Merge branch 'main' into redsun82/dump-sarif

Resolve supported languages using CodeQL CLI

.github/actions/prepare-mergeback-branch/action.yml

@@ -0,0 +1,80 @@
+name: "Prepare mergeback branch"
+description: Prepares a mergeback branch and opens a PR for it
+inputs:
+  base:
+    description: "The name of the base branch"
+    required: true
+  head:
+    description: "The name of the head branch"
+    required: true
+  branch:
+    description: "The name of the branch to create."
+    required: true
+  version:
+    description: "The new version"
+    required: true
+  token:
+    description: "The token to use"
+    required: true
+  dry-run:
+    description: "Set to true to skip creating the PR. The branch will still be pushed."
+    default: "false"
+runs:
+  using: composite
+  steps:
+    - name: Create mergeback branch
+      shell: bash
+      env:
+        VERSION: "${{ inputs.version }}"
+        NEW_BRANCH: "${{ inputs.branch }}"
+      run: |
+        set -exu
+
+        # Ensure we are on the new branch
+        git checkout "${NEW_BRANCH}"
+
+        # Update the version number ready for the next release
+        npm version patch --no-git-tag-version
+
+        # Update the changelog, adding a new version heading directly above the most recent existing one
+        awk '!f && /##/{print "'"## [UNRELEASED]\n\nNo user facing changes.\n"'"; f=1}1' CHANGELOG.md > temp && mv temp CHANGELOG.md
+        git add .
+        git commit -m "Update changelog and version after ${VERSION}"
+
+        git push origin "${NEW_BRANCH}"
+
+    - name: Create PR
+      shell: bash
+      if: inputs.dry-run != 'true'
+      env:
+        VERSION: "${{ inputs.version }}"
+        BASE_BRANCH: "${{ inputs.base }}"
+        HEAD_BRANCH: "${{ inputs.head }}"
+        NEW_BRANCH: "${{ inputs.branch }}"
+        GITHUB_TOKEN: "${{ inputs.token }}"
+      run: |
+        set -exu
+        pr_title="Mergeback ${VERSION} ${HEAD_BRANCH} into ${BASE_BRANCH}"
+        pr_body=$(cat << EOF
+          This PR bumps the version number and updates the changelog after the ${VERSION} release.
+
+          Please do the following:
+
+          - [ ] Remove and re-add the "Rebuild" label to the PR to trigger just this workflow.
+          - [ ] Wait for the "Rebuild" workflow to push a commit updating the distribution files.
+          - [ ] Mark the PR as ready for review to trigger the full set of PR checks.
+          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is
+                selected rather than "Squash and merge" or "Rebase and merge".
+        EOF
+        )
+
+        # PR checks won't be triggered on PRs created by Actions. Therefore mark the PR as draft
+        # so that a maintainer can take the PR out of draft, thereby triggering the PR checks.
+        gh pr create \
+          --head "${NEW_BRANCH}" \
+          --base "${BASE_BRANCH}" \
+          --title "${pr_title}" \
+          --label "Rebuild" \
+          --body "${pr_body}" \
+          --assignee "${GITHUB_ACTOR}" \
+          --draft

.github/actions/setup-swift/action.yml

@@ -1,39 +0,0 @@
-name: "Set up Swift on Linux"
-description: Sets up an appropriate Swift version on Linux.
-inputs:
-  codeql-path:
-    description: Path to the CodeQL CLI executable.
-    required: true
-runs:
-  using: "composite"
-  steps:
-    - name: Get Swift version
-      id: get_swift_version
-      if: runner.os == 'Linux'
-      shell: bash
-      env:
-        CODEQL_PATH: ${{ inputs.codeql-path }}
-      run: |
-        SWIFT_EXTRACTOR_DIR="$("$CODEQL_PATH" resolve languages --format json | jq -r '.swift[0]')"
-        if [ $SWIFT_EXTRACTOR_DIR = "null" ]; then
-          VERSION="null"
-        else
-          VERSION="$("$SWIFT_EXTRACTOR_DIR/tools/linux64/extractor" --version | awk '/version/ { print $3 }')"
-          # Specify 5.x.0, otherwise setup Action will default to latest minor version.
-          if [ $VERSION = "5.7" ]; then
-            VERSION="5.7.0"
-          elif [ $VERSION = "5.8" ]; then
-            VERSION="5.8.0"
-          elif [ $VERSION = "5.9" ]; then
-            VERSION="5.9.0"
-          # setup-swift does not yet support v5.9.1 Remove this when it does.
-          elif [ $VERSION = "5.9.1" ]; then
-            VERSION="5.9.0"
-          fi
-        fi
-        echo "version=$VERSION" | tee -a $GITHUB_OUTPUT
-
-    - uses: redsun82/setup-swift@362f49f31da2f5f4f851657046bdd1290d03edc8 # Please update the corresponding SHA in the CLI's CodeQL Action Integration Test.
-      if: runner.os == 'Linux' && steps.get_swift_version.outputs.version != 'null'
-      with:
-        swift-version: "${{ steps.get_swift_version.outputs.version }}"

.github/dependabot.yml

@@ -5,15 +5,12 @@ updates:
     schedule:
       interval: weekly
     labels:
-      - Update dependencies
+      - Rebuild
     # Ignore incompatible dependency updates
     ignore:
       # There is a type incompatibility issue between v0.0.9 and our other dependencies.
       - dependency-name: "@octokit/plugin-retry"
         versions: ["~6.0.0"]
-      # v7 requires ESM
-      - dependency-name: "del"
-        versions: ["^7.0.0"]
       # This is broken due to the way configuration files have changed. 
       # This might be fixed when we move to eslint v9.
       - dependency-name: "eslint-plugin-import"

.github/pull_request_template.md

@@ -1,4 +1,4 @@
-
+<!-- For GitHub staff: Remember that this is a public repository. -->
 
 ### Risk assessment
 

.github/update-release-branch.py

@@ -97,8 +97,8 @@ def open_pr(
   body.append(' - [ ] Ensure the docs team is aware of any documentation changes that need to be released.')
 
   if not is_primary_release:
-    body.append(' - [ ] Remove and re-add the "Update dependencies" label to the PR to trigger just this workflow.')
-    body.append(' - [ ] Wait for the "Update dependencies" workflow to push a commit updating the dependencies.')
+    body.append(' - [ ] Remove and re-add the "Rebuild" label to the PR to trigger just this workflow.')
+    body.append(' - [ ] Wait for the "Rebuild" workflow to push a commit updating the distribution files.')
 
   body.append(' - [ ] Mark the PR as ready for review to trigger the full set of PR checks.')
   body.append(' - [ ] Approve and merge this PR. Make sure `Create a merge commit` is selected rather than `Squash and merge` or `Rebase and merge`.')
@@ -108,7 +108,7 @@ def open_pr(
     body.append(' - [ ] Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.')
 
