File diff suppressed because one or more lines are too long
Generated
+6
@@ -0,0 +1,6 @@
|
||||
// Automatically generated from 'action-entry.js.tpl' for 'src/start-proxy-action.ts'.
|
||||
|
||||
"use strict";
|
||||
|
||||
const import_entry_points = require("./entry-points");
|
||||
void (0, import_entry_points.runStartProxyAction)();
|
||||
Generated
+6
@@ -0,0 +1,6 @@
|
||||
// Automatically generated from 'action-entry.js.tpl' for 'src/start-proxy-action-post.ts'.
|
||||
|
||||
"use strict";
|
||||
|
||||
const import_entry_points = require("./entry-points");
|
||||
void (0, import_entry_points.runStartProxyPostAction)();
|
||||
Generated
+16
-15
@@ -88509,7 +88509,7 @@ function getDiffRangesJsonFilePath() {
|
||||
return path2.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
|
||||
}
|
||||
function getActionVersion() {
|
||||
return "4.35.5";
|
||||
return "4.36.0";
|
||||
}
|
||||
function getWorkflowEventName() {
|
||||
return getRequiredEnvParam("GITHUB_EVENT_NAME");
|
||||
@@ -89032,7 +89032,7 @@ var determineBaseBranchHeadCommitOid = async function(checkoutPathOverride) {
|
||||
}
|
||||
}
|
||||
}
|
||||
if (commitOid === mergeSha && headOid.length === 40 && baseOid.length === 40) {
|
||||
if (commitOid === mergeSha && (headOid.length === 40 || headOid.length === 64) && (baseOid.length === 40 || baseOid.length === 64)) {
|
||||
return baseOid;
|
||||
}
|
||||
return void 0;
|
||||
@@ -89098,7 +89098,7 @@ var getFileOidsUnderPath = async function(basePath) {
|
||||
"Cannot list Git OIDs of tracked files."
|
||||
);
|
||||
const fileOidMap = {};
|
||||
const regex = /^[0-9]+ ([0-9a-f]{40}) [0-9]+\t(.+)$/;
|
||||
const regex = /^[0-9]+ ([0-9a-f]{40}|[0-9a-f]{64}) [0-9]+\t(.+)$/;
|
||||
for (const line of stdout.split("\n")) {
|
||||
if (line) {
|
||||
const match = line.match(regex);
|
||||
@@ -91212,7 +91212,7 @@ async function shouldEnableIndirectTracing(codeql, config) {
|
||||
|
||||
// src/codeql.ts
|
||||
var cachedCodeQL = void 0;
|
||||
var CODEQL_MINIMUM_VERSION = "2.17.6";
|
||||
var CODEQL_MINIMUM_VERSION = "2.19.4";
|
||||
var CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
|
||||
var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
|
||||
var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
|
||||
@@ -91339,10 +91339,6 @@ async function getCodeQLForCmd(cmd, checkVersion) {
|
||||
if (qlconfigFile !== void 0) {
|
||||
extraArgs.push(`--qlconfig-file=${qlconfigFile}`);
|
||||
}
|
||||
const overwriteFlag = isSupportedToolsFeature(
|
||||
await this.getVersion(),
|
||||
"forceOverwrite" /* ForceOverwrite */
|
||||
) ? "--force-overwrite" : "--overwrite";
|
||||
const overlayDatabaseMode = config.overlayDatabaseMode;
|
||||
if (overlayDatabaseMode === "overlay" /* Overlay */) {
|
||||
const overlayChangesFile = await writeOverlayChangesFile(
|
||||
@@ -91363,7 +91359,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
|
||||
[
|
||||
"database",
|
||||
"init",
|
||||
...overlayDatabaseMode === "overlay" /* Overlay */ ? [] : [overwriteFlag],
|
||||
...overlayDatabaseMode === "overlay" /* Overlay */ ? [] : ["--force-overwrite"],
|
||||
"--db-cluster",
|
||||
config.dbLocation,
|
||||
`--source-root=${sourceRoot}`,
|
||||
@@ -91374,7 +91370,14 @@ async function getCodeQLForCmd(cmd, checkVersion) {
|
||||
// Some user configs specify `--no-calculate-baseline` as an additional
|
||||
// argument to `codeql database init`. Therefore ignore the baseline file
|
||||
// options here to avoid specifying the same argument twice and erroring.
|
||||
ignoringOptions: ["--overwrite", ...baselineFilesOptions]
|
||||
//
|
||||
// Ignore `--overwrite` to avoid passing both `--force-overwrite` and `--overwrite` if
|
||||
// the user has configured `--overwrite`.
|
||||
ignoringOptions: [
|
||||
"--force-overwrite",
|
||||
"--overwrite",
|
||||
...baselineFilesOptions
|
||||
]
|
||||
})
|
||||
],
|
||||
{ stdin: externalRepositoryToken }
|
||||
@@ -91539,7 +91542,7 @@ ${output}`
|
||||
"--sarif-group-rules-by-pack",
|
||||
"--sarif-include-query-help=always",
|
||||
"--sublanguage-file-coverage",
|
||||
...await getJobRunUuidSarifOptions(this),
|
||||
...await getJobRunUuidSarifOptions(),
|
||||
...getExtraOptionsFromEnv(["database", "interpret-results"])
|
||||
];
|
||||
if (sarifRunPropertyFlag !== void 0) {
|
||||
@@ -91820,11 +91823,9 @@ function applyAutobuildAzurePipelinesTimeoutFix() {
|
||||
"-Dmaven.wagon.http.pool=false"
|
||||
].join(" ");
|
||||
}
|
||||
async function getJobRunUuidSarifOptions(codeql) {
|
||||
async function getJobRunUuidSarifOptions() {
|
||||
const jobRunUuid = process.env["JOB_RUN_UUID" /* JOB_RUN_UUID */];
|
||||
return jobRunUuid && await codeql.supportsFeature(
|
||||
"databaseInterpretResultsSupportsSarifRunProperty" /* DatabaseInterpretResultsSupportsSarifRunProperty */
|
||||
) ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
|
||||
return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
|
||||
}
|
||||
|
||||
// src/fingerprints.ts
|
||||
|
||||
Generated
-128020
File diff suppressed because one or more lines are too long
Generated
-94427
File diff suppressed because one or more lines are too long
Generated
+6
@@ -0,0 +1,6 @@
|
||||
// Automatically generated from 'action-entry.js.tpl' for 'src/upload-sarif-action.ts'.
|
||||
|
||||
"use strict";
|
||||
|
||||
const import_entry_points = require("./entry-points");
|
||||
void (0, import_entry_points.runUploadSarifAction)();
|
||||
Generated
+6
@@ -0,0 +1,6 @@
|
||||
// Automatically generated from 'action-entry.js.tpl' for 'src/upload-sarif-action-post.ts'.
|
||||
|
||||
"use strict";
|
||||
|
||||
const import_entry_points = require("./entry-points");
|
||||
void (0, import_entry_points.runUploadSarifPostAction)();
|
||||
Generated
+280
-382
File diff suppressed because it is too large
Load Diff
+8
-7
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "codeql",
|
||||
"version": "4.35.5",
|
||||
"version": "4.36.0",
|
||||
"private": true,
|
||||
"description": "CodeQL action",
|
||||
"scripts": {
|
||||
@@ -12,7 +12,8 @@
|
||||
"ava": "npm run transpile && ava --verbose",
|
||||
"test": "npm run ava -- src/",
|
||||
"test-debug": "npm run test -- --timeout=20m",
|
||||
"transpile": "tsc --build --verbose tsconfig.json"
|
||||
"transpile": "tsc --build --verbose tsconfig.json",
|
||||
"update-pr-checks": "./pr-checks/sync.sh"
|
||||
},
|
||||
"license": "MIT",
|
||||
"workspaces": [
|
||||
@@ -43,7 +44,7 @@
|
||||
"uuid": "^14.0.0"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@ava/typescript": "7.0.0",
|
||||
"@ava/typescript": "6.0.0",
|
||||
"@eslint/compat": "^2.0.5",
|
||||
"@microsoft/eslint-formatter-sarif": "^3.1.0",
|
||||
"@octokit/types": "^16.0.0",
|
||||
@@ -55,7 +56,7 @@
|
||||
"@types/sarif": "^2.1.7",
|
||||
"@types/semver": "^7.7.1",
|
||||
"@types/sinon": "^21.0.1",
|
||||
"ava": "^7.0.0",
|
||||
"ava": "^6.4.1",
|
||||
"esbuild": "^0.28.0",
|
||||
"eslint": "^9.39.4",
|
||||
"eslint-import-resolver-typescript": "^4.4.4",
|
||||
@@ -64,11 +65,11 @@
|
||||
"eslint-plugin-jsdoc": "^62.9.0",
|
||||
"eslint-plugin-no-async-foreach": "^0.1.1",
|
||||
"glob": "^11.1.0",
|
||||
"globals": "^17.5.0",
|
||||
"globals": "^17.6.0",
|
||||
"nock": "^14.0.12",
|
||||
"sinon": "^21.1.2",
|
||||
"sinon": "^22.0.0",
|
||||
"typescript": "^6.0.3",
|
||||
"typescript-eslint": "^8.59.1"
|
||||
"typescript-eslint": "^8.59.2"
|
||||
},
|
||||
"overrides": {
|
||||
"@actions/tool-cache": {
|
||||
|
||||
@@ -2,7 +2,8 @@ name: "Multi-language repository"
|
||||
description: "An end-to-end integration test of a multi-language repository using automatic language detection"
|
||||
operatingSystems:
|
||||
- ubuntu
|
||||
- macos
|
||||
- os: macos
|
||||
runner-image: macos-latest-xlarge
|
||||
env:
|
||||
CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
|
||||
installGo: true
|
||||
|
||||
@@ -2,7 +2,7 @@ name: "Rust analysis"
|
||||
description: "Tests creation of a Rust database"
|
||||
versions:
|
||||
# experimental rust support introduced, requires action to set `CODEQL_ENABLE_EXPERIMENTAL_FEATURES`
|
||||
- stable-v2.19.3
|
||||
- stable-v2.19.4
|
||||
# first public preview version
|
||||
- stable-v2.22.1
|
||||
- linked
|
||||
|
||||
@@ -3,7 +3,8 @@ description: "Tests creation of a Swift database using autobuild"
|
||||
versions:
|
||||
- nightly-latest
|
||||
operatingSystems:
|
||||
- macos
|
||||
- os: macos
|
||||
runner-image: macos-latest-xlarge
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
"@octokit/core": "^7.0.6",
|
||||
"@octokit/plugin-paginate-rest": ">=9.2.2",
|
||||
"@octokit/plugin-rest-endpoint-methods": "^17.0.0",
|
||||
"yaml": "^2.8.3"
|
||||
"yaml": "^2.8.4"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@types/node": "^20.19.39",
|
||||
|
||||
@@ -7,7 +7,13 @@ Tests for the sync-checks.ts script
|
||||
import * as assert from "node:assert/strict";
|
||||
import { describe, it } from "node:test";
|
||||
|
||||
import { CheckInfo, Exclusions, Options, removeExcluded } from "./sync-checks";
|
||||
import {
|
||||
CheckInfo,
|
||||
Exclusions,
|
||||
Options,
|
||||
removeExcluded,
|
||||
resolveToken,
|
||||
} from "./sync-checks";
|
||||
|
||||
const defaultOptions: Options = {
|
||||
apply: false,
|
||||
@@ -58,3 +64,46 @@ describe("removeExcluded", async () => {
|
||||
assert.deepEqual(retained, expectedExactMatches);
|
||||
});
|
||||
});
|
||||
|
||||
describe("resolveToken", async () => {
|
||||
await it("reads the token from standard input", async () => {
|
||||
const token = await resolveToken(
|
||||
{ tokenStdin: true },
|
||||
{ env: {}, readStdin: async () => " stdin-token\n" },
|
||||
);
|
||||
assert.equal(token, "stdin-token");
|
||||
});
|
||||
|
||||
await it("reads the token from the GH_TOKEN environment variable", async () => {
|
||||
const token = await resolveToken(
|
||||
{},
|
||||
{ env: { GH_TOKEN: "env-token" }, readStdin: async () => "" },
|
||||
);
|
||||
assert.equal(token, "env-token");
|
||||
});
|
||||
|
||||
await it("reads the token from the GITHUB_TOKEN environment variable", async () => {
|
||||
const token = await resolveToken(
|
||||
{},
|
||||
{ env: { GITHUB_TOKEN: "env-token" }, readStdin: async () => "" },
|
||||
);
|
||||
assert.equal(token, "env-token");
|
||||
});
|
||||
|
||||
await it("rejects an empty standard input token", async () => {
