github/codeql-action
0
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-05-07 14:20:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstream/main' into failed-database-diagnostic

Browse Source
This commit is contained in:
Angela P Wen
2023-03-14 17:55:11 -07:00
parent ed73efb5ca 433fe88bf3
commit c193f610a2
48 changed files with 126 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/__analyze-ref-input.yml
Generated
+1
View File
@@ -88,6 +88,7 @@ jobs:
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
ref: refs/heads/main
sha: 5e235361806c361d4d3f8859e3c897658025a9a2
env:
.github/workflows/__autobuild-action.yml
Generated
+2
View File
@@ -56,6 +56,8 @@ jobs:
CORECLR_PROFILER: ''
CORECLR_PROFILER_PATH_64: ''
- uses: ./../action/analyze
with:
upload-database: false
- name: Check database
shell: bash
run: |
.github/workflows/__go-custom-queries.yml
Generated
+2
View File
@@ -86,6 +86,8 @@ jobs:
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
CODEQL_ACTION_TEST_MODE: true
.github/workflows/__go-tracing-autobuilder.yml
Generated
+2
View File
@@ -71,6 +71,8 @@ jobs:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/autobuild
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
if [[ "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" != true ]]; then
.github/workflows/__go-tracing-custom-build-steps.yml
Generated
+2
View File
@@ -73,6 +73,8 @@ jobs:
shell: bash
run: go build main.go
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
# Once we start running Bash 4.2 in all environments, we can replace the
.github/workflows/__go-tracing-legacy-workflow.yml
Generated
+2
View File
@@ -70,6 +70,8 @@ jobs:
languages: go
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
cd "$RUNNER_TEMP/codeql_databases"
.github/workflows/__javascript-source-root.yml
Generated
+1
View File
@@ -54,6 +54,7 @@ jobs:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
upload-database: false
skip-queries: true
upload: false
- name: Assert database exists
.github/workflows/__multi-language-autodetect.yml
Generated
+2
View File
@@ -81,6 +81,8 @@ jobs:
- uses: ./../action/analyze
id: analysis
with:
upload-database: false
- name: Check language autodetect for all languages excluding Ruby, Swift
shell: bash
.github/workflows/__packaging-codescanning-config-inputs-js.yml
Generated
+1
View File
@@ -66,6 +66,7 @@ jobs:
- uses: ./../action/analyze
with:
output: ${{ runner.temp }}/results
upload-database: false
- name: Check results
uses: ./../action/.github/check-sarif
.github/workflows/__packaging-config-inputs-js.yml
Generated
+1
View File
@@ -66,6 +66,7 @@ jobs:
- uses: ./../action/analyze
with:
output: ${{ runner.temp }}/results
upload-database: false
- name: Check results
uses: ./../action/.github/check-sarif
.github/workflows/__packaging-config-js.yml
Generated
+1
View File
@@ -65,6 +65,7 @@ jobs:
- uses: ./../action/analyze
with:
output: ${{ runner.temp }}/results
upload-database: false
- name: Check results
uses: ./../action/.github/check-sarif
.github/workflows/__ruby.yml
Generated
+2
View File
@@ -54,6 +54,8 @@ jobs:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
id: analysis
with:
upload-database: false
- name: Check database
shell: bash
run: |
.github/workflows/__split-workflow.yml
Generated
+1
View File
@@ -61,6 +61,7 @@ jobs:
with:
skip-queries: true
output: ${{ runner.temp }}/results
upload-database: false
- name: Assert No Results
shell: bash
.github/workflows/__swift-autobuild.yml
Generated
+2
View File
@@ -57,6 +57,8 @@ jobs:
timeout-minutes: 10
- uses: ./../action/analyze
id: analysis
with:
upload-database: false
- name: Check database
shell: bash
run: |
.github/workflows/__swift-custom-build.yml
Generated
+2
View File
@@ -64,6 +64,8 @@ jobs:
run: ./build.sh
- uses: ./../action/analyze
id: analysis
with:
upload-database: false
- name: Check database
shell: bash
run: |
.github/workflows/__test-autobuild-working-dir.yml
Generated
+2
View File
@@ -53,6 +53,8 @@ jobs:
with:
working-directory: autobuild-dir
- uses: ./../action/analyze
with:
upload-database: false
- name: Check database
shell: bash
run: |
.github/workflows/__test-local-codeql.yml
Generated
+2
View File
@@ -51,5 +51,7 @@ jobs:
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
env:
CODEQL_ACTION_TEST_MODE: true
.github/workflows/__test-proxy.yml
Generated
+2
View File
@@ -43,6 +43,8 @@ jobs:
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
upload-database: false
env:
https_proxy: http://squid-proxy:3128
CODEQL_ACTION_TEST_MODE: true
.github/workflows/__unset-environment.yml
Generated
+2
View File
@@ -65,6 +65,8 @@ jobs:
./build.sh
- uses: ./../action/analyze
id: analysis
with:
upload-database: false
- shell: bash
run: |
CPP_DB="${{ fromJson(steps.analysis.outputs.db-locations).cpp }}"
.github/workflows/__upload-ref-sha-input.yml
Generated
+1
View File
@@ -88,6 +88,7 @@ jobs:
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
ref: refs/heads/main
sha: 5e235361806c361d4d3f8859e3c897658025a9a2
upload: false
.github/workflows/__with-checkout-path.yml
Generated
+1
View File
@@ -104,6 +104,7 @@ jobs:
ref: v1.1.0
sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
upload: false
upload-database: false
- uses: ./../action/upload-sarif
with:
lib/codeql.js
Generated
+1 -6
View File
@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
return result;
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.getExtraOptions = exports.getCodeQLForCmd = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.setupCodeQL = exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = exports.CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG = exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = exports.CODEQL_VERSION_TRACING_GLIBC_2_34 = exports.CODEQL_VERSION_NEW_TRACING = exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = exports.CommandInvocationError = void 0;
exports.getExtraOptions = exports.getCodeQLForCmd = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.setupCodeQL = exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = exports.CODEQL_VERSION_TRACING_GLIBC_2_34 = exports.CODEQL_VERSION_NEW_TRACING = exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = exports.CommandInvocationError = void 0;
const fs = __importStar(require("fs"));
const path = __importStar(require("path"));
const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
@@ -100,11 +100,6 @@ exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = "2.10.3";
* Versions 2.11.1+ of the CodeQL Bundle include a `security-experimental` built-in query suite for each language.
*/
exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = "2.12.1";
/**
* Versions 2.12.3+ of the CodeQL CLI support exporting information in the code scanning
* configuration file to SARIF.
*/
exports.CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG = "2.12.3";
/**
* Versions 2.12.4+ of the CodeQL CLI support the `--qlconfig-file` flag in calls to `database init`.
*/
lib/codeql.js.map
+1 -1
View File
File diff suppressed because one or more lines are too long
lib/feature-flags.js
Generated
+18 -4
View File
@@ -28,7 +28,6 @@ const fs = __importStar(require("fs"));
const path = __importStar(require("path"));
const semver = __importStar(require("semver"));
const api_client_1 = require("./api-client");
const codeql_1 = require("./codeql");
const defaults = __importStar(require("./defaults.json"));
const util = __importStar(require("./util"));
const DEFAULT_VERSION_FEATURE_FLAG_PREFIX = "default_codeql_version_";
@@ -55,7 +54,7 @@ exports.featureConfig = {
},
[Feature.ExportCodeScanningConfigEnabled]: {
envVar: "CODEQL_ACTION_EXPORT_CODE_SCANNING_CONFIG",
minimumVersion: codeql_1.CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG,
minimumVersion: "2.12.3",
defaultValue: false,
},
[Feature.ExportDiagnosticsEnabled]: {
@@ -82,6 +81,7 @@ exports.FEATURE_FLAGS_FILE_NAME = "cached-feature-flags.json";
*/
class Features {
constructor(gitHubVersion, repositoryNwo, tempDir, logger) {
this.logger = logger;
this.gitHubFeatureFlags = new GitHubFeatureFlags(gitHubVersion, repositoryNwo, path.join(tempDir, exports.FEATURE_FLAGS_FILE_NAME), logger);
}
async getDefaultCliVersion(variant) {
@@ -106,22 +106,36 @@ class Features {
const envVar = (process.env[exports.featureConfig[feature].envVar] || "").toLocaleLowerCase();
// Do not use this feature if user explicitly disables it via an environment variable.
if (envVar === "false") {
this.logger.debug(`Feature ${feature} is disabled via the environment variable ${exports.featureConfig[feature].envVar}.`);
return false;
}
// Never use this feature if the CLI version explicitly can't support it.
const minimumVersion = exports.featureConfig[feature].minimumVersion;
if (codeql && minimumVersion) {
if (!(await util.codeQlVersionAbove(codeql, minimumVersion))) {
this.logger.debug(`Feature ${feature} is disabled because the CodeQL CLI version is older than the minimum ` +
`version ${minimumVersion}.`);
return false;
}
else {
this.logger.debug(`CodeQL CLI version ${await codeql.getVersion()} is newer than the minimum ` +
`version ${minimumVersion} for feature ${feature}.`);
}
}
// Use this feature if user explicitly enables it via an environment variable.