   title = f'Merge {source_branch} into {target_branch}'
-  labels = ['Update dependencies'] if not is_primary_release else []
+  labels = ['Rebuild'] if not is_primary_release else []
 
   # Create the pull request
   # PR checks won't be triggered on PRs created by Actions. Therefore mark the PR as draft so that
@@ -389,7 +389,7 @@ def main():
 
     # Migrate the package version number from a vLatest version number to a vOlder version number
     print(f'Setting version number to {version} in package.json')
-    replace_version_package_json(get_current_version(), version) # We rely on the `Update dependencies` workflow to update package-lock.json
+    replace_version_package_json(get_current_version(), version) # We rely on the `Rebuild` workflow to update package-lock.json
     run_git('add', 'package.json')
 
     # Migrate the changelog notes from vLatest version numbers to vOlder version numbers

.github/workflows/__analyze-ref-input.yml

@@ -44,7 +44,7 @@ jobs:
             version: default
           - os: macos-latest
             version: default
-          - os: windows-2025
+          - os: windows-latest
             version: default
     name: "Analyze: 'ref' and 'sha' from inputs"
     permissions:

.github/workflows/__autobuild-action.yml

@@ -34,7 +34,7 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
     name: autobuild-action
     permissions:

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -42,11 +42,11 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
           - os: ubuntu-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: Autobuild direct tracing (custom working directory)
     permissions:
@@ -65,7 +65,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin

.github/workflows/__autobuild-direct-tracing.yml

@@ -42,11 +42,11 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
           - os: ubuntu-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: Autobuild direct tracing
     permissions:
@@ -65,7 +65,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin

.github/workflows/__bundle-toolcache.yml

@@ -34,7 +34,7 @@ jobs:
             version: linked
           - os: ubuntu-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
     name: 'Bundle: Caching checks'
     permissions:

.github/workflows/__bundle-zstd.yml

@@ -34,7 +34,7 @@ jobs:
             version: linked
           - os: ubuntu-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
     name: 'Bundle: Zstandard checks'
     permissions:

.github/workflows/__config-export.yml

@@ -34,13 +34,13 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: Config export
     permissions:

.github/workflows/__config-input.yml

@@ -41,6 +41,13 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__diagnostics-export.yml

@@ -34,13 +34,13 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: Diagnostic export
     permissions:

.github/workflows/__export-file-baseline-information.yml

@@ -44,7 +44,7 @@ jobs:
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: Export file baseline information
     permissions:
@@ -72,10 +72,6 @@ jobs:
         with:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
-      - uses: ./../action/.github/actions/setup-swift
-        if: runner.os == 'macOS'
-        with:
-          codeql-path: ${{ steps.init.outputs.codeql-path }}
       - name: Build code
         shell: bash
         run: ./build.sh

.github/workflows/__init-with-registries.yml

@@ -34,19 +34,19 @@ jobs:
             version: default
           - os: macos-latest
             version: default
-          - os: windows-2025
+          - os: windows-latest
             version: default
           - os: ubuntu-latest
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: 'Packaging: Download using registries'
     permissions:

.github/workflows/__multi-language-autodetect.yml

@@ -93,6 +93,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Use Xcode 16
+        shell: bash
+        if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
+        run: sudo xcode-select -s "/Applications/Xcode_16.app"
+
       - uses: ./../action/init
         id: init
         with:
@@ -101,11 +106,6 @@ jobs:
             || '' }}
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - uses: ./../action/.github/actions/setup-swift
-        if: runner.os == 'macOS'
-        with:
-          codeql-path: ${{ steps.init.outputs.codeql-path }}
-
       - name: Build code
         shell: bash
         run: ./build.sh
@@ -164,4 +164,5 @@ jobs:
             exit 1
           fi
     env:
+      CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -44,19 +44,19 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
           - os: ubuntu-latest
             version: default
           - os: macos-latest
             version: default
-          - os: windows-2025
+          - os: windows-latest
             version: default
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: 'Packaging: Config and input passed to the CLI'
     permissions:
@@ -67,6 +67,13 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__packaging-config-inputs-js.yml

@@ -44,19 +44,19 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
           - os: ubuntu-latest
             version: default
           - os: macos-latest
             version: default
-          - os: windows-2025
+          - os: windows-latest
             version: default
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: 'Packaging: Config and input'
     permissions:
@@ -67,6 +67,13 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__packaging-config-js.yml

@@ -44,19 +44,19 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
           - os: ubuntu-latest
             version: default
           - os: macos-latest
             version: default
-          - os: windows-2025
+          - os: windows-latest
             version: default
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: 'Packaging: Config file'
     permissions:
@@ -67,6 +67,13 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__packaging-inputs-js.yml

@@ -44,19 +44,19 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
           - os: ubuntu-latest
             version: default
           - os: macos-latest
             version: default
-          - os: windows-2025
+          - os: windows-latest
             version: default
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: 'Packaging: Action input'
     permissions:
@@ -67,6 +67,13 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__quality-queries.yml

@@ -32,16 +32,58 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
+            analysis-kinds: code-scanning
+          - os: ubuntu-latest
+            version: linked
+            analysis-kinds: code-quality
+          - os: ubuntu-latest
+            version: linked
+            analysis-kinds: code-scanning,code-quality
           - os: macos-latest
             version: linked
-          - os: windows-2025
+            analysis-kinds: code-scanning
+          - os: macos-latest
             version: linked
+            analysis-kinds: code-quality
+          - os: macos-latest
+            version: linked
+            analysis-kinds: code-scanning,code-quality
+          - os: windows-latest
+            version: linked
+            analysis-kinds: code-scanning
+          - os: windows-latest
+            version: linked
+            analysis-kinds: code-quality
+          - os: windows-latest
+            version: linked
+            analysis-kinds: code-scanning,code-quality
           - os: ubuntu-latest
             version: nightly-latest
+            analysis-kinds: code-scanning
+          - os: ubuntu-latest
+            version: nightly-latest
+            analysis-kinds: code-quality
+          - os: ubuntu-latest
+            version: nightly-latest
+            analysis-kinds: code-scanning,code-quality
           - os: macos-latest
             version: nightly-latest
-          - os: windows-2025
+            analysis-kinds: code-scanning
+          - os: macos-latest
             version: nightly-latest
+            analysis-kinds: code-quality
+          - os: macos-latest
+            version: nightly-latest
+            analysis-kinds: code-scanning,code-quality
+          - os: windows-latest
+            version: nightly-latest
+            analysis-kinds: code-scanning
+          - os: windows-latest
+            version: nightly-latest
+            analysis-kinds: code-quality
+          - os: windows-latest
+            version: nightly-latest
+            analysis-kinds: code-scanning,code-quality
     name: Quality queries input
     permissions:
       contents: read
@@ -61,25 +103,30 @@ jobs:
       - uses: ./../action/init
         with:
           languages: javascript
-          quality-queries: code-quality
+          analysis-kinds: ${{ matrix.analysis-kinds }}
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
           output: ${{ runner.temp }}/results
           upload-database: false
       - name: Upload security SARIF
+        if: contains(matrix.analysis-kinds, 'code-scanning')
         uses: actions/upload-artifact@v4
         with:
-          name: quality-queries-${{ matrix.os }}-${{ matrix.version }}.sarif.json
+          name: |
+            quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
           path: ${{ runner.temp }}/results/javascript.sarif
           retention-days: 7
       - name: Upload quality SARIF
+        if: contains(matrix.analysis-kinds, 'code-quality')
         uses: actions/upload-artifact@v4
         with:
-          name: quality-queries-${{ matrix.os }}-${{ matrix.version }}.quality.sarif.json
+          name: |
+            quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.quality.sarif.json
           path: ${{ runner.temp }}/results/javascript.quality.sarif
           retention-days: 7
       - name: Check quality query does not appear in security SARIF
+        if: contains(matrix.analysis-kinds, 'code-scanning')
         uses: actions/github-script@v7
         env:
           SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
@@ -87,6 +134,7 @@ jobs:
         with:
           script: ${{ env.CHECK_SCRIPT }}
       - name: Check quality query appears in quality SARIF
+        if: contains(matrix.analysis-kinds, 'code-quality')
         uses: actions/github-script@v7
         env:
           SARIF_PATH: ${{ runner.temp }}/results/javascript.quality.sarif