|
||||
await assert.rejects(
|
||||
resolveToken(
|
||||
{ tokenStdin: true },
|
||||
{ env: {}, readStdin: async () => "\n" },
|
||||
),
|
||||
/No token received on standard input/,
|
||||
);
|
||||
});
|
||||
|
||||
await it("rejects missing token sources", async () => {
|
||||
await assert.rejects(
|
||||
resolveToken({}, { env: {}, readStdin: async () => "" }),
|
||||
/Missing authentication token/,
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -15,8 +15,8 @@ import {
|
||||
|
||||
/** Represents the command-line options. */
|
||||
export interface Options {
|
||||
/** The token to use to authenticate to the GitHub API. */
|
||||
token?: string;
|
||||
/** Whether to read the GitHub API token from standard input. */
|
||||
tokenStdin?: boolean;
|
||||
/** The git ref to use the checks for. */
|
||||
ref?: string;
|
||||
/** Whether to actually apply the changes or not. */
|
||||
@@ -31,6 +31,65 @@ const codeqlActionRepo = {
|
||||
repo: "codeql-action",
|
||||
};
|
||||
|
||||
/** Environment variables to check for a GitHub API token. */
|
||||
const TOKEN_ENVIRONMENT_VARIABLES = ["GH_TOKEN", "GITHUB_TOKEN"];
|
||||
|
||||
/** Represents the sources from which we can retrieve the GitHub API token. */
|
||||
interface TokenSource {
|
||||
/** Environment variables to inspect. */
|
||||
env: NodeJS.ProcessEnv;
|
||||
/** Reads a token from standard input. */
|
||||
readStdin: () => Promise<string>;
|
||||
}
|
||||
|
||||
/** Reads the GitHub API token from standard input. */
|
||||
async function readTokenFromStdin(): Promise<string> {
|
||||
let token = "";
|
||||
process.stdin.setEncoding("utf8");
|
||||
for await (const chunk of process.stdin) {
|
||||
token += chunk;
|
||||
}
|
||||
return token.trim();
|
||||
}
|
||||
|
||||
/** Gets a GitHub API token from one of the supported environment variables. */
|
||||
function getTokenFromEnvironment(env: NodeJS.ProcessEnv): string | undefined {
|
||||
for (const variableName of TOKEN_ENVIRONMENT_VARIABLES) {
|
||||
const token = env[variableName]?.trim();
|
||||
if (token) {
|
||||
return token;
|
||||
}
|
||||
}
|
||||
return undefined;
|
||||
}
|
||||
|
||||
/** Gets the token to use to authenticate to the GitHub API. */
|
||||
export async function resolveToken(
|
||||
options: Pick<Options, "tokenStdin">,
|
||||
tokenSource: TokenSource = {
|
||||
env: process.env,
|
||||
readStdin: readTokenFromStdin,
|
||||
},
|
||||
): Promise<string> {
|
||||
if (options.tokenStdin) {
|
||||
const token = (await tokenSource.readStdin()).trim();
|
||||
if (token.length === 0) {
|
||||
throw new Error("No token received on standard input.");
|
||||
}
|
||||
return token;
|
||||
}
|
||||
|
||||
const environmentToken = getTokenFromEnvironment(tokenSource.env);
|
||||
if (environmentToken !== undefined) {
|
||||
return environmentToken;
|
||||
}
|
||||
|
||||
throw new Error(
|
||||
"Missing authentication token. Set GH_TOKEN/GITHUB_TOKEN or pipe a token " +
|
||||
"to --token-stdin.",
|
||||
);
|
||||
}
|
||||
|
||||
/** Represents a configuration of which checks should not be set up as required checks. */
|
||||
export interface Exclusions {
|
||||
/** A list of strings that, if contained in a check name, are excluded. */
|
||||
@@ -205,9 +264,10 @@ async function updateBranch(
|
||||
async function main(): Promise<void> {
|
||||
const { values: options } = parseArgs({
|
||||
options: {
|
||||
// The token to use to authenticate to the API.
|
||||
token: {
|
||||
type: "string",
|
||||
// Read the token to use to authenticate to the API from standard input.
|
||||
"token-stdin": {
|
||||
type: "boolean",
|
||||
default: false,
|
||||
},
|
||||
// The git ref for which to retrieve the check runs.
|
||||
ref: {
|
||||
@@ -228,16 +288,16 @@ async function main(): Promise<void> {
|
||||
strict: true,
|
||||
});
|
||||
|
||||
if (options.token === undefined) {
|
||||
throw new Error("Missing --token");
|
||||
}
|
||||
const token = await resolveToken({
|
||||
tokenStdin: options["token-stdin"],
|
||||
});
|
||||
|
||||
console.info(
|
||||
`Oldest supported major version is: ${OLDEST_SUPPORTED_MAJOR_VERSION}`,
|
||||
);
|
||||
|
||||
// Initialise the API client.
|
||||
const client = getApiClient(options.token);
|
||||
const client = getApiClient(token);
|
||||
|
||||
// Find the check runs for the specified `ref` that we will later set as the required checks
|
||||
// for the main and release branches.
|
||||
|
||||
+42
-11
@@ -28,6 +28,24 @@ interface WorkflowInput {
|
||||
/** A partial mapping from known input names to input definitions. */
|
||||
type WorkflowInputs = Partial<Record<KnownInputName, WorkflowInput>>;
|
||||
|
||||
/** An operating system identifier. */
|
||||
type OperatingSystemIdentifier = "ubuntu" | "macos" | "windows";
|
||||
|
||||
/**
|
||||
* Represents an operating system matrix entry for a generated PR check workflow.
|
||||
*
|
||||
* Either a string containing the OS identifier or an object containing the OS identifier and an
|
||||
* optional runner image label.
|
||||
*/
|
||||
type OperatingSystem =
|
||||
| OperatingSystemIdentifier
|
||||
| {
|
||||
/** OS identifier. */
|
||||
os: OperatingSystemIdentifier;
|
||||
/** Optional runner image label. */
|
||||
"runner-image"?: string;
|
||||
};
|
||||
|
||||
/**
|
||||
* Represents PR check specifications.
|
||||
*/
|
||||
@@ -36,8 +54,8 @@ interface Specification extends JobSpecification {
|
||||
inputs?: Record<string, WorkflowInput>;
|
||||
/** CodeQL bundle versions to test against. Defaults to `DEFAULT_TEST_VERSIONS`. */
|
||||
versions?: string[];
|
||||
/** Operating system prefixes used to select runner images (e.g. `["ubuntu", "macos"]`). */
|
||||
operatingSystems?: string[];
|
||||
/** Operating system prefixes, either as strings or with explicit runner image labels. */
|
||||
operatingSystems?: OperatingSystem[];
|
||||
/** Per-OS version overrides. If specified for an OS, only those versions are tested on that OS. */
|
||||
osCodeQlVersions?: Record<string, string[]>;
|
||||
/** Whether to use the all-platform CodeQL bundle. */
|
||||
@@ -97,10 +115,6 @@ type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;
|
||||
// The default set of CodeQL Bundle versions to use for the PR checks.
|
||||
const defaultTestVersions = [
|
||||
// The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
|
||||
"stable-v2.17.6",
|
||||
// The last CodeQL release in the 2.18 series.
|
||||
"stable-v2.18.4",
|
||||
// The last CodeQL release in the 2.19 series.
|
||||
"stable-v2.19.4",
|
||||
// The last CodeQL release in the 2.20 series.
|
||||
"stable-v2.20.7",
|
||||
@@ -108,6 +122,10 @@ const defaultTestVersions = [
|
||||
"stable-v2.21.4",
|
||||
// The last CodeQL release in the 2.22 series.
|
||||
"stable-v2.22.4",
|
||||
// The last CodeQL release in the 2.23 series.
|
||||
"stable-v2.23.9",
|
||||
// The last CodeQL release in the 2.24 series.
|
||||
"stable-v2.24.3",
|
||||
// The default version of CodeQL for Dotcom, as determined by feature flags.
|
||||
"default",
|
||||
// The version of CodeQL shipped with the Action in `defaults.json`. During the release process
|
||||
@@ -311,10 +329,19 @@ function generateJobMatrix(
|
||||
);
|
||||
}
|
||||
|
||||
const runnerImages = ["ubuntu-latest", "macos-latest", "windows-latest"];
|
||||
const defaultRunnerImages = [
|
||||
"ubuntu-latest",
|
||||
"macos-latest",
|
||||
"windows-latest",
|
||||
];
|
||||
const operatingSystems = checkSpecification.operatingSystems ?? ["ubuntu"];
|
||||
|
||||
for (const operatingSystem of operatingSystems) {
|
||||
for (const operatingSystemConfig of operatingSystems) {
|
||||
const operatingSystem =
|
||||
typeof operatingSystemConfig === "string"
|
||||
? operatingSystemConfig
|
||||
: operatingSystemConfig.os;
|
||||
|
||||
// If osCodeQlVersions is set for this OS, only include the specified CodeQL versions.
|
||||
const allowedVersions =
|
||||
checkSpecification.osCodeQlVersions?.[operatingSystem];
|
||||
@@ -322,9 +349,13 @@ function generateJobMatrix(
|
||||
continue;
|
||||
}
|
||||
|
||||
const runnerImagesForOs = runnerImages.filter((image) =>
|
||||
image.startsWith(operatingSystem),
|
||||
);
|
||||
const runnerImagesForOs =
|
||||
typeof operatingSystemConfig === "string" ||
|
||||
operatingSystemConfig["runner-image"] === undefined
|
||||
? defaultRunnerImages.filter((image) =>
|
||||
image.startsWith(operatingSystem),
|
||||
)
|
||||
: [operatingSystemConfig["runner-image"]];
|
||||
|
||||
for (const runnerImage of runnerImagesForOs) {
|
||||
matrix.push({
|
||||
|
||||
@@ -22,4 +22,4 @@ outputs:
|
||||
description: The inferred build environment configuration.
|
||||
runs:
|
||||
using: node24
|
||||
main: '../lib/resolve-environment-action.js'
|
||||
main: '../lib/resolve-environment-entry.js'
|
||||
|
||||
@@ -55,4 +55,4 @@ outputs:
|
||||
description: The version of the CodeQL binary that was installed.
|
||||
runs:
|
||||
using: node24
|
||||
main: '../lib/setup-codeql-action.js'
|
||||
main: '../lib/setup-codeql-entry.js'
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
"use strict";
|
||||
|
||||
const import_entry_points = require("./entry-points");
|
||||
void (0, import_entry_points.run__ACTION__)();
|
||||
@@ -1,90 +0,0 @@
|
||||
import test from "ava";
|
||||
import * as sinon from "sinon";
|
||||
|
||||
import * as actionsUtil from "./actions-util";
|
||||
import * as analyze from "./analyze";
|
||||
import * as api from "./api-client";
|
||||
import * as configUtils from "./config-utils";
|
||||
import * as gitUtils from "./git-utils";
|
||||
import * as statusReport from "./status-report";
|
||||
import {
|
||||
setupTests,
|
||||
setupActionsVars,
|
||||
mockFeatureFlagApiEndpoint,
|
||||
} from "./testing-utils";
|
||||
import * as util from "./util";
|
||||
|
||||
setupTests(test);
|
||||
|
||||
// This test needs to be in its own file so that ava would run it in its own
|
||||
// nodejs process. The code being tested is in analyze-action.ts, which runs
|
||||
// immediately on load. So the file needs to be loaded during part of the test,
|
||||
// and that can happen only once per nodejs process. If multiple such tests are
|
||||
// in the same test file, ava would run them in the same nodejs process, and all
|
||||
// but the first test would fail.
