Ignore pre-release parts when comparing GHES versions

lib/upload-lib.js

@@ -55,7 +55,6 @@ const zlib_1 = __importDefault(require("zlib"));
 const core = __importStar(require("@actions/core"));
 const file_url_1 = __importDefault(require("file-url"));
 const jsonschema = __importStar(require("jsonschema"));
-const semver = __importStar(require("semver"));
 const actionsUtil = __importStar(require("./actions-util"));
 const actions_util_1 = require("./actions-util");
 const api = __importStar(require("./api-client"));
@@ -138,7 +137,7 @@ function areAllRunsUnique(sarifObjects) {
 async function shouldShowCombineSarifFilesDeprecationWarning(sarifObjects, githubVersion) {
     // Do not show this warning on GHES versions before 3.14.0
     if (githubVersion.type === util_1.GitHubVariant.GHES &&
-        semver.lt((0, util_1.parseGhesVersion)(githubVersion.version), "3.14.0")) {
+        (0, util_1.satisfiesGHESVersion)(githubVersion.version, "<3.14", true)) {
         return false;
     }
     // Only give a deprecation warning when not all runs are unique and
@@ -158,7 +157,7 @@ async function throwIfCombineSarifFilesDisabled(sarifObjects, features, githubVe
 async function shouldDisableCombineSarifFiles(sarifObjects, features, githubVersion) {
     if (githubVersion.type === util_1.GitHubVariant.GHES) {
         // Never block on GHES versions before 3.18.
-        if (semver.lt((0, util_1.parseGhesVersion)(githubVersion.version), "3.18.0-0")) {
+        if ((0, util_1.satisfiesGHESVersion)(githubVersion.version, "<3.18", true)) {
             return false;
         }
     }

lib/upload-lib.test.js

@@ -305,6 +305,12 @@ ava_1.default.beforeEach(() => {
         message: /The CodeQL Action does not support uploading multiple SARIF runs with the same category/,
     });
 });
+(0, ava_1.default)("throwIfCombineSarifFilesDisabled with an invalid GHES version", async (t) => {
+    await t.notThrowsAsync(uploadLib.throwIfCombineSarifFilesDisabled([createMockSarif("abc", "def"), createMockSarif("abc", "def")], (0, testing_utils_1.createFeatures)([]), {
+        type: util_1.GitHubVariant.GHES,
+        version: "foobar",
+    }));
+});
 (0, ava_1.default)("throwIfCombineSarifFilesDisabled with only 1 run", async (t) => {
     await t.notThrowsAsync(uploadLib.throwIfCombineSarifFilesDisabled([createMockSarif("abc", "def")], (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.DisableCombineSarifFiles]), {
         type: util_1.GitHubVariant.DOTCOM,

lib/util.js

@@ -77,7 +77,7 @@ exports.getErrorMessage = getErrorMessage;
 exports.prettyPrintPack = prettyPrintPack;
 exports.checkDiskUsage = checkDiskUsage;
 exports.checkActionVersion = checkActionVersion;
-exports.parseGhesVersion = parseGhesVersion;
+exports.satisfiesGHESVersion = satisfiesGHESVersion;
 exports.cloneObject = cloneObject;
 exports.checkSipEnablement = checkSipEnablement;
 exports.cleanUpGlob = cleanUpGlob;
@@ -889,20 +889,22 @@ function checkActionVersion(version, githubVersion) {
     }
 }
 /**
- * This will parse a GitHub Enterprise Server version string into a SemVer object.
+ * This will check whether the given GitHub version satisfies the given range,
+ * taking into account that a range like >=3.18 will also match the GHES 3.18
+ * pre-release/RC versions.
  *
- * GHES versions are usually in a semver-compatible format, so usually this will
- * just call the SemVer constructor. However, for GHES pre-release versions,
- * the version string is in the format "3.18.0.pre1", which is not a valid semver
- * version since the pre-release part of the version should be separated by a
- * hyphen. This function will replace the ".pre" part of the version with "-pre"
- * to make it a valid semver version.
+ * When the given `githubVersion` is not a GHES version, or if the version
+ * is invalid, this will return `defaultIfInvalid`.
  */
-function parseGhesVersion(version) {
-    if (version.includes(".pre")) {
-        version = version.replace(".pre", "-pre");
+function satisfiesGHESVersion(ghesVersion, range, defaultIfInvalid) {
+    const semverVersion = semver.coerce(ghesVersion);
+    if (semverVersion === null) {
+        return defaultIfInvalid;
     }
-    return new semver.SemVer(version);
+    // We always drop the pre-release part of the version, since anything that
+    // applies to GHES 3.18.0 should also apply to GHES 3.18.0.pre1.
+    semverVersion.prerelease = [];
+    return semver.satisfies(semverVersion, range);
 }
 /**
  * Supported build modes.