.github/workflows/__resolve-environment-action.yml

@@ -34,19 +34,19 @@ jobs:
             version: default
           - os: macos-latest
             version: default
-          - os: windows-2025
+          - os: windows-latest
             version: default
           - os: ubuntu-latest
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: Resolve environment
     permissions:

.github/workflows/__rubocop-multi-language.yml

@@ -49,7 +49,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@2a7b30092b0caf9c046252510f9273b4875f3db9 # v1.254.0
+        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration

.github/workflows/__start-proxy.yml

@@ -34,7 +34,7 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
     name: Start proxy
     permissions:

.github/workflows/__swift-autobuild.yml

@@ -54,9 +54,6 @@ jobs:
           languages: swift
           build-mode: autobuild
           tools: ${{ steps.prepare-test.outputs.tools-url }}
-      - uses: ./../action/.github/actions/setup-swift
-        with:
-          codeql-path: ${{steps.init.outputs.codeql-path}}
       - name: Check working directory
         shell: bash
         run: pwd

.github/workflows/__swift-custom-build.yml

@@ -67,14 +67,15 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Use Xcode 16
+        shell: bash
+        if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
+        run: sudo xcode-select -s "/Applications/Xcode_16.app"
       - uses: ./../action/init
         id: init
         with:
           languages: swift
           tools: ${{ steps.prepare-test.outputs.tools-url }}
-      - uses: ./../action/.github/actions/setup-swift
-        with:
-          codeql-path: ${{steps.init.outputs.codeql-path}}
       - name: Check working directory
         shell: bash
         run: pwd

.github/workflows/__upload-quality-sarif.yml

@@ -44,7 +44,7 @@ jobs:
             version: default
           - os: macos-latest
             version: default
-          - os: windows-2025
+          - os: windows-latest
             version: default
     name: 'Upload-sarif: code quality endpoint'
     permissions:
@@ -73,7 +73,7 @@ jobs:
           languages: cpp,csharp,java,javascript,python
           config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
             github.sha }}
-          quality-queries: code-quality
+          analysis-kinds: code-scanning,code-quality
       - name: Build code
         shell: bash
         run: ./build.sh

.github/workflows/__upload-ref-sha-input.yml

@@ -44,7 +44,7 @@ jobs:
             version: default
           - os: macos-latest
             version: default
-          - os: windows-2025
+          - os: windows-latest
             version: default
     name: "Upload-sarif: 'ref' and 'sha' from inputs"
     permissions:

.github/workflows/__with-checkout-path.yml

@@ -44,7 +44,7 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
     name: Use a custom `checkout_path`
     permissions:

.github/workflows/codescanning-config-cli.yml

@@ -55,6 +55,16 @@ jobs:
     steps:
     - name: Check out repository
       uses: actions/checkout@v5
+
+    - name: Set up Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20'
+        cache: 'npm'
+
+    - name: Install dependencies
+      run: npm ci
+
     - name: Prepare test
       id: prepare-test
       uses: ./.github/actions/prepare-test

.github/workflows/expected-queries-runs.yml

@@ -1,49 +0,0 @@
-name: Check queries that ran
-
-on:
-  push:
-    branches:
-    - main
-    - releases/v*
-  pull_request:
-    types:
-    - opened
-    - synchronize
-    - reopened
-    - ready_for_review
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch: {}
-
-jobs:
-  expected-queries:
-    name: Expected Queries Tests
-    env:
-      CODEQL_ACTION_TEST_MODE: true
-    timeout-minutes: 45
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: read
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@v5
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: linked
-    - uses: ./../action/init
-      with:
-        languages: javascript
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-    - uses: ./../action/analyze
-      with:
-        output: ${{ runner.temp }}/results
-
-    - name: Check Sarif
-      uses: ./../action/.github/actions/check-sarif
-      with:
-        sarif-file: ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/incomplete-hostname-regexp,js/path-injection
-        queries-not-run: foo,bar

.github/workflows/post-release-mergeback.yml

@@ -3,7 +3,7 @@
 #    tag
 # 2. Updates the `vN` tag to refer to this merge commit.
 # 3. Iff vN == vLatest, merges any changes from the release back into the main branch.
-#    Typically, this is two commits – one to update the version number and one to update dependencies.
+#    Typically, this is two commits – one to update the version number and one to rebuild.
 name: Tag release and merge back
 
 on:
@@ -124,48 +124,15 @@ jobs:
           cat $PARTIAL_CHANGELOG
           echo "::endgroup::"
 