|
||||
|
||||
test("analyze action with RAM & threads from environment variables", async (t) => {
|
||||
// This test frequently times out on Windows with the default timeout, so we bump
|
||||
// it a bit to 20s.
|
||||
t.timeout(1000 * 20);
|
||||
await util.withTmpDir(async (tmpDir) => {
|
||||
setupActionsVars(tmpDir, tmpDir);
|
||||
sinon
|
||||
.stub(statusReport, "createStatusReportBase")
|
||||
.resolves({} as statusReport.StatusReportBase);
|
||||
sinon.stub(statusReport, "sendStatusReport").resolves();
|
||||
sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
|
||||
|
||||
const gitHubVersion: util.GitHubVersion = {
|
||||
type: util.GitHubVariant.DOTCOM,
|
||||
};
|
||||
sinon.stub(configUtils, "getConfig").resolves({
|
||||
gitHubVersion,
|
||||
augmentationProperties: {},
|
||||
languages: [],
|
||||
packs: [],
|
||||
trapCaches: {},
|
||||
} as unknown as configUtils.Config);
|
||||
const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
|
||||
requiredInputStub.withArgs("token").returns("fake-token");
|
||||
requiredInputStub.withArgs("upload-database").returns("false");
|
||||
requiredInputStub.withArgs("output").returns("out");
|
||||
const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
|
||||
optionalInputStub.withArgs("expect-error").returns("false");
|
||||
sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
|
||||
mockFeatureFlagApiEndpoint(200, {});
|
||||
|
||||
// When there are no action inputs for RAM and threads, the action uses
|
||||
// environment variables (passed down from the init action) to set RAM and
|
||||
// threads usage.
|
||||
process.env["CODEQL_THREADS"] = "-1";
|
||||
process.env["CODEQL_RAM"] = "4992";
|
||||
|
||||
const runFinalizeStub = sinon.stub(analyze, "runFinalize");
|
||||
const runQueriesStub = sinon.stub(analyze, "runQueries");
|
||||
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
||||
const analyzeAction = require("./analyze-action");
|
||||
|
||||
// When analyze-action.ts loads, it runs an async function from the top
|
||||
// level but does not wait for it to finish. To ensure that calls to
|
||||
// runFinalize and runQueries are correctly captured by spies, we explicitly
|
||||
// wait for the action promise to complete before starting verification.
|
||||
await analyzeAction.runPromise;
|
||||
|
||||
t.assert(
|
||||
runFinalizeStub.calledOnceWith(
|
||||
sinon.match.any,
|
||||
sinon.match.any,
|
||||
"--threads=-1",
|
||||
"--ram=4992",
|
||||
),
|
||||
);
|
||||
t.assert(
|
||||
runQueriesStub.calledOnceWith(
|
||||
sinon.match.any,
|
||||
"--ram=4992",
|
||||
"--threads=-1",
|
||||
),
|
||||
);
|
||||
});
|
||||
});
|
||||
@@ -1,88 +0,0 @@
|
||||
import test from "ava";
|
||||
import * as sinon from "sinon";
|
||||
|
||||
import * as actionsUtil from "./actions-util";
|
||||
import * as analyze from "./analyze";
|
||||
import * as api from "./api-client";
|
||||
import * as configUtils from "./config-utils";
|
||||
import * as gitUtils from "./git-utils";
|
||||
import * as statusReport from "./status-report";
|
||||
import {
|
||||
setupTests,
|
||||
setupActionsVars,
|
||||
mockFeatureFlagApiEndpoint,
|
||||
} from "./testing-utils";
|
||||
import * as util from "./util";
|
||||
|
||||
setupTests(test);
|
||||
|
||||
// This test needs to be in its own file so that ava would run it in its own
|
||||
// nodejs process. The code being tested is in analyze-action.ts, which runs
|
||||
// immediately on load. So the file needs to be loaded during part of the test,
|
||||
// and that can happen only once per nodejs process. If multiple such tests are
|
||||
// in the same test file, ava would run them in the same nodejs process, and all
|
||||
// but the first test would fail.
|
||||
|
||||
test("analyze action with RAM & threads from action inputs", async (t) => {
|
||||
t.timeout(1000 * 20);
|
||||
await util.withTmpDir(async (tmpDir) => {
|
||||
setupActionsVars(tmpDir, tmpDir);
|
||||
sinon
|
||||
.stub(statusReport, "createStatusReportBase")
|
||||
.resolves({} as statusReport.StatusReportBase);
|
||||
sinon.stub(statusReport, "sendStatusReport").resolves();
|
||||
const gitHubVersion: util.GitHubVersion = {
|
||||
type: util.GitHubVariant.DOTCOM,
|
||||
};
|
||||
sinon.stub(configUtils, "getConfig").resolves({
|
||||
gitHubVersion,
|
||||
augmentationProperties: {},
|
||||
languages: [],
|
||||
packs: [],
|
||||
trapCaches: {},
|
||||
} as unknown as configUtils.Config);
|
||||
const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
|
||||
requiredInputStub.withArgs("token").returns("fake-token");
|
||||
requiredInputStub.withArgs("upload-database").returns("false");
|
||||
requiredInputStub.withArgs("output").returns("out");
|
||||
const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
|
||||
optionalInputStub.withArgs("expect-error").returns("false");
|
||||
sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
|
||||
sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
|
||||
mockFeatureFlagApiEndpoint(200, {});
|
||||
|
||||
process.env["CODEQL_THREADS"] = "1";
|
||||
process.env["CODEQL_RAM"] = "4992";
|
||||
|
||||
// Action inputs have precedence over environment variables.
|
||||
optionalInputStub.withArgs("threads").returns("-1");
|
||||
optionalInputStub.withArgs("ram").returns("3012");
|
||||
|
||||
const runFinalizeStub = sinon.stub(analyze, "runFinalize");
|
||||
const runQueriesStub = sinon.stub(analyze, "runQueries");
|
||||
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
||||
const analyzeAction = require("./analyze-action");
|
||||
|
||||
// When analyze-action.ts loads, it runs an async function from the top
|
||||
// level but does not wait for it to finish. To ensure that calls to
|
||||
// runFinalize and runQueries are correctly captured by spies, we explicitly
|
||||
// wait for the action promise to complete before starting verification.
|
||||
await analyzeAction.runPromise;
|
||||
|
||||
t.assert(
|
||||
runFinalizeStub.calledOnceWith(
|
||||
sinon.match.any,
|
||||
sinon.match.any,
|
||||
"--threads=-1",
|
||||
"--ram=3012",
|
||||
),
|
||||
);
|
||||
t.assert(
|
||||
runQueriesStub.calledOnceWith(
|
||||
sinon.match.any,
|
||||
"--ram=3012",
|
||||
"--threads=-1",
|
||||
),
|
||||
);
|
||||
});
|
||||
});
|
||||
@@ -20,7 +20,7 @@ import { EnvVar } from "./environment";
|
||||
import { getActionsLogger } from "./logging";
|
||||
import { checkGitHubVersionInRange, getErrorMessage } from "./util";
|
||||
|
||||
async function runWrapper() {
|
||||
export async function runWrapper() {
|
||||
// To capture errors appropriately, keep as much code within the try-catch as
|
||||
// possible, and only use safe functions outside.
|
||||
|
||||
@@ -72,5 +72,3 @@ async function runWrapper() {
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
void runWrapper();
|
||||
|
||||
@@ -0,0 +1,142 @@
|
||||
import test from "ava";
|
||||
import * as sinon from "sinon";
|
||||
|
||||
import * as actionsUtil from "./actions-util";
|
||||
import * as analyze from "./analyze";
|
||||
import { runWrapper } from "./analyze-action";
|
||||
import * as api from "./api-client";
|
||||
import * as configUtils from "./config-utils";
|
||||
import * as gitUtils from "./git-utils";
|
||||
import * as statusReport from "./status-report";
|
||||
import {
|
||||
setupTests,
|
||||
setupActionsVars,
|
||||
mockFeatureFlagApiEndpoint,
|
||||
} from "./testing-utils";
|
||||
import * as util from "./util";
|
||||
|
||||
setupTests(test);
|
||||
|
||||
test.serial(
|
||||
"analyze action with RAM & threads from environment variables",
|
||||
async (t) => {
|
||||
// This test frequently times out on Windows with the default timeout, so we bump
|
||||
// it a bit to 20s.
|
||||
t.timeout(1000 * 20);
|
||||
await util.withTmpDir(async (tmpDir) => {
|
||||
setupActionsVars(tmpDir, tmpDir);
|
||||
sinon
|
||||
.stub(statusReport, "createStatusReportBase")
|
||||
.resolves({} as statusReport.StatusReportBase);
|
||||
sinon.stub(statusReport, "sendStatusReport").resolves();
|
||||
sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
|
||||
|
||||
const gitHubVersion: util.GitHubVersion = {
|
||||
type: util.GitHubVariant.DOTCOM,
|
||||
};
|
||||
sinon.stub(configUtils, "getConfig").resolves({
|
||||
gitHubVersion,
|
||||
augmentationProperties: {},
|
||||
languages: [],
|
||||
packs: [],
|
||||
trapCaches: {},
|
||||
} as unknown as configUtils.Config);
|
||||
const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
|
||||
requiredInputStub.withArgs("token").returns("fake-token");
|
||||
requiredInputStub.withArgs("upload-database").returns("false");
|
||||
requiredInputStub.withArgs("output").returns("out");
|
||||
const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
|
||||
optionalInputStub.withArgs("expect-error").returns("false");
|
||||
sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
|
||||
mockFeatureFlagApiEndpoint(200, {});
|
||||
|
||||
// When there are no action inputs for RAM and threads, the action uses
|
||||
// environment variables (passed down from the init action) to set RAM and
|
||||
// threads usage.
|
||||
process.env["CODEQL_THREADS"] = "-1";
|
||||
process.env["CODEQL_RAM"] = "4992";
|
||||
|
||||
const runFinalizeStub = sinon.stub(analyze, "runFinalize");
|
||||
const runQueriesStub = sinon.stub(analyze, "runQueries");
|
||||
|
||||
await runWrapper();
|
||||
|
||||
t.assert(
|
||||
runFinalizeStub.calledOnceWith(
|
||||
sinon.match.any,
|
||||
sinon.match.any,
|
||||
"--threads=-1",
|
||||
"--ram=4992",
|
||||
),
|
||||
);
|
||||
t.assert(
|
||||
runQueriesStub.calledOnceWith(
|
||||
sinon.match.any,
|
||||
"--ram=4992",
|
||||
"--threads=-1",
|
||||
),
|
||||
);
|
||||
});
|
||||
},
|
||||
);
|
||||
|
||||
test.serial(
|
||||
"analyze action with RAM & threads from action inputs",
|
||||
async (t) => {
|
||||
t.timeout(1000 * 20);
|
||||
await util.withTmpDir(async (tmpDir) => {
|
||||
setupActionsVars(tmpDir, tmpDir);
|
||||
sinon
|
||||
.stub(statusReport, "createStatusReportBase")
|
||||
.resolves({} as statusReport.StatusReportBase);
|
||||
sinon.stub(statusReport, "sendStatusReport").resolves();
|
||||
const gitHubVersion: util.GitHubVersion = {
|
||||
type: util.GitHubVariant.DOTCOM,
|
||||
};
|
||||
sinon.stub(configUtils, "getConfig").resolves({
|
||||
gitHubVersion,
|
||||
augmentationProperties: {},
|
||||
languages: [],
|
||||
packs: [],
|
||||
trapCaches: {},
|
||||
} as unknown as configUtils.Config);
|
||||
const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
|
||||
requiredInputStub.withArgs("token").returns("fake-token");
|
||||
requiredInputStub.withArgs("upload-database").returns("false");
|
||||
requiredInputStub.withArgs("output").returns("out");
|
||||
const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
|
||||
optionalInputStub.withArgs("expect-error").returns("false");
|
||||
sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
|
||||
sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
|
||||
mockFeatureFlagApiEndpoint(200, {});
|
||||
|
||||
process.env["CODEQL_THREADS"] = "1";
|
||||
process.env["CODEQL_RAM"] = "4992";
|
||||
|
||||
// Action inputs have precedence over environment variables.