if (envVar === "true") {
this.logger.debug(`Feature ${feature} is enabled via the environment variable ${exports.featureConfig[feature].envVar}.`);
return true;
}
// Ask the GitHub API if the feature is enabled.
return ((await this.gitHubFeatureFlags.getValue(feature)) ??
exports.featureConfig[feature].defaultValue);
const apiValue = await this.gitHubFeatureFlags.getValue(feature);
if (apiValue !== undefined) {
this.logger.debug(`Feature ${feature} is ${apiValue ? "enabled" : "disabled"} via the GitHub API.`);
return apiValue;
}
const defaultValue = exports.featureConfig[feature].defaultValue;
this.logger.debug(`Feature ${feature} is ${defaultValue ? "enabled" : "disabled"} due to its default value.`);
return defaultValue;
}
}
exports.Features = Features;
lib/feature-flags.js.map
+1 -1
View File
File diff suppressed because one or more lines are too long
pr-checks/checks/analyze-ref-input.yml
+1
View File
@@ -11,5 +11,6 @@ steps:
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
ref: 'refs/heads/main'
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
pr-checks/checks/autobuild-action.yml
+2
View File
@@ -16,6 +16,8 @@ steps:
CORECLR_PROFILER: ""
CORECLR_PROFILER_PATH_64: ""
- uses: ./../action/analyze
with:
upload-database: false
- name: Check database
shell: bash
run: |
pr-checks/checks/go-custom-queries.yml
+3 -1
View File
@@ -1,6 +1,6 @@
name: "Go: Custom queries"
description: "Checks that Go works in conjunction with a config file specifying custom queries"
env:
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
steps:
- uses: ./../action/init
@@ -12,3 +12,5 @@ steps:
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
pr-checks/checks/go-tracing-autobuilder.yml
+2
View File
@@ -10,6 +10,8 @@ steps:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/autobuild
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
if [[ "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" != true ]]; then
pr-checks/checks/go-tracing-custom-build-steps.yml
+2
View File
@@ -10,6 +10,8 @@ steps:
shell: bash
run: go build main.go
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
# Once we start running Bash 4.2 in all environments, we can replace the
pr-checks/checks/go-tracing-legacy-workflow.yml
+2
View File
@@ -9,6 +9,8 @@ steps:
languages: go
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
cd "$RUNNER_TEMP/codeql_databases"
pr-checks/checks/javascript-source-root.yml
+1
View File
@@ -15,6 +15,7 @@ steps:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
upload-database: false
skip-queries: true
upload: false
- name: Assert database exists
pr-checks/checks/multi-language-autodetect.yml
+3 -1
View File
@@ -9,7 +9,7 @@ steps:
with:
db-location: "${{ runner.temp }}/customDbLocation"
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/.github/setup-swift
with:
codeql-path: ${{steps.init.outputs.codeql-path}}
@@ -20,6 +20,8 @@ steps:
- uses: ./../action/analyze
id: analysis
with:
upload-database: false
- name: Check language autodetect for all languages excluding Ruby, Swift
shell: bash
pr-checks/checks/packaging-codescanning-config-inputs-js.yml
+1
View File
@@ -18,6 +18,7 @@ steps:
- uses: ./../action/analyze
with:
output: "${{ runner.temp }}/results"
upload-database: false
- name: Check results
uses: ./../action/.github/check-sarif
pr-checks/checks/packaging-config-inputs-js.yml
+1
View File
@@ -14,6 +14,7 @@ steps:
- uses: ./../action/analyze
with:
output: "${{ runner.temp }}/results"
upload-database: false
- name: Check results
uses: ./../action/.github/check-sarif
pr-checks/checks/packaging-config-js.yml
+1
View File
@@ -13,6 +13,7 @@ steps:
- uses: ./../action/analyze
with:
output: "${{ runner.temp }}/results"
upload-database: false
- name: Check results
uses: ./../action/.github/check-sarif
pr-checks/checks/ruby.yml
+2
View File
@@ -9,6 +9,8 @@ steps:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
id: analysis
with:
upload-database: false
- name: Check database
shell: bash
run: |
pr-checks/checks/split-workflow.yml
+1
View File
@@ -16,6 +16,7 @@ steps:
with:
skip-queries: true
output: "${{ runner.temp }}/results"
upload-database: false
- name: Assert No Results
shell: bash
pr-checks/checks/swift-autobuild.yml
+2
View File
@@ -21,6 +21,8 @@ steps:
timeout-minutes: 10
- uses: ./../action/analyze
id: analysis
with:
upload-database: false
- name: Check database
shell: bash
run: |
pr-checks/checks/swift-custom-build.yml
+2
View File
@@ -22,6 +22,8 @@ steps:
run: ./build.sh
- uses: ./../action/analyze
id: analysis
with:
upload-database: false