-      - name: Create mergeback branch
+      - name: Create mergeback branch and PR
         if: ${{ steps.check.outputs.exists != 'true' && endsWith(github.ref_name, steps.getVersion.outputs.latest_release_branch) }}
-        env:
-          VERSION: "${{ steps.getVersion.outputs.version }}"
-          NEW_BRANCH: "${{ steps.getVersion.outputs.newBranch }}"
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-        run: |
-          set -exu
-          pr_title="Mergeback ${VERSION} ${HEAD_BRANCH} into ${BASE_BRANCH}"
-          pr_body=$(cat << EOF
-            This PR bumps the version number and updates the changelog after the ${VERSION} release.
-
-            Please do the following:
-
-            - [ ] Remove and re-add the "Update dependencies" label to the PR to trigger just this workflow.
-            - [ ] Wait for the "Update dependencies" workflow to push a commit updating the dependencies.
-            - [ ] Mark the PR as ready for review to trigger the full set of PR checks.
-            - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is
-                  selected rather than "Squash and merge" or "Rebase and merge".
-          EOF
-          )
-
-          # Update the version number ready for the next release
-          npm version patch --no-git-tag-version
-
-          # Update the changelog, adding a new version heading directly above the most recent existing one
-          awk '!f && /##/{print "'"## [UNRELEASED]\n\nNo user facing changes.\n"'"; f=1}1' CHANGELOG.md > temp && mv temp CHANGELOG.md
-          git add .
-          git commit -m "Update changelog and version after ${VERSION}"
-
-          git push origin "${NEW_BRANCH}"
-
-          # PR checks won't be triggered on PRs created by Actions. Therefore mark the PR as draft
-          # so that a maintainer can take the PR out of draft, thereby triggering the PR checks.
-          gh pr create \
-            --head "${NEW_BRANCH}" \
-            --base "${BASE_BRANCH}" \
-            --title "${pr_title}" \
-            --label "Update dependencies" \
-            --body "${pr_body}" \
-            --assignee "${GITHUB_ACTOR}" \
-            --draft
+        uses: ./.github/actions/prepare-mergeback-branch
+        with:
+          base: "${{ env.BASE_BRANCH }}"
+          head: "${{ env.HEAD_BRANCH }}"
+          branch: "${{ steps.getVersion.outputs.newBranch }}"
+          version: "${{ steps.getVersion.outputs.version }}"
+          token: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: Generate token
         uses: actions/create-github-app-token@v2.1.1

.github/workflows/pr-checks.yml

@@ -9,89 +9,58 @@ on:
   workflow_dispatch:
 
 jobs:
-  check-js:
-    name: Check JS
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
+  unit-tests:
+    name: Unit Tests
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
     permissions:
       contents: read
       security-events: write # needed to upload ESLint results
-
-    strategy:
-      fail-fast: false
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Lint
-        id: lint
-        run: npm run-script lint-ci
-
-      - name: Upload sarif
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: eslint.sarif
-          category: eslint
-
-      - name: Check generated JS
-        run: .github/workflows/script/check-js.sh
-
-  check-node-modules:
-    if: github.event_name != 'push' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/releases/v')
-    name: Check modules up to date
-    permissions:
-      contents: read
-    runs-on: macos-latest
+    runs-on: ${{ matrix.os }}
     timeout-minutes: 45
 
     steps:
       - uses: actions/checkout@v5
-      - name: Check node modules up to date
-        run: .github/workflows/script/check-node-modules.sh
-
-  check-file-contents:
-    if: github.event_name != 'push' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/releases/v')
-    name: Check file contents
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
+      
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
 
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: 3.11
 
-      # Ensure the generated PR check workflows are up to date.
+      - name: Install dependencies
+        run: |
+          # Use the system Bash shell to ensure we can run commands like `npm ci`
+          # that are not available in the default shell on Windows.
+          npm config set script-shell bash
+          npm ci
+
+      - name: Verify compiled JS up to date
+        run: .github/workflows/script/check-js.sh
+
       - name: Verify PR checks up to date
         run: .github/workflows/script/verify-pr-checks.sh
 
-  npm-test:
-    if: github.event_name != 'push' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/releases/v')
-    name: Unit Test
-    needs: [check-js, check-node-modules]
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-2025]
-    permissions:
-      contents: read
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 45
+      - name: Run unit tests
+        run: npm test
 
-    steps:
-      - uses: actions/checkout@v5
-      - name: npm test
-        run: |
-          # Run any commands referenced in package.json using Bash, otherwise
-          # we won't be able to find them on Windows.
-          npm config set script-shell bash
-          npm test
+      - name: Lint
+        if: matrix.os != 'windows-latest'
+        run: npm run lint-ci
+
+      - name: Upload sarif
+        uses: github/codeql-action/upload-sarif@v3
+        if: matrix.os == 'ubuntu-latest'
+        with:
+          sarif_file: eslint.sarif
+          category: eslint
 
   check-node-version:
     if: github.event.pull_request

.github/workflows/prepare-release.yml

@@ -0,0 +1,73 @@
+name: Prepare release
+on:
+  workflow_call:
+    outputs:
+      version:
+        description: "The version that is being released."
+        value: ${{ jobs.prepare.outputs.version }}
+      major_version:
+        description: "The major version of the release."
+        value: ${{ jobs.prepare.outputs.major_version }}
+      latest_tag:
+        description: "The most recent, existing release tag."
+        value: ${{ jobs.prepare.outputs.latest_tag }}
+      backport_source_branch:
+        description: "The release branch for the given tag."
+        value: ${{ jobs.prepare.outputs.backport_source_branch }}
+      backport_target_branches:
+        description: "JSON encoded list of branches to target with backports."
+        value: ${{ jobs.prepare.outputs.backport_target_branches }}
+
+  push:
+    paths:
+      - .github/workflows/prepare-release.yml
+
+jobs:
+  prepare:
+    name: "Prepare release"
+    runs-on: ubuntu-latest
+    if: github.repository == 'github/codeql-action'
+
+    permissions:
+      contents: read
+
+    outputs:
+      version: ${{ steps.versions.outputs.version }}
+      major_version: ${{ steps.versions.outputs.major_version }}
+      latest_tag: ${{ steps.versions.outputs.latest_tag }}
+      backport_source_branch: ${{ steps.branches.outputs.backport_source_branch }}
+      backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # Need full history for calculation of diffs
+
+      - name: Configure runner for release
+        uses: ./.github/actions/release-initialise
+
+      - name: Get version tags
+        id: versions
+        run: |
+          VERSION="v$(jq '.version' -r 'package.json')"
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          MAJOR_VERSION=$(cut -d '.' -f1 <<< "${VERSION}")
+          echo "major_version=${MAJOR_VERSION}" >> $GITHUB_OUTPUT
+          LATEST_TAG=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | head -1)
+          echo "latest_tag=${LATEST_TAG}" >> $GITHUB_OUTPUT
+
+      - name: Determine older release branches
+        id: branches
+        uses: ./.github/actions/release-branches
+        with:
+          major_version: ${{ steps.versions.outputs.major_version }}
+          latest_tag: ${{ steps.versions.outputs.latest_tag }}
+
+      - name: Print release information
+        run: |
+          echo 'version: ${{ steps.versions.outputs.version }}'
+          echo 'major_version: ${{ steps.versions.outputs.major_version }}'
+          echo 'latest_tag: ${{ steps.versions.outputs.latest_tag }}'
+          echo 'backport_source_branch: ${{ steps.branches.outputs.backport_source_branch }}'
+          echo 'backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}'