|
||||
optionalInputStub.withArgs("threads").returns("-1");
|
||||
optionalInputStub.withArgs("ram").returns("3012");
|
||||
|
||||
const runFinalizeStub = sinon.stub(analyze, "runFinalize");
|
||||
const runQueriesStub = sinon.stub(analyze, "runQueries");
|
||||
|
||||
await runWrapper();
|
||||
|
||||
t.assert(
|
||||
runFinalizeStub.calledOnceWith(
|
||||
sinon.match.any,
|
||||
sinon.match.any,
|
||||
"--threads=-1",
|
||||
"--ram=3012",
|
||||
),
|
||||
);
|
||||
t.assert(
|
||||
runQueriesStub.calledOnceWith(
|
||||
sinon.match.any,
|
||||
"--ram=3012",
|
||||
"--threads=-1",
|
||||
),
|
||||
);
|
||||
});
|
||||
},
|
||||
);
|
||||
@@ -523,14 +523,11 @@ async function run(startedAt: Date) {
|
||||
}
|
||||
}
|
||||
|
||||
// Module-level startedAt so it can be accessed by runWrapper for error reporting
|
||||
const startedAt = new Date();
|
||||
export const runPromise = run(startedAt);
|
||||
|
||||
async function runWrapper() {
|
||||
export async function runWrapper() {
|
||||
const startedAt = new Date();
|
||||
const logger = getActionsLogger();
|
||||
try {
|
||||
await runPromise;
|
||||
await run(startedAt);
|
||||
} catch (error) {
|
||||
core.setFailed(`analyze action failed: ${util.getErrorMessage(error)}`);
|
||||
await sendUnhandledErrorStatusReport(
|
||||
@@ -542,5 +539,3 @@ async function runWrapper() {
|
||||
}
|
||||
await util.checkForTimeout();
|
||||
}
|
||||
|
||||
void runWrapper();
|
||||
|
||||
@@ -141,14 +141,9 @@ test("scanArtifactsForTokens handles files without tokens", async (t) => {
|
||||
}
|
||||
});
|
||||
|
||||
// This test is slow (extracts and scans a zip artifact), so by default we only run it in CI. Set
|
||||
// RUN_SLOW_TESTS=1 to run it locally.
|
||||
if (
|
||||
os.platform() !== "win32" &&
|
||||
(process.env.CI === "true" || process.env.RUN_SLOW_TESTS === "1")
|
||||
) {
|
||||
// `scanArchiveFile` does not support Windows, so we skip this test there.
|
||||
if (os.platform() !== "win32") {
|
||||
test("scanArtifactsForTokens finds token in debug artifacts", async (t) => {
|
||||
t.timeout(15000); // 15 seconds
|
||||
const messages: LoggedMessage[] = [];
|
||||
const logger = getRecordingLogger(messages, { logToConsole: false });
|
||||
// The zip here is a regression test based on
|
||||
|
||||
@@ -142,7 +142,7 @@ async function run(startedAt: Date) {
|
||||
await sendCompletedStatusReport(config, logger, startedAt, languages ?? []);
|
||||
}
|
||||
|
||||
async function runWrapper() {
|
||||
export async function runWrapper() {
|
||||
const startedAt = new Date();
|
||||
const logger = getActionsLogger();
|
||||
try {
|
||||
@@ -157,5 +157,3 @@ async function runWrapper() {
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
void runWrapper();
|
||||
|
||||
+4
-4
@@ -1072,7 +1072,7 @@ test.serial(
|
||||
);
|
||||
|
||||
test.serial(
|
||||
"Avoids duplicating --overwrite flag if specified in CODEQL_ACTION_EXTRA_OPTIONS",
|
||||
"Avoids duplicating --force-overwrite flag if specified in CODEQL_ACTION_EXTRA_OPTIONS",
|
||||
async (t) => {
|
||||
const runnerConstructorStub = stubToolRunnerConstructor();
|
||||
const codeqlObject = await stubCodeql();
|
||||
@@ -1080,7 +1080,7 @@ test.serial(
|
||||
sinon.stub(io, "which").resolves("");
|
||||
|
||||
process.env["CODEQL_ACTION_EXTRA_OPTIONS"] =
|
||||
'{ "database": { "init": ["--overwrite"] } }';
|
||||
'{ "database": { "init": ["--force-overwrite"] } }';
|
||||
|
||||
await codeqlObject.databaseInitCluster(
|
||||
stubConfig,
|
||||
@@ -1093,9 +1093,9 @@ test.serial(
|
||||
t.true(runnerConstructorStub.calledOnce);
|
||||
const args = runnerConstructorStub.firstCall.args[1] as string[];
|
||||
t.is(
|
||||
args.filter((option: string) => option === "--overwrite").length,
|
||||
args.filter((option: string) => option === "--force-overwrite").length,
|
||||
1,
|
||||
"--overwrite should only be passed once",
|
||||
"--force-overwrite should only be passed once",
|
||||
);
|
||||
|
||||
// Clean up
|
||||
|
||||
+13
-18
@@ -277,7 +277,7 @@ let cachedCodeQL: CodeQL | undefined = undefined;
|
||||
* The version flags below can be used to conditionally enable certain features
|
||||
* on versions newer than this.
|
||||
*/
|
||||
const CODEQL_MINIMUM_VERSION = "2.17.6";
|
||||
const CODEQL_MINIMUM_VERSION = "2.19.4";
|
||||
|
||||
/**
|
||||
* This version will shortly become the oldest version of CodeQL that the Action will run with.
|
||||
@@ -592,13 +592,6 @@ async function getCodeQLForCmd(
|
||||
extraArgs.push(`--qlconfig-file=${qlconfigFile}`);
|
||||
}
|
||||
|
||||
const overwriteFlag = isSupportedToolsFeature(
|
||||
await this.getVersion(),
|
||||
ToolsFeature.ForceOverwrite,
|
||||
)
|
||||
? "--force-overwrite"
|
||||
: "--overwrite";
|
||||
|
||||
const overlayDatabaseMode = config.overlayDatabaseMode;
|
||||
if (overlayDatabaseMode === OverlayDatabaseMode.Overlay) {
|
||||
const overlayChangesFile = await writeOverlayChangesFile(
|
||||
@@ -625,7 +618,7 @@ async function getCodeQLForCmd(
|
||||
"init",
|
||||
...(overlayDatabaseMode === OverlayDatabaseMode.Overlay
|
||||
? []
|
||||
: [overwriteFlag]),
|
||||
: ["--force-overwrite"]),
|
||||
"--db-cluster",
|
||||
config.dbLocation,
|
||||
`--source-root=${sourceRoot}`,
|
||||
@@ -636,7 +629,14 @@ async function getCodeQLForCmd(
|
||||
// Some user configs specify `--no-calculate-baseline` as an additional
|
||||
// argument to `codeql database init`. Therefore ignore the baseline file
|
||||
// options here to avoid specifying the same argument twice and erroring.
|
||||
ignoringOptions: ["--overwrite", ...baselineFilesOptions],
|
||||
//
|
||||
// Ignore `--overwrite` to avoid passing both `--force-overwrite` and `--overwrite` if
|
||||
// the user has configured `--overwrite`.
|
||||
ignoringOptions: [
|
||||
"--force-overwrite",
|
||||
"--overwrite",
|
||||
...baselineFilesOptions,
|
||||
],
|
||||
}),
|
||||
],
|
||||
{ stdin: externalRepositoryToken },
|
||||
@@ -853,7 +853,7 @@ async function getCodeQLForCmd(
|
||||
"--sarif-group-rules-by-pack",
|
||||
"--sarif-include-query-help=always",
|
||||
"--sublanguage-file-coverage",
|
||||
...(await getJobRunUuidSarifOptions(this)),
|
||||
...(await getJobRunUuidSarifOptions()),
|
||||
...getExtraOptionsFromEnv(["database", "interpret-results"]),
|
||||
];
|
||||
if (sarifRunPropertyFlag !== undefined) {
|
||||
@@ -1283,13 +1283,8 @@ function applyAutobuildAzurePipelinesTimeoutFix() {
|
||||
].join(" ");
|
||||
}
|
||||
|
||||
async function getJobRunUuidSarifOptions(codeql: CodeQL) {
|
||||
async function getJobRunUuidSarifOptions() {
|
||||
const jobRunUuid = process.env[EnvVar.JOB_RUN_UUID];
|
||||
|
||||
return jobRunUuid &&
|
||||
(await codeql.supportsFeature(
|
||||
ToolsFeature.DatabaseInterpretResultsSupportsSarifRunProperty,
|
||||
))
|
||||
? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`]
|
||||
: [];
|
||||
return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
|
||||
}
|
||||
|
||||
@@ -21,6 +21,7 @@ import { GitVersionInfo } from "./git-utils";
|
||||
import { BuiltInLanguage, Language } from "./languages";
|
||||
import { getRunnerLogger } from "./logging";
|
||||
import { CODEQL_OVERLAY_MINIMUM_VERSION } from "./overlay";
|
||||
import * as overlayDiagnostics from "./overlay/diagnostics";
|
||||
import { OverlayDisabledReason } from "./overlay/diagnostics";
|
||||
import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
|
||||
import * as overlayStatus from "./overlay/status";
|
||||
@@ -2143,3 +2144,87 @@ test.serial(
|
||||
});
|
||||
},
|
||||
);
|
||||
|
||||
test("applyIncrementalAnalysisSettings: no-op when mode is not Overlay and diff ranges are unavailable", async (t) => {
|
||||
const config = createTestConfig({});
|
||||
config.overlayDatabaseMode = OverlayDatabaseMode.None;
|
||||
const codeql = createStubCodeQL({});
|
||||
const logger = getRunnerLogger(true);
|
||||
|
||||
await configUtils.applyIncrementalAnalysisSettings(
|
||||
config,
|
||||
false,
|
||||
codeql,
|
||||
logger,
|
||||
);
|
||||
|
||||
t.is(config.overlayDatabaseMode, OverlayDatabaseMode.None);
|
||||
t.deepEqual(config.extraQueryExclusions, []);
|
||||
});
|
||||
|
||||
test("applyIncrementalAnalysisSettings: keeps overlay mode and adds exclusions when diff ranges are available", async (t) => {
|
||||
const config = createTestConfig({
|
||||
overlayDatabaseMode: OverlayDatabaseMode.Overlay,
|
||||
});
|
||||
const codeql = createStubCodeQL({});
|
||||
const logger = getRunnerLogger(true);
|
||||
|
||||
await configUtils.applyIncrementalAnalysisSettings(
|
||||
config,
|
||||
true,
|
||||
codeql,
|
||||
logger,
|
||||
);
|
||||
|
||||
t.is(config.overlayDatabaseMode, OverlayDatabaseMode.Overlay);
|
||||
t.deepEqual(config.extraQueryExclusions, [
|
||||
{ exclude: { tags: "exclude-from-incremental" } },
|
||||
]);
|
||||
});
|
||||
|
||||
test("applyIncrementalAnalysisSettings: disables overlay analysis when diff ranges are unavailable", async (t) => {
|
||||
const config = createTestConfig({
|
||||
overlayDatabaseMode: OverlayDatabaseMode.Overlay,
|
||||
});
|
||||
config.useOverlayDatabaseCaching = true;
|
||||
const codeql = createStubCodeQL({});
|
||||
const logger = getRunnerLogger(true);
|
||||
const addDiagnosticsStub = sinon
|
||||
.stub(overlayDiagnostics, "addOverlayDisablementDiagnostics")
|
||||
.resolves();
|
||||
|
||||
await configUtils.applyIncrementalAnalysisSettings(
|
||||
config,
|
||||
false,
|
||||
codeql,
|
||||
logger,
|
||||
);
|
||||
|
||||
t.is(config.overlayDatabaseMode, OverlayDatabaseMode.None);
|
||||
t.is(config.useOverlayDatabaseCaching, false);
|
||||
t.deepEqual(config.extraQueryExclusions, []);
|
||||
t.true(addDiagnosticsStub.calledOnce);
|
||||
t.is(
|
||||
addDiagnosticsStub.firstCall.args[2],
|
||||
OverlayDisabledReason.DiffInformedAnalysisNotEnabled,
|
||||
);
|
||||
});
|
||||
|
||||
test("applyIncrementalAnalysisSettings: adds exclusions for diff-informed-only runs", async (t) => {
|
||||
const config = createTestConfig({});
|
||||
config.overlayDatabaseMode = OverlayDatabaseMode.None;
|
||||
const codeql = createStubCodeQL({});
|
||||
const logger = getRunnerLogger(true);
|
||||
|
||||
await configUtils.applyIncrementalAnalysisSettings(
|
||||
config,
|
||||
true,
|
||||
codeql,
|
||||
logger,
|
||||
);
|
||||
|
||||
t.is(config.overlayDatabaseMode, OverlayDatabaseMode.None);
|
||||
t.deepEqual(config.extraQueryExclusions, [
|
||||
{ exclude: { tags: "exclude-from-incremental" } },
|
||||
]);
|
||||
});
|
||||
|
||||
+55
-13
@@ -31,7 +31,7 @@ import {
|
||||
addNoLanguageDiagnostic,
|
||||
makeTelemetryDiagnostic,
|
||||
} from "./diagnostics";
|
||||
import { shouldPerformDiffInformedAnalysis } from "./diff-informed-analysis-utils";
|
||||
import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
|
||||
import { EnvVar } from "./environment";
|
||||
import * as errorMessages from "./error-messages";
|
||||
import { Feature, FeatureEnablement } from "./feature-flags";
|
||||
@@ -1077,6 +1077,48 @@ function hasQueryCustomisation(userConfig: UserConfig): boolean {
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Finalize the incremental-analysis configuration for this run.