src/upload-lib.test.ts

@@ -548,6 +548,19 @@ test("throwIfCombineSarifFilesDisabled when on GHES 3.18", async (t) => {
   );
 });
 
+test("throwIfCombineSarifFilesDisabled with an invalid GHES version", async (t) => {
+  await t.notThrowsAsync(
+    uploadLib.throwIfCombineSarifFilesDisabled(
+      [createMockSarif("abc", "def"), createMockSarif("abc", "def")],
+      createFeatures([]),
+      {
+        type: GitHubVariant.GHES,
+        version: "foobar",
+      },
+    ),
+  );
+});
+
 test("throwIfCombineSarifFilesDisabled with only 1 run", async (t) => {
   await t.notThrowsAsync(
     uploadLib.throwIfCombineSarifFilesDisabled(

src/upload-lib.ts

@@ -6,7 +6,6 @@ import * as core from "@actions/core";
 import { OctokitResponse } from "@octokit/types";
 import fileUrl from "file-url";
 import * as jsonschema from "jsonschema";
-import * as semver from "semver";
 
 import * as actionsUtil from "./actions-util";
 import { getOptionalInput, getRequiredInput } from "./actions-util";
@@ -30,7 +29,7 @@ import {
   getRequiredEnvParam,
   GitHubVariant,
   GitHubVersion,
-  parseGhesVersion,
+  satisfiesGHESVersion,
   SarifFile,
   SarifRun,
 } from "./util";
@@ -133,7 +132,7 @@ export async function shouldShowCombineSarifFilesDeprecationWarning(
   // Do not show this warning on GHES versions before 3.14.0
   if (
     githubVersion.type === GitHubVariant.GHES &&
-    semver.lt(parseGhesVersion(githubVersion.version), "3.14.0")
+    satisfiesGHESVersion(githubVersion.version, "<3.14", true)
   ) {
     return false;
   }
@@ -178,7 +177,7 @@ async function shouldDisableCombineSarifFiles(
 ) {
   if (githubVersion.type === GitHubVariant.GHES) {
     // Never block on GHES versions before 3.18.
-    if (semver.lt(parseGhesVersion(githubVersion.version), "3.18.0-0")) {
+    if (satisfiesGHESVersion(githubVersion.version, "<3.18", true)) {
       return false;
     }
   } else {

src/util.ts

@@ -1133,20 +1133,28 @@ export function checkActionVersion(
 }
 
 /**
- * This will parse a GitHub Enterprise Server version string into a SemVer object.
+ * This will check whether the given GitHub version satisfies the given range,
+ * taking into account that a range like >=3.18 will also match the GHES 3.18
+ * pre-release/RC versions.
  *
- * GHES versions are usually in a semver-compatible format, so usually this will
- * just call the SemVer constructor. However, for GHES pre-release versions,
- * the version string is in the format "3.18.0.pre1", which is not a valid semver
- * version since the pre-release part of the version should be separated by a
- * hyphen. This function will replace the ".pre" part of the version with "-pre"
- * to make it a valid semver version.
+ * When the given `githubVersion` is not a GHES version, or if the version
+ * is invalid, this will return `defaultIfInvalid`.
  */
-export function parseGhesVersion(version: string): semver.SemVer {
-  if (version.includes(".pre")) {
-    version = version.replace(".pre", "-pre");
+export function satisfiesGHESVersion(
+  ghesVersion: string,
+  range: string,
+  defaultIfInvalid: boolean,
+): boolean {
+  const semverVersion = semver.coerce(ghesVersion);
+  if (semverVersion === null) {
+    return defaultIfInvalid;
   }
-  return new semver.SemVer(version);
+
+  // We always drop the pre-release part of the version, since anything that
+  // applies to GHES 3.18.0 should also apply to GHES 3.18.0.pre1.
+  semverVersion.prerelease = [];
+
+  return semver.satisfies(semverVersion, range);
 }
 
 /**