.github/workflows/python312-windows.yml

@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: windows-2025
+    runs-on: windows-latest
 
     steps:
     - uses: actions/setup-python@v5

.github/workflows/query-filters.yml

@@ -25,6 +25,16 @@ jobs:
     steps:
     - name: Check out repository
       uses: actions/checkout@v5
+
+    - name: Install Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: 20.x
+        cache: npm
+
+    - name: Install dependencies
+      run: npm ci
+
     - name: Prepare test
       id: prepare-test
       uses: ./.github/actions/prepare-test

.github/workflows/rebuild.yml

@@ -63,7 +63,7 @@ jobs:
 
       - name: Compile TypeScript
         run: |
-          npm install
+          npm ci
           npm run lint -- --fix
           npm run build
 

.github/workflows/rollback-release.yml

@@ -0,0 +1,182 @@
+name: Rollback release
+on:
+  # You can trigger this workflow via workflow dispatch to start a rollback.
+  # This will create a draft release that mirrors the release for `rollback-tag`.
+  workflow_dispatch:
+    inputs:
+      rollback-tag:
+        type: string
+        description: "The tag of an old release to roll-back to."
+        required: true
+  # Only for dry-runs of changes to the workflow.
+  push:
+    paths:
+      - .github/workflows/rollback-release.yml
+      - .github/actions/prepare-mergeback-branch/**
+
+jobs:
+  prepare:
+    name: "Prepare release"
+    if: github.repository == 'github/codeql-action'
+
+    permissions:
+      contents: read
+
+    uses: ./.github/workflows/prepare-release.yml
+
+  rollback:
+    name: "Create rollback release"
+    if: github.repository == 'github/codeql-action'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    # Don't set the deployment environment for test runs
+    # The Actions token does not have permissions to push changes to workflow files.
+    # Since workflow files may change as part of a backport PR, we use the "Automation" environment for real runs to authenticate as a GitHub App and push these changes.
+    environment: ${{ github.event_name == 'workflow_dispatch' && 'Automation' || '' }}
+
+    needs:
+      - prepare
+
+    permissions:
+      contents: write # needed to push to the repo (tags and releases)
+      pull-requests: write # needed to create the mergeback PR
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # Need full history for calculation of diffs
+
+      - name: Configure runner for release
+        uses: ./.github/actions/release-initialise
+
+      - name: Create tag for testing
+        if: github.event_name != 'workflow_dispatch'
+        shell: bash
+        run: git tag v0.0.0
+
+      # We start by preparing the mergeback branch, mainly so that we have the updated changelog
+      # readily available for the partial changelog that's needed for the release.
+      - name: Prepare mergeback branch
+        id: mergeback-branch
+        env:
+          BASE_BRANCH: ${{ (github.event_name == 'workflow_dispatch' && 'main') || github.ref_name }}
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: |
+          set -x
+
+          # Checkout the base branch, since we may be testing on a different branch
+          git checkout "$BASE_BRANCH"
+
+          # Generate a new branch name for the mergeback PR
+          short_sha="${GITHUB_SHA:0:8}"
+          NEW_BRANCH="mergeback/${VERSION}-to-${BASE_BRANCH}-${short_sha}"
+          echo "new-branch=${NEW_BRANCH}" >> $GITHUB_OUTPUT
+
+          # Create the mergeback branch
+          git checkout -b "${NEW_BRANCH}"
+
+      - name: Prepare rollback changelog
+        env:
+          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
+          # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
+          # but use `v0.0.0` for testing.
+          ROLLBACK_TAG: ${{ inputs.rollback-tag || 'v0.0.0' }}
+          LATEST_TAG: ${{ needs.prepare.outputs.latest_tag }}
+          VERSION: "${{ needs.prepare.outputs.version }}"
+        run: |
+          python .github/workflows/script/rollback_changelog.py \
+            --target-version "${ROLLBACK_TAG:1}" \
+            --rollback-version "${LATEST_TAG:1}" \
+            --new-version "$VERSION" > $NEW_CHANGELOG
+
+          echo "::group::New CHANGELOG"
+          cat $NEW_CHANGELOG
+          echo "::endgroup::"
+
+      - name: Create tags
+        shell: bash
+        env:
+          # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
+          # but use `v0.0.0` for testing.
+          ROLLBACK_TAG: ${{ inputs.rollback-tag || 'v0.0.0' }}
+          RELEASE_TAG: ${{ needs.prepare.outputs.version }}
+          MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
+        run: |
+          git checkout "refs/tags/${ROLLBACK_TAG}"
+          git tag --annotate "${RELEASE_TAG}" --message "${RELEASE_TAG}"
+          git tag --annotate "${MAJOR_VERSION_TAG}" --message "${MAJOR_VERSION_TAG}" --force
+
+      - name: Push tags
+        # skip when testing
+        if: github.event_name == 'workflow_dispatch'
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ needs.prepare.outputs.version }}
+          MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
+        run: |
+          git push origin --atomic --force refs/tags/"${RELEASE_TAG}" refs/tags/"${MAJOR_VERSION_TAG}"
+
+      - name: Prepare partial Changelog
+        env:
+          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
+          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
+          VERSION: "${{ needs.prepare.outputs.version }}"
+        run: |
+          python .github/workflows/script/prepare_changelog.py $NEW_CHANGELOG "$VERSION" > $PARTIAL_CHANGELOG
+
+          echo "::group::Partial CHANGELOG"
+          cat $PARTIAL_CHANGELOG
+          echo "::endgroup::"
+
+      - name: Generate token
+        if: github.event_name == 'workflow_dispatch'
+        uses: actions/create-github-app-token@v2.1.1
+        id: app-token
+        with:
+          app-id: ${{ vars.AUTOMATION_APP_ID }}
+          private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
+
+      - name: Create the rollback release
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
+          VERSION: "${{ needs.prepare.outputs.version }}"
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          RELEASE_URL: "${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ needs.prepare.outputs.version }}"
+        run: |
+          set -exu
+
+          # Do not mark this release as latest. The most recent bundle release must be marked as latest.
+          # Set as a draft to give us an opportunity to review the rollback release.
+          gh release create \
+            "$VERSION" \
+            --latest=false \
+            --draft \
+            --title "$VERSION" \
+            --notes-file "$PARTIAL_CHANGELOG"
+
+          echo "Created draft rollback release at $RELEASE_URL" >> $GITHUB_STEP_SUMMARY
+
+      - name: Update changelog
+        shell: bash
+        env:
+          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
+          NEW_BRANCH: "${{ steps.mergeback-branch.outputs.new-branch }}"
+        run: |
+          git checkout "${NEW_BRANCH}"
+          mv ${NEW_CHANGELOG} CHANGELOG.md
+
+      - name: Create mergeback branch and PR
+        uses: ./.github/actions/prepare-mergeback-branch
+        with:
+          base: "main"
+          head: ""
+          branch: "${{ steps.mergeback-branch.outputs.new-branch }}"
+          version: "${{ needs.prepare.outputs.version }}"
+          token: "${{ secrets.GITHUB_TOKEN }}"
+          # Setting this to `true` for non-workflow_dispatch events will
+          # still push the `branch`, but won't create a corresponding PR
+          dry-run: "${{ github.event_name != 'workflow_dispatch' }}"
+