|
||||
*
|
||||
* Overlay analysis has only been validated in combination with diff-informed
|
||||
* analysis, so if `Overlay` mode was selected for a pull request but the diff
|
||||
* ranges could not be computed, fall back to a full non-overlay analysis.
|
||||
*
|
||||
* Query exclusions for incremental-only queries are then applied whenever the
|
||||
* diff ranges are available — which, after the fallback above, is exactly the
|
||||
* set of runs where any kind of incremental analysis (overlay or
|
||||
* diff-informed) is in effect.
|
||||
*/
|
||||
export async function applyIncrementalAnalysisSettings(
|
||||
config: Config,
|
||||
hasDiffRanges: boolean,
|
||||
codeql: CodeQL,
|
||||
logger: Logger,
|
||||
): Promise<void> {
|
||||
if (
|
||||
config.overlayDatabaseMode === OverlayDatabaseMode.Overlay &&
|
||||
!hasDiffRanges
|
||||
) {
|
||||
logger.info(
|
||||
`Reverting overlay database mode to ${OverlayDatabaseMode.None} ` +
|
||||
"because the PR diff ranges could not be computed.",
|
||||
);
|
||||
config.overlayDatabaseMode = OverlayDatabaseMode.None;
|
||||
config.useOverlayDatabaseCaching = false;
|
||||
await addOverlayDisablementDiagnostics(
|
||||
config,
|
||||
codeql,
|
||||
OverlayDisabledReason.DiffInformedAnalysisNotEnabled,
|
||||
);
|
||||
}
|
||||
|
||||
if (hasDiffRanges) {
|
||||
config.extraQueryExclusions.push({
|
||||
exclude: { tags: "exclude-from-incremental" },
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Load and return the config.
|
||||
*
|
||||
@@ -1231,18 +1273,18 @@ export async function initConfig(
|
||||
);
|
||||
}
|
||||
|
||||
if (
|
||||
config.overlayDatabaseMode === OverlayDatabaseMode.Overlay ||
|
||||
(await shouldPerformDiffInformedAnalysis(
|
||||
inputs.codeql,
|
||||
inputs.features,
|
||||
logger,
|
||||
))
|
||||
) {
|
||||
config.extraQueryExclusions.push({
|
||||
exclude: { tags: "exclude-from-incremental" },
|
||||
});
|
||||
}
|
||||
const hasDiffRanges = await prepareDiffInformedAnalysis(
|
||||
inputs.codeql,
|
||||
inputs.features,
|
||||
logger,
|
||||
);
|
||||
|
||||
await applyIncrementalAnalysisSettings(
|
||||
config,
|
||||
hasDiffRanges,
|
||||
inputs.codeql,
|
||||
logger,
|
||||
);
|
||||
|
||||
if (await isTrapCachingEnabled(features, config.overlayDatabaseMode)) {
|
||||
const { trapCaches, trapCacheDownloadTime } = await downloadCacheWithTime(
|
||||
|
||||
@@ -5,14 +5,16 @@ import * as actionsUtil from "./actions-util";
|
||||
import type { PullRequestBranches } from "./actions-util";
|
||||
import * as apiClient from "./api-client";
|
||||
import {
|
||||
shouldPerformDiffInformedAnalysis,
|
||||
getDiffInformedAnalysisBranches,
|
||||
prepareDiffInformedAnalysis,
|
||||
exportedForTesting,
|
||||
} from "./diff-informed-analysis-utils";
|
||||
import { Feature, initFeatures } from "./feature-flags";
|
||||
import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
|
||||
import { getRunnerLogger } from "./logging";
|
||||
import { parseRepositoryNwo } from "./repository";
|
||||
import {
|
||||
setupTests,
|
||||
createFeatures,
|
||||
mockCodeQLVersion,
|
||||
mockFeatureFlagApiEndpoint,
|
||||
setupActionsVars,
|
||||
@@ -73,28 +75,25 @@ const testShouldPerformDiffInformedAnalysis = makeMacro({
|
||||
[Feature.DiffInformedQueries]: testCase.featureEnabled,
|
||||
});
|
||||
|
||||
const getGitHubVersionStub = sinon
|
||||
sinon
|
||||
.stub(apiClient, "getGitHubVersion")
|
||||
.resolves(testCase.gitHubVersion);
|
||||
const getPullRequestBranchesStub = sinon
|
||||
sinon
|
||||
.stub(actionsUtil, "getPullRequestBranches")
|
||||
.returns(testCase.pullRequestBranches);
|
||||
|
||||
const result = await shouldPerformDiffInformedAnalysis(
|
||||
const branches = await getDiffInformedAnalysisBranches(
|
||||
codeql,
|
||||
features,
|
||||
logger,
|
||||
);
|
||||
|
||||
t.is(result, expectedResult);
|
||||
t.is(branches !== undefined, expectedResult);
|
||||
|
||||
delete process.env.CODEQL_ACTION_DIFF_INFORMED_QUERIES;
|
||||
|
||||
getGitHubVersionStub.restore();
|
||||
getPullRequestBranchesStub.restore();
|
||||
});
|
||||
},
|
||||
title: (title) => `shouldPerformDiffInformedAnalysis: ${title}`,
|
||||
title: (title) => `getDiffInformedAnalysisBranches: ${title}`,
|
||||
});
|
||||
|
||||
testShouldPerformDiffInformedAnalysis.serial(
|
||||
@@ -178,6 +177,135 @@ testShouldPerformDiffInformedAnalysis.serial(
|
||||
false,
|
||||
);
|
||||
|
||||
test.serial(
|
||||
"prepareDiffInformedAnalysis: returns false when not a pull request",
|
||||
async (t) => {
|
||||
await withTmpDir(async (tmpDir) => {
|
||||
setupActionsVars(tmpDir, tmpDir);
|
||||
const logger = getRunnerLogger(true);
|
||||
const codeql = mockCodeQLVersion("2.21.0");
|
||||
const features = createFeatures([Feature.DiffInformedQueries]);
|
||||
|
||||
sinon.stub(actionsUtil, "getPullRequestBranches").returns(undefined);
|
||||
sinon
|
||||
.stub(apiClient, "getGitHubVersion")
|
||||
.resolves({ type: GitHubVariant.DOTCOM });
|
||||
|
||||
const result = await prepareDiffInformedAnalysis(
|
||||
codeql,
|
||||
features,
|
||||
logger,
|
||||
);
|
||||
|
||||
t.false(result);
|
||||
});
|
||||
},
|
||||
);
|
||||
|
||||
test.serial(
|
||||
"prepareDiffInformedAnalysis: returns false when applicability check throws",
|
||||
async (t) => {
|
||||
await withTmpDir(async (tmpDir) => {
|
||||
setupActionsVars(tmpDir, tmpDir);
|
||||
const logger = getRunnerLogger(true);
|
||||
const codeql = mockCodeQLVersion("2.21.0");
|
||||
// A features implementation whose getValue rejects, simulating an
|
||||
// unexpected failure when determining whether diff-informed analysis
|
||||
// should run.
|
||||
const features: FeatureEnablement = {
|
||||
getEnabledDefaultCliVersions: async () => {
|
||||
throw new Error("not implemented");
|
||||
},
|
||||
getValue: async () => {
|
||||
throw new Error("feature flag lookup failed");
|
||||
},
|
||||
};
|
||||
|
||||
const result = await prepareDiffInformedAnalysis(
|
||||
codeql,
|
||||
features,
|
||||
logger,
|
||||
);
|
||||
|
||||
t.false(result);
|
||||
});
|
||||
},
|
||||
);
|
||||
|
||||
test.serial(
|
||||
"prepareDiffInformedAnalysis: returns true when the diff is fetched successfully",
|
||||
async (t) => {
|
||||
await withTmpDir(async (tmpDir) => {
|
||||
setupActionsVars(tmpDir, tmpDir);
|
||||
const logger = getRunnerLogger(true);
|
||||
const codeql = mockCodeQLVersion("2.21.0");
|
||||
const features = createFeatures([Feature.DiffInformedQueries]);
|
||||
|
||||
sinon
|
||||
.stub(actionsUtil, "getPullRequestBranches")
|
||||
.returns({ base: "main", head: "feature" });
|
||||
sinon
|
||||
.stub(apiClient, "getGitHubVersion")
|
||||
.resolves({ type: GitHubVariant.DOTCOM });
|
||||
// eslint-disable-next-line @typescript-eslint/no-unsafe-argument
|
||||
sinon.stub(apiClient, "getApiClient").returns({
|
||||
rest: {
|
||||
repos: {
|
||||
compareCommitsWithBasehead: sinon
|
||||
.stub()
|
||||
.resolves({ data: { files: [] } }),
|
||||
},
|
||||
},
|
||||
} as any);
|
||||
|
||||
const result = await prepareDiffInformedAnalysis(
|
||||
codeql,
|
||||
features,
|
||||
logger,
|
||||
);
|
||||
|
||||
t.true(result);
|
||||
});
|
||||
},
|
||||
);
|
||||
|
||||
test.serial(
|
||||
"prepareDiffInformedAnalysis: returns false when the diff API call fails",
|
||||
async (t) => {
|
||||
await withTmpDir(async (tmpDir) => {
|
||||
setupActionsVars(tmpDir, tmpDir);
|
||||
const logger = getRunnerLogger(true);
|
||||
const codeql = mockCodeQLVersion("2.21.0");
|
||||
const features = createFeatures([Feature.DiffInformedQueries]);
|
||||
|
||||
sinon
|
||||
.stub(actionsUtil, "getPullRequestBranches")
|
||||
.returns({ base: "main", head: "feature" });
|
||||
sinon
|
||||
.stub(apiClient, "getGitHubVersion")
|
||||
.resolves({ type: GitHubVariant.DOTCOM });
|
||||
const notFoundError: any = new Error("Not Found");
|
||||
notFoundError.status = 404;
|
||||
// eslint-disable-next-line @typescript-eslint/no-unsafe-argument
|
||||
sinon.stub(apiClient, "getApiClient").returns({
|
||||
rest: {
|
||||
repos: {
|
||||
compareCommitsWithBasehead: sinon.stub().rejects(notFoundError),
|
||||
},
|
||||
},
|
||||
} as any);
|
||||
|
||||
const result = await prepareDiffInformedAnalysis(
|
||||
codeql,
|
||||
features,
|
||||
logger,
|
||||
);
|
||||
|
||||
t.false(result);
|
||||
});
|
||||
},
|
||||
);
|
||||
|
||||
function runGetDiffRanges(changes: number, patch: string[] | undefined): any {
|
||||
return exportedForTesting.getDiffRanges(
|
||||
{
|
||||
|
||||
@@ -5,9 +5,9 @@ import type { PullRequestBranches } from "./actions-util";
|
||||
import { getApiClient, getGitHubVersion } from "./api-client";
|
||||
import type { CodeQL } from "./codeql";
|
||||
import { Feature, FeatureEnablement } from "./feature-flags";
|
||||
import { Logger } from "./logging";
|
||||
import { Logger, withGroupAsync } from "./logging";
|
||||
import { getRepositoryNwoFromEnv } from "./repository";
|
||||
import { GitHubVariant, satisfiesGHESVersion } from "./util";
|
||||
import { getErrorMessage, GitHubVariant, satisfiesGHESVersion } from "./util";
|
||||
|
||||
/**
|
||||
* This interface is an abbreviated version of the file diff object returned by
|
||||
@@ -21,20 +21,6 @@ interface FileDiff {
|
||||
patch?: string | undefined;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if the action should perform diff-informed analysis.