- name: Check database
shell: bash
run: |
pr-checks/checks/test-autobuild-working-dir.yml
+2
View File
@@ -18,6 +18,8 @@ steps:
with:
working-directory: autobuild-dir
- uses: ./../action/analyze
with:
upload-database: false
- name: Check database
shell: bash
run: |
pr-checks/checks/test-local-codeql.yml
+2
View File
@@ -16,3 +16,5 @@ steps:
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
pr-checks/checks/test-proxy.yml
+2
View File
@@ -18,3 +18,5 @@ steps:
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
upload-database: false
pr-checks/checks/unset-environment.yml
+2
View File
@@ -13,6 +13,8 @@ steps:
run: env -i CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN=true PATH="$PATH" HOME="$HOME" ./build.sh
- uses: ./../action/analyze
id: analysis
with:
upload-database: false
- shell: bash
run: |
CPP_DB="${{ fromJson(steps.analysis.outputs.db-locations).cpp }}"
pr-checks/checks/upload-ref-sha-input.yml
+1
View File
@@ -11,6 +11,7 @@ steps:
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
ref: 'refs/heads/main'
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
upload: false
pr-checks/checks/with-checkout-path.yml
+1
View File
@@ -30,6 +30,7 @@ steps:
ref: v1.1.0
sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
upload: false
upload-database: false
- uses: ./../action/upload-sarif
with:
src/codeql.ts
-6
View File
@@ -307,12 +307,6 @@ export const CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = "2.10.3";
*/
export const CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = "2.12.1";
/**
* Versions 2.12.3+ of the CodeQL CLI support exporting information in the code scanning
* configuration file to SARIF.
*/
export const CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG = "2.12.3";
/**
* Versions 2.12.4+ of the CodeQL CLI support the `--qlconfig-file` flag in calls to `database init`.
*/
src/feature-flags.ts
+35 -6
View File
@@ -4,7 +4,7 @@ import * as path from "path";
import * as semver from "semver";
import { getApiClient } from "./api-client";
import { CodeQL, CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG } from "./codeql";
import { CodeQL } from "./codeql";
import * as defaults from "./defaults.json";
import { Logger } from "./logging";
import { RepositoryNwo } from "./repository";
@@ -58,7 +58,7 @@ export const featureConfig: Record<
},
[Feature.ExportCodeScanningConfigEnabled]: {
envVar: "CODEQL_ACTION_EXPORT_CODE_SCANNING_CONFIG",
minimumVersion: CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG,
minimumVersion: "2.12.3",
defaultValue: false,
},
[Feature.ExportDiagnosticsEnabled]: {
@@ -101,7 +101,7 @@ export class Features implements FeatureEnablement {
gitHubVersion: util.GitHubVersion,
repositoryNwo: RepositoryNwo,
tempDir: string,
logger: Logger
private readonly logger: Logger
) {
this.gitHubFeatureFlags = new GitHubFeatureFlags(
gitHubVersion,
@@ -142,6 +142,9 @@ export class Features implements FeatureEnablement {
// Do not use this feature if user explicitly disables it via an environment variable.
if (envVar === "false") {
this.logger.debug(
`Feature ${feature} is disabled via the environment variable ${featureConfig[feature].envVar}.`
);
return false;
}
@@ -149,19 +152,45 @@ export class Features implements FeatureEnablement {
const minimumVersion = featureConfig[feature].minimumVersion;
if (codeql && minimumVersion) {
if (!(await util.codeQlVersionAbove(codeql, minimumVersion))) {
this.logger.debug(
`Feature ${feature} is disabled because the CodeQL CLI version is older than the minimum ` +
`version ${minimumVersion}.`
);
return false;
} else {
this.logger.debug(
`CodeQL CLI version ${await codeql.getVersion()} is newer than the minimum ` +
`version ${minimumVersion} for feature ${feature}.`
);
}
}
// Use this feature if user explicitly enables it via an environment variable.
if (envVar === "true") {
this.logger.debug(
`Feature ${feature} is enabled via the environment variable ${featureConfig[feature].envVar}.`
);
return true;
}
// Ask the GitHub API if the feature is enabled.
return (
(await this.gitHubFeatureFlags.getValue(feature)) ??
featureConfig[feature].defaultValue
const apiValue = await this.gitHubFeatureFlags.getValue(feature);
if (apiValue !== undefined) {
this.logger.debug(
`Feature ${feature} is ${
apiValue ? "enabled" : "disabled"
} via the GitHub API.`
);
return apiValue;
}
const defaultValue = featureConfig[feature].defaultValue;
this.logger.debug(
`Feature ${feature} is ${
defaultValue ? "enabled" : "disabled"
} due to its default value.`
);
return defaultValue;
}
}