.github/workflows/script/check-node-modules.sh

@@ -1,20 +0,0 @@
-#!/bin/bash
-set -eu
-
-# Sanity check that repo is clean to start with
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then this workflow needs attention...
-    >&2 echo "Failed: Repo should be clean before testing!"
-    exit 1
-fi
-
-"$(dirname "$0")/update-node-modules.sh" check-only
-
-# Check that repo is still clean
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then the PR needs attention
-    >&2 echo "Failed: node_modules are not up to date. Add the 'Update dependencies' label to your PR to update them. Note it is important that node modules are updated on macOS and not any other operating system as there is one dependency (fsevents) that is needed for macOS and may not be installed if dependencies are updated on a Windows or Linux machine."
-    git status
-    exit 1
-fi
-echo "Success: node_modules are up to date"

.github/workflows/script/prepare_changelog.py

@@ -12,7 +12,7 @@ def extract_changelog_snippet(changelog_file, version_tag):
     output = EMPTY_CHANGELOG
 
   else:
-    with open('CHANGELOG.md', 'r') as f:
+    with open(changelog_file, 'r') as f:
       lines = f.readlines()
 
       # Include everything up to, but excluding the second heading

.github/workflows/script/rollback_changelog.py

@@ -0,0 +1,62 @@
+import datetime
+import os
+import argparse
+
+EMPTY_CHANGELOG = """# CodeQL Action Changelog
+
+"""
+
+def get_today_string():
+  today = datetime.datetime.today()
+  return '{:%d %b %Y}'.format(today)
+
+# Include everything up to and after the first heading,
+# but not the first heading and body.
+def drop_unreleased_section(lines: list[str]):
+  before_first_section = ''
+  after_first_section = ''
+  found_first_section = False
+  skipped_first_section = False
+
+  for i, line in enumerate(lines):
+    if line.startswith('## ') and not found_first_section:
+      found_first_section = True
+    elif line.startswith('## ') and found_first_section:
+      skipped_first_section = True
+
+    if not found_first_section:
+      before_first_section += line
+    if skipped_first_section:
+      after_first_section += line
+
+  return (before_first_section, after_first_section)
+
+def update_changelog(target_version, rollback_version, new_version):
+  before_first_section = EMPTY_CHANGELOG
+  after_first_section = ''
+
+  if (os.path.exists('CHANGELOG.md')):
+    with open('CHANGELOG.md', 'r') as f:
+      (before_first_section, after_first_section) = drop_unreleased_section(f.readlines())
+
+  newHeader = f'## {new_version} - {get_today_string()}\n'
+
+  print(before_first_section, end="")
+  print(newHeader)
+  print(f"This release rolls back {rollback_version} due to issues with that release. It is identical to {target_version}.\n")
+  print(after_first_section)
+
+# We expect three version strings as input:
+#
+# - target_version: the version that we are re-releasing as `new_version`
+# - rollback_version: the version that we are rolling back, typically the one that followed `target_version`
+# - new_version: the new version that we are releasing `target_version` as, typically the one that follows `rollback_version`
+#
+# Example: python3 .github/workflows/script/rollback_changelog.py --target-version "1.2.3" --rollback-version "1.2.4" --new-version "1.2.5"
+parser = argparse.ArgumentParser(description="Update CHANGELOG.md for a rollback release.")
+parser.add_argument("--target-version", "-t", required=True, help="Version to re-release as new_version.")
+parser.add_argument("--rollback-version", "-r", required=True, help="Version being rolled back.")
+parser.add_argument("--new-version", "-n", required=True, help="New version to publish for target_version.")
+args = parser.parse_args()
+
+update_changelog(args.target_version, args.rollback_version, args.new_version)

.github/workflows/script/update-node-modules.sh

@@ -1,21 +0,0 @@
-#!/bin/bash
-set -eu
-
-if [ "$1" != "update" ] && [ "$1" != "check-only" ]; then
-    >&2 echo "Failed: Invalid argument. Must be 'update' or 'check-only'"
-    exit 1
-fi
-
-npm install --force -g npm@9.2.0
-
-# clean the npm cache to ensure we don't have any files owned by root
-sudo npm cache clean --force
-
-if [ "$1" = "update" ]; then
-    npm install
-fi
-
-# Reinstall modules and then clean to remove absolute paths
-# Use 'npm ci' instead of 'npm install' as this is intended to be reproducible
-npm ci
-npm run removeNPMAbsolutePaths

.github/workflows/script/update-required-checks.sh

@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 # Update the required checks based on the current branch.
-# Typically, this will be main.
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 REPO_DIR="$(dirname "$SCRIPT_DIR")"

.github/workflows/update-bundle.yml

@@ -36,6 +36,15 @@ jobs:
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
       - name: Update bundle
         uses: ./.github/actions/update-bundle
 

.github/workflows/update-dependencies.yml

@@ -1,45 +0,0 @@
-name: Update dependencies
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, ready_for_review, labeled]
-
-jobs:
-  update:
-    name: Update dependencies
-    timeout-minutes: 45
-    runs-on: macos-latest
-    if: contains(github.event.pull_request.labels.*.name, 'Update dependencies') && (github.event.pull_request.head.repo.full_name == 'github/codeql-action')
-    permissions:
-      contents: write # needed to push the updated dependencies
-      pull-requests: write # needed to comment on the PR
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v5
-
-    - name: Remove PR label
-      env:
-        GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-        REPOSITORY: '${{ github.repository }}'
-        PR_NUMBER: '${{ github.event.pull_request.number }}'
-      run: |
-        gh api "repos/$REPOSITORY/issues/$PR_NUMBER/labels/Update%20dependencies" -X DELETE
-
-    - name: Push updated dependencies
-      env:
-        BRANCH: '${{ github.head_ref }}'
-        GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-      run: |
-        git fetch origin "$BRANCH" --depth=1
-        git checkout "origin/$BRANCH"
-        .github/workflows/script/update-node-modules.sh update
-        if [ ! -z "$(git status --porcelain)" ]; then
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-          git add node_modules
-          git commit -am "Update checked-in dependencies"
-          git push origin "HEAD:$BRANCH"
-          echo "Pushed a commit to update the checked-in dependencies." \
-            "Please mark the PR as ready for review to trigger PR checks." |
-            gh pr comment --body-file - --repo github/codeql-action "${{ github.event.pull_request.number }}"
-          gh pr ready --undo --repo github/codeql-action "${{ github.event.pull_request.number }}"
-        fi