|
||||
*/
|
||||
export async function shouldPerformDiffInformedAnalysis(
|
||||
codeql: CodeQL,
|
||||
features: FeatureEnablement,
|
||||
logger: Logger,
|
||||
): Promise<boolean> {
|
||||
return (
|
||||
(await getDiffInformedAnalysisBranches(codeql, features, logger)) !==
|
||||
undefined
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the branches to use for diff-informed analysis.
|
||||
*
|
||||
@@ -69,6 +55,46 @@ export async function getDiffInformedAnalysisBranches(
|
||||
return branches;
|
||||
}
|
||||
|
||||
/**
|
||||
* Prepares the diff ranges needed for diff-informed analysis for the current
|
||||
* run.
|
||||
*
|
||||
* @returns `true` if the diff ranges were successfully computed and persisted
|
||||
* and are therefore available for use, `false` otherwise.
|
||||
*/
|
||||
export async function prepareDiffInformedAnalysis(
|
||||
codeql: CodeQL,
|
||||
features: FeatureEnablement,
|
||||
logger: Logger,
|
||||
): Promise<boolean> {
|
||||
let branches: PullRequestBranches | undefined;
|
||||
try {
|
||||
branches = await getDiffInformedAnalysisBranches(codeql, features, logger);
|
||||
} catch (e) {
|
||||
// If we cannot determine whether diff-informed analysis applies (for
|
||||
// example, because a feature-flag lookup failed), treat it as not
|
||||
// applicable rather than triggering the overlay fallback.
|
||||
logger.warning(
|
||||
`Failed to determine branch information for diff-informed analysis: ${getErrorMessage(e)}`,
|
||||
);
|
||||
return false;
|
||||
}
|
||||
if (!branches) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return await withGroupAsync("Computing PR diff ranges", async () => {
|
||||
try {
|
||||
return await computeAndPersistDiffRanges(branches, logger);
|
||||
} catch (e) {
|
||||
logger.warning(
|
||||
`Failed to compute diff-informed analysis ranges: ${getErrorMessage(e)}`,
|
||||
);
|
||||
return false;
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
export interface DiffThunkRange {
|
||||
/** Relative path from the repository root, using forward slashes as separators. */
|
||||
path: string;
|
||||
@@ -151,6 +177,33 @@ export async function getPullRequestEditedDiffRanges(
|
||||
return results;
|
||||
}
|
||||
|
||||
/**
|
||||
* Compute and persist the diff ranges for a pull request. This fetches the
|
||||
* diff from the GitHub API and writes it to the diff ranges JSON file so that
|
||||
* CodeQL can use it for diff-informed analysis.
|
||||
*
|
||||
* @param branches The base and head branches of the pull request, as returned
|
||||
* by `getDiffInformedAnalysisBranches`.
|
||||
* @param logger
|
||||
* @returns `true` if the diff ranges were successfully computed and persisted,
|
||||
* otherwise `false`.
|
||||
*/
|
||||
export async function computeAndPersistDiffRanges(
|
||||
branches: PullRequestBranches,
|
||||
logger: Logger,
|
||||
): Promise<boolean> {
|
||||
const ranges = await getPullRequestEditedDiffRanges(branches, logger);
|
||||
if (ranges === undefined) {
|
||||
return false;
|
||||
}
|
||||
writeDiffRangesJsonFile(logger, ranges);
|
||||
const distinctFiles = new Set(ranges.map((r) => r.path)).size;
|
||||
logger.info(
|
||||
`Persisted ${ranges.length} diff range(s) across ${distinctFiles} file(s).`,
|
||||
);
|
||||
return true;
|
||||
}
|
||||
|
||||
async function getFileDiffsWithBasehead(
|
||||
branches: PullRequestBranches,
|
||||
logger: Logger,
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
export async function run__ACTION__() {
|
||||
return await __ACTION__.runWrapper();
|
||||
}
|
||||
@@ -26,6 +26,9 @@ const DEFAULT_VERSION_FEATURE_FLAG_SUFFIX = "_enabled";
|
||||
|
||||
/**
|
||||
* The first version of the CodeQL Bundle that shipped with zstd-compressed bundles.
|
||||
*
|
||||
* This is now below the minimum version of CodeQL, but we keep this around because we currently set
|
||||
* up CodeQL before checking that the version is new enough.
|
||||
*/
|
||||
export const CODEQL_VERSION_ZSTD_BUNDLE = "2.19.0";
|
||||
|
||||
|
||||
+77
-14
@@ -33,7 +33,6 @@ test.serial(
|
||||
|
||||
const actualRef = await gitUtils.getRef();
|
||||
t.deepEqual(actualRef, expectedRef);
|
||||
callback.restore();
|
||||
});
|
||||
},
|
||||
);
|
||||
@@ -54,7 +53,6 @@ test.serial(
|
||||
|
||||
const actualRef = await gitUtils.getRef();
|
||||
t.deepEqual(actualRef, expectedRef);
|
||||
callback.restore();
|
||||
});
|
||||
},
|
||||
);
|
||||
@@ -73,7 +71,6 @@ test.serial(
|
||||
|
||||
const actualRef = await gitUtils.getRef();
|
||||
t.deepEqual(actualRef, "refs/pull/1/head");
|
||||
callback.restore();
|
||||
});
|
||||
},
|
||||
);
|
||||
@@ -100,8 +97,6 @@ test.serial(
|
||||
|
||||
const actualRef = await gitUtils.getRef();
|
||||
t.deepEqual(actualRef, "refs/pull/2/merge");
|
||||
callback.restore();
|
||||
getAdditionalInputStub.restore();
|
||||
});
|
||||
},
|
||||
);
|
||||
@@ -161,7 +156,6 @@ test.serial(
|
||||
"Both 'ref' and 'sha' are required if one of them is provided.",
|
||||
},
|
||||
);
|
||||
getAdditionalInputStub.restore();
|
||||
});
|
||||
},
|
||||
);
|
||||
@@ -188,7 +182,6 @@ test.serial(
|
||||
"Both 'ref' and 'sha' are required if one of them is provided.",
|
||||
},
|
||||
);
|
||||
getAdditionalInputStub.restore();
|
||||
});
|
||||
},
|
||||
);
|
||||
@@ -242,7 +235,6 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => {
|
||||
process.env["GITHUB_EVENT_NAME"] = "schedule";
|
||||
process.env["GITHUB_REF"] = "refs/heads/main";
|
||||
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), false);
|
||||
getAdditionalInputStub.restore();
|
||||
});
|
||||
});
|
||||
|
||||
@@ -254,8 +246,6 @@ test.serial("determineBaseBranchHeadCommitOid non-pullrequest", async (t) => {
|
||||
const result = await gitUtils.determineBaseBranchHeadCommitOid(__dirname);
|
||||
t.deepEqual(result, undefined);
|
||||
t.deepEqual(0, infoStub.callCount);
|
||||
|
||||
infoStub.restore();
|
||||
});
|
||||
|
||||
test.serial(
|
||||
@@ -276,8 +266,6 @@ test.serial(
|
||||
"git call failed. Will calculate the base branch SHA on the server. Error: " +
|
||||
"The checkout path provided to the action does not appear to be a git repository.",
|
||||
);
|
||||
|
||||
infoStub.restore();
|
||||
},
|
||||
);
|
||||
|
||||
@@ -301,10 +289,27 @@ test.serial("determineBaseBranchHeadCommitOid other error", async (t) => {
|
||||
"The checkout path provided to the action does not appear to be a git repository.",
|
||||
),
|
||||
);
|
||||
|
||||
infoStub.restore();
|
||||
});
|
||||
|
||||
test.serial(
|
||||
"determineBaseBranchHeadCommitOid accepts SHA-256 OIDs",
|
||||
async (t) => {
|
||||
const mergeSha = "a".repeat(64);
|
||||
const baseOid = "b".repeat(64);
|
||||
const headOid = "c".repeat(64);
|
||||
|
||||
process.env["GITHUB_EVENT_NAME"] = "pull_request";
|
||||
process.env["GITHUB_SHA"] = mergeSha;
|
||||
|
||||
sinon
|
||||
.stub(gitUtils as any, "runGitCommand")
|
||||
.resolves(`commit ${mergeSha}\nparent ${baseOid}\nparent ${headOid}\n`);
|
||||
|
||||
const result = await gitUtils.determineBaseBranchHeadCommitOid(__dirname);
|
||||
t.deepEqual(result, baseOid);
|
||||
},
|
||||
);
|
||||
|
||||
test.serial("decodeGitFilePath unquoted strings", async (t) => {
|
||||
t.deepEqual(gitUtils.decodeGitFilePath("foo"), "foo");
|
||||
t.deepEqual(gitUtils.decodeGitFilePath("foo bar"), "foo bar");
|
||||
@@ -436,6 +441,64 @@ test.serial("getFileOidsUnderPath handles quoted paths", async (t) => {
|
||||
});
|
||||
});
|
||||
|
||||
test.serial("getFileOidsUnderPath handles SHA-256 OIDs", async (t) => {
|
||||
await withTmpDir(async (tmpDir) => {
|
||||
const sha256OidA =
|
||||
"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2c0d4b7e8f9a1234567890ab";
|
||||
const sha256OidB =
|
||||
"aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899";
|
||||
|
||||
sinon
|
||||
.stub(gitUtils as any, "runGitCommand")
|
||||
.callsFake(async (_cwd: any, args: any) => {
|
||||
if (args[0] === "rev-parse") {
|
||||
return `${tmpDir}\n`;
|
||||
}
|
||||
return (
|
||||
`100644 ${sha256OidA} 0\tlib/sha256-file-a.js\n` +
|
||||
`100644 ${sha256OidB} 0\tsrc/sha256-file-b.ts`
|
||||
);
|
||||
});
|
||||
|
||||
const result = await gitUtils.getFileOidsUnderPath("/fake/path");
|
||||
|
||||
t.deepEqual(result, {
|
||||
"lib/sha256-file-a.js": sha256OidA,
|
||||
"src/sha256-file-b.ts": sha256OidB,
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
test.serial(
|
||||
"getFileOidsUnderPath rejects OIDs of unsupported length",
|
||||
async (t) => {
|
||||
await withTmpDir(async (tmpDir) => {
|
||||
// 50-char OID: not a valid SHA-1 (40) or SHA-256 (64) length. The regex
|
||||
// must not accept this even though every character is a valid hex digit.