.github/workflows/update-release-branch.yml

@@ -14,46 +14,11 @@ on:
 jobs:
 
   prepare:
-    runs-on: ubuntu-latest
-    if: github.repository == 'github/codeql-action'
-    outputs:
-      version: ${{ steps.versions.outputs.version }}
-      major_version: ${{ steps.versions.outputs.major_version }}
-      latest_tag: ${{ steps.versions.outputs.latest_tag }}
-      backport_source_branch: ${{ steps.branches.outputs.backport_source_branch }}
-      backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}
+    name: "Prepare release"
     permissions:
       contents: read
-    steps:
-    - uses: actions/checkout@v5
-      with:
-        fetch-depth: 0  # Need full history for calculation of diffs
-    - uses: ./.github/actions/release-initialise
 
-    - name: Get version tags
-      id: versions
-      run: |
-        VERSION="v$(jq '.version' -r 'package.json')"
-        echo "version=${VERSION}" >> $GITHUB_OUTPUT
-        MAJOR_VERSION=$(cut -d '.' -f1 <<< "${VERSION}")
-        echo "major_version=${MAJOR_VERSION}" >> $GITHUB_OUTPUT
-        LATEST_TAG=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-        echo "latest_tag=${LATEST_TAG}" >> $GITHUB_OUTPUT
-
-    - id: branches
-      name: Determine older release branches
-      uses: ./.github/actions/release-branches
-      with:
-        major_version: ${{ steps.versions.outputs.major_version }}
-        latest_tag: ${{ steps.versions.outputs.latest_tag }}
-
-    - name: debug logging
-      run: |
-        echo 'version: ${{ steps.versions.outputs.version }}'
-        echo 'major_version: ${{ steps.versions.outputs.major_version }}'
-        echo 'latest_tag: ${{ steps.versions.outputs.latest_tag }}'
-        echo 'backport_source_branch: ${{ steps.branches.outputs.backport_source_branch }}'
-        echo 'backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}'
+    uses: ./.github/workflows/prepare-release.yml
 
   update:
     timeout-minutes: 45

.gitignore

@@ -1,5 +1,7 @@
-# Ignore for example failing-tests.json from AVA
-node_modules/.cache/
+# Dependency directories
+node_modules/
+# Build output for tests
+build/
 # Java build files
 .gradle/
 *.class
@@ -8,4 +10,4 @@ node_modules/.cache/
 # eslint sarif report
 eslint.sarif
 # for local incremental compilation
-tsconfig.tsbuildinfo
+tsconfig.tsbuildinfo

.vscode/settings.json

@@ -5,6 +5,7 @@
     "**/.DS_Store": true,
 
     // transpiled JavaScript
+    "build": true,
     "lib": true,
   },
   // Installing a new Node package often triggers VS Code's git limit warnings as there is typically

CHANGELOG.md

@@ -4,8 +4,29 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
+- We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the `codeql-action/init` step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the `codeql-action/init` step. [#3099](https://github.com/github/codeql-action/pull/3099) and [#3100](https://github.com/github/codeql-action/pull/3100)
+
+## 3.30.3 - 10 Sep 2025
+
 No user facing changes.
 
+## 3.30.2 - 09 Sep 2025
+
+- Fixed a bug which could cause language autodetection to fail. [#3084](https://github.com/github/codeql-action/pull/3084)
+- Experimental: The `quality-queries` input that was added in `3.29.2` as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new `analysis-kinds` input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. [#3064](https://github.com/github/codeql-action/pull/3064)
+
+## 3.30.1 - 05 Sep 2025
+
+- Update default CodeQL bundle version to 2.23.0. [#3077](https://github.com/github/codeql-action/pull/3077)
+
+## 3.30.0 - 01 Sep 2025
+
+- Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. [#3054](https://github.com/github/codeql-action/pull/3054)
+
+## 3.29.11 - 21 Aug 2025
+
+- Update default CodeQL bundle version to 2.22.4. [#3044](https://github.com/github/codeql-action/pull/3044)
+
 ## 3.29.10 - 18 Aug 2025
 
 No user facing changes.

CONTRIBUTING.md

@@ -25,11 +25,9 @@ This project also includes configuration to run tests from VSCode (with support
 
 You may want to run `tsc --watch` from the command line or inside of vscode in order to ensure build artifacts are up to date as you are working.
 
-### Checking in compiled artifacts and `node_modules`
+### Checking in compiled artifacts
 
-Because CodeQL Action users consume the code directly from this repository, and there can be no build step during a GitHub Actions run, this repository contains all compiled artifacts and node modules. There is a PR check that will fail if any of the compiled artifacts are not up to date. Compiled artifacts are stored in the `lib/` directory. For all day-to-day development purposes, this folder can be ignored.
-
-Only run `npm install` if you are explicitly changing the set of dependencies in `package.json`. The `node_modules` directory should be up to date when you check out, but if for some reason, there is an inconsistency use `npm ci && npm run removeNPMAbsolutePaths` to ensure the directory is in a state consistent with the `package-lock.json`. Note that due to a macOS-specific dependency, this command should be run on a macOS machine. There is a PR check to ensure the consistency of the `node_modules` directory.
+Because CodeQL Action users consume the code directly from this repository, and there can be no build step during a GitHub Actions run, this repository contains all compiled artifacts. There is a PR check that will fail if any of the compiled artifacts are not up to date. Compiled artifacts are stored in the `lib/` directory. For all day-to-day development purposes, this folder can be ignored.
 
 ### Running the action
 
@@ -41,10 +39,10 @@ As well as the unit tests (see _Common tasks_ above), there are integration test
 
 ## Submitting a pull request
 
-1. [Fork][fork] and clone the repository
-2. Create a new branch: `git checkout -b my-branch-name`
-3. Make your change, add tests, and make sure the tests still pass
-4. Push to your fork and [submit a pull request][pr]
+1. [Fork][fork] and clone the repository.
+2. Create a new branch: `git checkout -b my-branch-name`.
+3. Make your change, add tests, and make sure the tests still pass. Ensure that you have run `npm run build` and committed any changes to the compiled artifacts.
+4. Push to your fork and [submit a pull request][pr].
 5. Pat yourself on the back and wait for your pull request to be reviewed and merged.
 