|
||||
const invalidLine =
|
||||
"100644 30d998ded095371488be3a729eb61d86ed721a1830d998ded0 0\tlib/bad.js";
|
||||
sinon
|
||||
.stub(gitUtils as any, "runGitCommand")
|
||||
.callsFake(async (_cwd: any, args: any) => {
|
||||
if (args[0] === "rev-parse") {
|
||||
return `${tmpDir}\n`;
|
||||
}
|
||||
return invalidLine;
|
||||
});
|
||||
|
||||
await t.throwsAsync(
|
||||
async () => {
|
||||
await gitUtils.getFileOidsUnderPath("/fake/path");
|
||||
},
|
||||
{
|
||||
instanceOf: Error,
|
||||
message: `Unexpected "git ls-files" output: ${invalidLine}`,
|
||||
},
|
||||
);
|
||||
});
|
||||
},
|
||||
);
|
||||
|
||||
test.serial("getFileOidsUnderPath handles empty output", async (t) => {
|
||||
await withTmpDir(async (tmpDir) => {
|
||||
sinon
|
||||
|
||||
+6
-4
@@ -163,11 +163,12 @@ export const determineBaseBranchHeadCommitOid = async function (
|
||||
}
|
||||
}
|
||||
|
||||
// Let's confirm our assumptions: We had a merge commit and the parsed parent data looks correct
|
||||
// Let's confirm our assumptions: We had a merge commit and the parsed parent
|
||||
// data looks correct. OIDs are either 40 (SHA-1) or 64 (SHA-256) hex characters.
|
||||
if (
|
||||
commitOid === mergeSha &&
|
||||
headOid.length === 40 &&
|
||||
baseOid.length === 40
|
||||
(headOid.length === 40 || headOid.length === 64) &&
|
||||
(baseOid.length === 40 || baseOid.length === 64)
|
||||
) {
|
||||
return baseOid;
|
||||
}
|
||||
@@ -296,7 +297,8 @@ export const getFileOidsUnderPath = async function (
|
||||
// 100644 4c51bc1d9e86cd86e01b0f340cb8ce095c33b283 0\tsrc/git-utils.test.ts
|
||||
// 100644 6b792ea543ce75d7a8a03df591e3c85311ecb64f 0\tsrc/git-utils.ts
|
||||
// The fields are: <mode> <oid> <stage>\t<path>
|
||||
const regex = /^[0-9]+ ([0-9a-f]{40}) [0-9]+\t(.+)$/;
|
||||
// The OID is either 40 (SHA-1) or 64 (SHA-256) hex characters.
|
||||
const regex = /^[0-9]+ ([0-9a-f]{40}|[0-9a-f]{64}) [0-9]+\t(.+)$/;
|
||||
for (const line of stdout.split("\n")) {
|
||||
if (line) {
|
||||
const match = line.match(regex);
|
||||
|
||||
@@ -207,7 +207,7 @@ function getJobStatusFromEnvironment(): JobStatus | undefined {
|
||||
return undefined;
|
||||
}
|
||||
|
||||
async function runWrapper() {
|
||||
export async function runWrapper() {
|
||||
const startedAt = new Date();
|
||||
const logger = getActionsLogger();
|
||||
try {
|
||||
@@ -222,5 +222,3 @@ async function runWrapper() {
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
void runWrapper();
|
||||
|
||||
+1
-45
@@ -37,11 +37,6 @@ import {
|
||||
makeDiagnostic,
|
||||
makeTelemetryDiagnostic,
|
||||
} from "./diagnostics";
|
||||
import {
|
||||
getDiffInformedAnalysisBranches,
|
||||
getPullRequestEditedDiffRanges,
|
||||
writeDiffRangesJsonFile,
|
||||
} from "./diff-informed-analysis-utils";
|
||||
import { EnvVar } from "./environment";
|
||||
import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
|
||||
import {
|
||||
@@ -434,7 +429,6 @@ async function run(startedAt: Date) {
|
||||
}
|
||||
|
||||
await checkInstallPython311(config.languages, codeql);
|
||||
await computeAndPersistDiffRanges(codeql, features, logger);
|
||||
} catch (unwrappedError) {
|
||||
const error = wrapError(unwrappedError);
|
||||
core.setFailed(error.message);
|
||||
@@ -830,42 +824,6 @@ async function loadRepositoryProperties(
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Compute and persist diff ranges when diff-informed analysis is enabled
|
||||
* (feature flag + PR context). This writes the standard pr-diff-range.json
|
||||
* file for later reuse in the analyze step. Failures are logged but non-fatal.
|
||||
*/
|
||||
async function computeAndPersistDiffRanges(
|
||||
codeql: CodeQL,
|
||||
features: FeatureEnablement,
|
||||
logger: Logger,
|
||||
): Promise<void> {
|
||||
await withGroupAsync("Computing PR diff ranges", async () => {
|
||||
try {
|
||||
const branches = await getDiffInformedAnalysisBranches(
|
||||
codeql,
|
||||
features,
|
||||
logger,
|
||||
);
|
||||
if (!branches) {
|
||||
return;
|
||||
}
|
||||
const ranges = await getPullRequestEditedDiffRanges(branches, logger);
|
||||
if (ranges === undefined) {
|
||||
return;
|
||||
}
|
||||
writeDiffRangesJsonFile(logger, ranges);
|
||||
const distinctFiles = new Set(ranges.map((r) => r.path)).size;
|
||||
logger.info(
|
||||
`Persisted ${ranges.length} diff range(s) across ${distinctFiles} file(s).`,
|
||||
);
|
||||
} catch (e) {
|
||||
logger.warning(
|
||||
`Failed to compute and persist PR diff ranges: ${getErrorMessage(e)}`,
|
||||
);
|
||||
}
|
||||
});
|
||||
}
|
||||
async function recordZstdAvailability(
|
||||
config: configUtils.Config,
|
||||
zstdAvailability: ZstdAvailability,
|
||||
@@ -880,7 +838,7 @@ async function recordZstdAvailability(
|
||||
);
|
||||
}
|
||||
|
||||
async function runWrapper() {
|
||||
export async function runWrapper() {
|
||||
const startedAt = new Date();
|
||||
const logger = getActionsLogger();
|
||||
try {
|
||||
@@ -896,5 +854,3 @@ async function runWrapper() {
|
||||
}
|
||||
await checkForTimeout();
|
||||
}
|
||||
|
||||
void runWrapper();
|
||||
|
||||
+16
-35
@@ -80,65 +80,46 @@ const testDownloadOverlayBaseDatabaseFromCache = makeMacro({
|
||||
await fs.promises.writeFile(baseDatabaseOidsFile, JSON.stringify({}));
|
||||
}
|
||||
|
||||
const stubs: sinon.SinonStub[] = [];
|
||||
sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
|
||||
|
||||
const getAutomationIDStub = sinon
|
||||
.stub(apiClient, "getAutomationID")
|
||||
.resolves("test-automation-id/");
|
||||
stubs.push(getAutomationIDStub);
|
||||
|
||||
const isInTestModeStub = sinon
|
||||
.stub(utils, "isInTestMode")
|
||||
.returns(testCase.isInTestMode);
|
||||
stubs.push(isInTestModeStub);
|
||||
sinon.stub(utils, "isInTestMode").returns(testCase.isInTestMode);
|
||||
|
||||
if (testCase.restoreCacheResult instanceof Error) {
|
||||
const restoreCacheStub = sinon
|
||||
sinon
|
||||
.stub(actionsCache, "restoreCache")
|
||||
.rejects(testCase.restoreCacheResult);
|
||||
stubs.push(restoreCacheStub);
|
||||
} else {
|
||||
const restoreCacheStub = sinon
|
||||
sinon
|
||||
.stub(actionsCache, "restoreCache")
|
||||
.resolves(testCase.restoreCacheResult);
|
||||
stubs.push(restoreCacheStub);
|
||||
}
|
||||
|
||||
const tryGetFolderBytesStub = sinon
|
||||
sinon
|
||||
.stub(utils, "tryGetFolderBytes")
|
||||
.resolves(testCase.tryGetFolderBytesSucceeds ? 1024 * 1024 : undefined);
|
||||
stubs.push(tryGetFolderBytesStub);
|
||||
|
||||
const codeql = mockCodeQLVersion(testCase.codeQLVersion);
|
||||
|
||||
if (testCase.resolveDatabaseOutput instanceof Error) {
|
||||
const resolveDatabaseStub = sinon
|
||||
sinon
|
||||
.stub(codeql, "resolveDatabase")
|
||||
.rejects(testCase.resolveDatabaseOutput);
|
||||
stubs.push(resolveDatabaseStub);
|
||||
} else {
|
||||
const resolveDatabaseStub = sinon
|
||||
sinon
|
||||
.stub(codeql, "resolveDatabase")
|
||||
.resolves(testCase.resolveDatabaseOutput);
|
||||
stubs.push(resolveDatabaseStub);
|
||||
}
|
||||
|
||||
try {
|
||||
const result = await downloadOverlayBaseDatabaseFromCache(
|
||||
codeql,
|
||||
config,
|
||||
logger,
|
||||
);
|
||||
const result = await downloadOverlayBaseDatabaseFromCache(
|
||||
codeql,
|
||||
config,
|
||||
logger,
|
||||
);
|
||||
|
||||
if (expectDownloadSuccess) {
|
||||
t.truthy(result);
|
||||
} else {
|
||||
t.is(result, undefined);
|
||||
}
|
||||
} finally {
|
||||
for (const stub of stubs) {
|
||||
stub.restore();
|
||||
}
|
||||
if (expectDownloadSuccess) {
|
||||
t.truthy(result);
|
||||
} else {
|
||||
t.is(result, undefined);
|
||||
}
|
||||
});
|
||||
},
|
||||
|
||||
@@ -39,6 +39,15 @@ export enum OverlayDisabledReason {
|
||||
NotPullRequestOrDefaultBranch = "not-pull-request-or-default-branch",
|
||||
/** The top-level overlay analysis feature flag is not enabled. */
|
||||
OverallFeatureNotEnabled = "overall-feature-not-enabled",
|
||||
/**
|
||||
* Overlay analysis was selected for a pull request, but diff-informed
|
||||
* analysis was not enabled for the run (for example, because the
|
||||
* `DiffInformedQueries` feature flag is off, the GHES version is too old,
|
||||
* or the PR diff ranges could not be computed). Overlay analysis has only
|
||||
* been validated in combination with diff-informed analysis, so we fall
|
||||
* back to a non-overlay analysis in this case.
|
||||
*/
|
||||
DiffInformedAnalysisNotEnabled = "diff-informed-analysis-not-enabled",
|
||||
/** Overlay analysis was skipped because it previously failed with similar hardware resources. */
|
||||
SkippedDueToCachedStatus = "skipped-due-to-cached-status",
|
||||
/** Disk usage could not be determined during the overlay status check. */
|
||||
|
||||
+16
-56
@@ -50,31 +50,21 @@ test.serial(
|
||||
"modified.js": "ddd444", // Changed OID
|
||||
"added.js": "eee555", // New file
|
||||
};
|
||||
const getFileOidsStubForOverlay = sinon
|
||||
.stub(gitUtils, "getFileOidsUnderPath")
|
||||
.resolves(currentOids);
|
||||
sinon.stub(gitUtils, "getFileOidsUnderPath").resolves(currentOids);
|
||||
|
||||
// Write the overlay changes file, which uses the mocked overlay OIDs
|
||||
// and the base database OIDs file
|
||||
const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
|
||||
const getTempDirStub = sinon
|
||||
.stub(actionsUtil, "getTemporaryDirectory")
|
||||
.returns(tempDir);
|
||||
const getDiffRangesStub = sinon
|
||||
sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
|
||||
sinon
|
||||
.stub(actionsUtil, "getDiffRangesJsonFilePath")
|
||||
.returns(diffRangeFilePath);
|
||||
const getGitRootStub = sinon
|
||||
.stub(gitUtils, "getGitRoot")
|
||||
.resolves(sourceRoot);
|
||||
sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
|
||||
const changesFilePath = await writeOverlayChangesFile(
|
||||
config,
|
||||
sourceRoot,
|
||||
logger,
|
||||
);
|
||||
getFileOidsStubForOverlay.restore();
|
||||
getTempDirStub.restore();
|
||||
getDiffRangesStub.restore();
|
||||
getGitRootStub.restore();
|
||||
|
||||
const fileContent = await fs.promises.readFile(changesFilePath, "utf-8");
|
||||
const parsedContent = JSON.parse(fileContent) as { changes: string[] };
|
||||
@@ -128,20 +118,14 @@ test.serial(
|
||||
"modified.js": "ddd444", // Changed OID
|
||||
"reverted.js": "eee555", // Same OID as base -- not detected by OID comparison
|
||||
};
|
||||
const getFileOidsStubForOverlay = sinon
|
||||
.stub(gitUtils, "getFileOidsUnderPath")
|
||||
.resolves(currentOids);
|
||||
sinon.stub(gitUtils, "getFileOidsUnderPath").resolves(currentOids);
|
||||
|
||||
const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
|
||||
const getTempDirStub = sinon
|
||||
.stub(actionsUtil, "getTemporaryDirectory")
|
||||
.returns(tempDir);
|
||||
const getDiffRangesStub = sinon
|
||||
sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
|
||||
sinon
|
||||
.stub(actionsUtil, "getDiffRangesJsonFilePath")
|
||||
.returns(diffRangeFilePath);
|
||||
const getGitRootStub = sinon
|
||||
.stub(gitUtils, "getGitRoot")
|
||||
.resolves(sourceRoot);
|
||||
sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
|
||||
|
||||
// Write a pr-diff-range.json file with diff ranges including
|
||||
// "reverted.js" (unchanged OIDs) and "modified.js" (already in OID changes)
|
||||
@@ -159,10 +143,6 @@ test.serial(
|
||||
sourceRoot,
|
||||
logger,
|
||||
);
|
||||
getFileOidsStubForOverlay.restore();
|
||||
getTempDirStub.restore();
|
||||
getDiffRangesStub.restore();
|
||||
getGitRootStub.restore();
|
||||
|
||||
const fileContent = await fs.promises.readFile(changesFilePath, "utf-8");
|
||||
const parsedContent = JSON.parse(fileContent) as { changes: string[] };
|
||||
@@ -208,20 +188,14 @@ test.serial(
|
||||
"unchanged.js": "aaa111",
|
||||
"modified.js": "ddd444",
|
||||
};
|
||||
const getFileOidsStubForOverlay = sinon
|
||||
.stub(gitUtils, "getFileOidsUnderPath")
|
||||
.resolves(currentOids);
|
||||
sinon.stub(gitUtils, "getFileOidsUnderPath").resolves(currentOids);
|
||||
|
||||
const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
|
||||
const getTempDirStub = sinon
|
||||
.stub(actionsUtil, "getTemporaryDirectory")
|
||||
.returns(tempDir);
|
||||
const getDiffRangesStub = sinon
|
||||
sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
|
||||
sinon
|
||||
.stub(actionsUtil, "getDiffRangesJsonFilePath")
|
||||
.returns(diffRangeFilePath);
|
||||
const getGitRootStub = sinon
|
||||
.stub(gitUtils, "getGitRoot")
|
||||
.resolves(sourceRoot);
|
||||
sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
|
||||
|
||||
// No pr-diff-range.json file exists - should work the same as before
|
||||
const changesFilePath = await writeOverlayChangesFile(
|
||||
@@ -229,10 +203,6 @@ test.serial(
|
||||
sourceRoot,
|
||||
logger,
|
||||
);
|
||||
getFileOidsStubForOverlay.restore();
|
||||
getTempDirStub.restore();
|
||||
getDiffRangesStub.restore();
|
||||
getGitRootStub.restore();
|
||||
|
||||
const fileContent = await fs.promises.readFile(changesFilePath, "utf-8");
|
||||
const parsedContent = JSON.parse(fileContent) as { changes: string[] };
|
||||
@@ -281,21 +251,15 @@ test.serial(
|
||||
"app.js": "aaa111",
|
||||
"lib/util.js": "bbb222",
|
||||
};
|
||||
const getFileOidsStubForOverlay = sinon
|
||||
.stub(gitUtils, "getFileOidsUnderPath")
|
||||
.resolves(currentOids);
|
||||
sinon.stub(gitUtils, "getFileOidsUnderPath").resolves(currentOids);
|
||||
|
||||
const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
|
||||
const getTempDirStub = sinon
|
||||
.stub(actionsUtil, "getTemporaryDirectory")
|
||||
.returns(tempDir);
|
||||
const getDiffRangesStub = sinon
|
||||
sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
|
||||
sinon
|
||||
.stub(actionsUtil, "getDiffRangesJsonFilePath")
|
||||
.returns(diffRangeFilePath);
|
||||
// getGitRoot returns the repo root (parent of sourceRoot)
|
||||
const getGitRootStub = sinon
|
||||
.stub(gitUtils, "getGitRoot")
|
||||
.resolves(repoRoot);
|
||||
sinon.stub(gitUtils, "getGitRoot").resolves(repoRoot);
|
||||
|
||||
// Diff ranges use repo-root-relative paths (as returned by the GitHub compare API)
|
||||
await fs.promises.writeFile(
|
||||
@@ -312,10 +276,6 @@ test.serial(
|
||||
sourceRoot,
|
||||
logger,
|
||||
);
|
||||
getFileOidsStubForOverlay.restore();
|
||||
getTempDirStub.restore();
|
||||
getDiffRangesStub.restore();
|
||||
getGitRootStub.restore();
|
||||
|
||||
const fileContent = await fs.promises.readFile(changesFilePath, "utf-8");
|
||||
const parsedContent = JSON.parse(fileContent) as { changes: string[] };
|
||||
|
||||
@@ -117,7 +117,7 @@ async function run(startedAt: Date) {
|
||||
}
|
||||
}
|
||||
|
||||
async function runWrapper() {
|
||||
export async function runWrapper() {
|
||||
const startedAt = new Date();
|
||||
const logger = getActionsLogger();
|
||||
try {
|
||||
@@ -137,5 +137,3 @@ async function runWrapper() {
|
||||
}
|
||||
await checkForTimeout();
|
||||
}
|
||||
|
||||
void runWrapper();
|
||||
|
||||
@@ -196,7 +196,7 @@ async function run(startedAt: Date): Promise<void> {
|
||||
}
|
||||
|
||||
/** Run the action and catch any unhandled errors. */
|
||||
async function runWrapper(): Promise<void> {
|
||||
export async function runWrapper(): Promise<void> {
|
||||
const startedAt = new Date();
|
||||
const logger = getActionsLogger();
|
||||
try {
|
||||
@@ -212,5 +212,3 @@ async function runWrapper(): Promise<void> {
|
||||
}
|
||||
await checkForTimeout();
|
||||
}
|
||||
|
||||
void runWrapper();
|
||||
|
||||
@@ -12,7 +12,7 @@ import { uploadArtifacts } from "./debug-artifacts";
|
||||
import { getActionsLogger } from "./logging";
|
||||
import { checkGitHubVersionInRange, getErrorMessage } from "./util";
|
||||
|
||||
async function runWrapper() {
|
||||
export async function runWrapper() {
|
||||
// To capture errors appropriately, keep as much code within the try-catch as
|
||||
// possible, and only use safe functions outside.
|
||||
|
||||
@@ -62,5 +62,3 @@ async function runWrapper() {
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
void runWrapper();
|
||||
|
||||
@@ -128,7 +128,7 @@ async function run(startedAt: Date) {
|
||||
}
|
||||
}
|
||||
|
||||
async function runWrapper() {
|
||||
export async function runWrapper() {
|
||||
const startedAt = new Date();
|
||||
const logger = getActionsLogger();
|
||||
|
||||
@@ -204,5 +204,3 @@ async function startProxy(
|
||||
|
||||
return { host, port, cert: config.ca.cert, registries: registry_urls };
|
||||
}
|
||||
|
||||
void runWrapper();
|
||||
|
||||
Binary file not shown.
@@ -6,9 +6,13 @@ import { ToolsFeature, isSupportedToolsFeature } from "./tools-features";
|
||||
test("isSupportedToolsFeature", async (t) => {
|
||||
const versionInfo = makeVersionInfo("1.0.0");
|
||||
|
||||
t.false(isSupportedToolsFeature(versionInfo, ToolsFeature.ForceOverwrite));
|
||||
t.false(
|
||||
isSupportedToolsFeature(versionInfo, ToolsFeature.BundleSupportsOverlay),
|
||||
);
|
||||
|
||||
versionInfo.features = { forceOverwrite: true };
|
||||
versionInfo.features = { bundleSupportsOverlay: true };
|
||||
|
||||
t.true(isSupportedToolsFeature(versionInfo, ToolsFeature.ForceOverwrite));
|
||||
t.true(
|
||||
isSupportedToolsFeature(versionInfo, ToolsFeature.BundleSupportsOverlay),
|
||||
);
|
||||
});
|
||||
|
||||
@@ -6,8 +6,6 @@ export enum ToolsFeature {
|
||||
BuiltinExtractorsSpecifyDefaultQueries = "builtinExtractorsSpecifyDefaultQueries",
|
||||
BundleSupportsIncludeOption = "bundleSupportsIncludeOption",
|
||||
BundleSupportsOverlay = "bundleSupportsOverlay",
|
||||
DatabaseInterpretResultsSupportsSarifRunProperty = "databaseInterpretResultsSupportsSarifRunProperty",
|
||||
ForceOverwrite = "forceOverwrite",
|
||||
IndirectTracingSupportsStaticBinaries = "indirectTracingSupportsStaticBinaries",
|
||||
SuppressesMissingFileBaselineWarning = "suppressesMissingFileBaselineWarning",
|
||||
}
|
||||
|
||||
@@ -12,7 +12,7 @@ import { EnvVar } from "./environment";
|
||||
import { getActionsLogger, withGroup } from "./logging";
|
||||
import { checkGitHubVersionInRange, getErrorMessage } from "./util";
|
||||
|
||||
async function runWrapper() {
|
||||
export async function runWrapper() {
|
||||
// To capture errors appropriately, keep as much code within the try-catch as
|
||||
// possible, and only use safe functions outside.
|
||||
|
||||
@@ -48,5 +48,3 @@ async function runWrapper() {
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
void runWrapper();
|
||||
|
||||
@@ -165,7 +165,7 @@ async function run(startedAt: Date) {
|
||||
}
|
||||
}
|
||||
|
||||
async function runWrapper() {
|
||||
export async function runWrapper() {
|
||||
const startedAt = new Date();
|
||||
const logger = getActionsLogger();
|
||||
try {
|
||||
@@ -182,5 +182,3 @@ async function runWrapper() {
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
void runWrapper();
|
||||
|
||||
+1
-4
@@ -418,9 +418,7 @@ for (const [
|
||||
`checkActionVersion ${reportErrorDescription} for ${versionsDescription}`,
|
||||
async (t) => {
|
||||
const warningSpy = sinon.spy(core, "warning");
|
||||
const versionStub = sinon
|
||||
.stub(api, "getGitHubVersion")
|
||||
.resolves(githubVersion);
|
||||
sinon.stub(api, "getGitHubVersion").resolves(githubVersion);
|
||||
|
||||
// call checkActionVersion twice and assert below that warning is reported only once
|
||||
util.checkActionVersion(version, await api.getGitHubVersion());
|
||||
@@ -437,7 +435,6 @@ for (const [
|
||||
} else {
|
||||
t.false(warningSpy.called);
|
||||
}
|
||||
versionStub.restore();
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
@@ -30,5 +30,5 @@ outputs:
|
||||
description: A stringified JSON array of objects containing the types and URLs of the configured registries.
|
||||
runs:
|
||||
using: node24
|
||||
main: "../lib/start-proxy-action.js"
|
||||
post: "../lib/start-proxy-action-post.js"
|
||||
main: "../lib/start-proxy-entry.js"
|
||||
post: "../lib/start-proxy-post-entry.js"
|
||||
|
||||
@@ -42,5 +42,5 @@ outputs:
|
||||
{ "code-scanning": "some-id", "code-quality": "some-other-id" }
|
||||
runs:
|
||||
using: node24
|
||||
main: '../lib/upload-sarif-action.js'
|
||||
post: '../lib/upload-sarif-action-post.js'
|
||||
main: '../lib/upload-sarif-entry.js'
|
||||
post: '../lib/upload-sarif-post-entry.js'
|
||||
|
||||
Reference in New Issue
Block a user