 If you're a GitHub staff member, you can merge your own PR once it's approved; for external contributors, GitHub staff will merge your PR once it's approved.
@@ -62,7 +60,7 @@ Here are a few things you can do that will increase the likelihood of your pull
 
     You can start a release by triggering this workflow via [workflow dispatch](https://github.com/github/codeql-action/actions/workflows/update-release-branch.yml).
 1. The workflow run will open a pull request titled "Merge main into releases/v3". Follow the steps on the checklist in the pull request. Once you've checked off all but the last two of these, approve the PR and automerge it.
-1. When the "Merge main into releases/v3" pull request is merged into the `releases/v3` branch, a mergeback pull request to `main` will be automatically created. This mergeback pull request incorporates the changelog updates into `main`, tags the release using the merge commit of the "Merge main into releases/v3" pull request, and bumps the patch version of the CodeQL Action. 
+1. When the "Merge main into releases/v3" pull request is merged into the `releases/v3` branch, a mergeback pull request to `main` will be automatically created. This mergeback pull request incorporates the changelog updates into `main`, tags the release using the merge commit of the "Merge main into releases/v3" pull request, and bumps the patch version of the CodeQL Action.
 1. If a backport to an older major version is required, a pull request targeting that version's branch will also be automatically created.
 1. Approve the mergeback and backport pull request (if applicable) and automerge them.
 
@@ -70,11 +68,12 @@ Once the mergeback and backport pull request have been merged, the release is co
 
 ## Keeping the PR checks up to date (admin access required)
 
-Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred jobs that need to pass in order for a PR to turn green. You can regenerate the checks automatically by running the [update-required-checks.sh](.github/workflows/script/update-required-checks.sh) script:
+Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred required jobs that need to pass in order for a PR to turn green. It would be too tedious to maintain that list manually. You can regenerate the set of required checks automatically by running the [update-required-checks.sh](.github/workflows/script/update-required-checks.sh) script:
 
-1. By default, this script retrieves the checks from the latest SHA on `main`, so make sure that your `main` branch is up to date.
-2. Run the script. If there's a reason to, you can pass in a different SHA as a CLI argument.
-3. After running, go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules for `main`, `v3`, and any other currently supported major versions have been updated.
+- If you run the script without an argument, it will retrieve the set of workflows that ran for the latest commit on `main`. Make sure that your local `main` branch is up to date before running the script.
+- You can specify a commit SHA as argument to retrieve the set of workflows for that commit instead. You will likely want to use this if you have a PR that removes or adds PR checks.
+
+After running, go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules for `main`, `v3`, and any other currently supported major versions have been updated.
 
 Note that any updates to checks on `main` need to be backported to all currently supported major version branches, in order to maintain the same set of names for required checks.
 

build.mjs

@@ -0,0 +1,75 @@
+import { copyFile, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import * as esbuild from "esbuild";
+import { globSync } from "glob";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+const SRC_DIR = join(__dirname, "src");
+const OUT_DIR = join(__dirname, "lib");
+
+/**
+ * Clean the output directory before building.
+ * 
+ * @type {esbuild.Plugin}
+ */
+const cleanPlugin = {
+  name: "clean",
+  setup(build) {
+    build.onStart(async () => {
+      await rm(OUT_DIR, { recursive: true, force: true });
+    });
+  },
+};
+
+/**
+ * Copy defaults.json to the output directory since other projects depend on it.
+ * 
+ * @type {esbuild.Plugin}
+ */
+const copyDefaultsPlugin = {
+  name: "copy-defaults",
+  setup(build) {
+    build.onEnd(async () => {
+      await rm(join(OUT_DIR, "defaults.json"), {
+        force: true,
+      });
+      await copyFile(
+        join(SRC_DIR, "defaults.json"),
+        join(OUT_DIR, "defaults.json"),
+      );
+    });
+  },
+};
+
+/**
+ * Log when the build ends.
+ *
+ * @type {esbuild.Plugin}
+ */
+const onEndPlugin = {
+  name: "on-end",
+  setup(build) {
+    build.onEnd((result) => {
+      // eslint-disable-next-line no-console
+      console.log(`Build ended with ${result.errors.length} errors`);
+    });
+  },
+};
+
+const context = await esbuild.context({
+  // Include upload-lib.ts as an entry point for use in testing environments.
+  entryPoints: globSync([`${SRC_DIR}/*-action.ts`, `${SRC_DIR}/*-action-post.ts`, "src/upload-lib.ts"]),
+  bundle: true,
+  format: "cjs",
+  outdir: OUT_DIR,
+  platform: "node",
+  plugins: [cleanPlugin, copyDefaultsPlugin, onEndPlugin],
+  target: ["node20"],
+});
+
+await context.rebuild();
+await context.dispose();

eslint.config.mjs

@@ -26,9 +26,11 @@ export default [
   {
     ignores: [
       "**/webpack.config.js",
+      "build/**/*",
       "lib/**/*",
       "src/testdata/**/*",
       "tests/**/*",
+      "build.mjs",
       "eslint.config.mjs",
       ".github/**/*",
     ],
@@ -74,7 +76,7 @@ export default [
 
         typescript: {},
       },
-      "import/ignore": ["sinon", "uuid", "@octokit/plugin-retry"],
+      "import/ignore": ["sinon", "uuid", "@octokit/plugin-retry", "del", "get-folder-size"],
     },
 
     rules: {

init/action.yml

@@ -42,6 +42,19 @@ inputs:
                      your workflow between the `init` and `analyze` steps. Available for all
                      compiled languages.
     required: false
+  analysis-kinds:
+    description: >-
+      [Internal] A comma-separated list of analysis kinds to enable. This input is intended for
+      internal-use only at this time and the behaviour is subject to changes. Some features may
+      not be available depending on which analysis kinds are enabled.
+
+      Available options are:
+
+      - `code-scanning`: The default, security-focused analysis.
+      - `code-quality`: Analysis focused on code quality. This must be enabled in conjunction
+                        with `code-scanning`.
+    default: 'code-scanning'
+    required: true
   token:
     description: GitHub token to use for authenticating with this instance of GitHub. To download custom packs from multiple registries, use the registries input.
     default: ${{ github.token }}
@@ -84,7 +97,7 @@ inputs:
     description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
     required: false
   quality-queries:
-    description: '[Internal] Comma-separated list of code quality queries to run.'
+    description: '[Internal] DEPRECATED. Comma-separated list of code quality queries to run.'
     required: false
   packs:
     description: >-

lib/actions-util.js

@@ -1,430 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.restoreInputs = exports.persistInputs = exports.CommandInvocationError = exports.getFileType = exports.FileCmdNotFoundError = exports.getOptionalInput = exports.getRequiredInput = void 0;
-exports.getTemporaryDirectory = getTemporaryDirectory;
-exports.getActionVersion = getActionVersion;
-exports.getWorkflowEventName = getWorkflowEventName;
-exports.isRunningLocalAction = isRunningLocalAction;
-exports.getRelativeScriptPath = getRelativeScriptPath;
-exports.getWorkflowEvent = getWorkflowEvent;
-exports.printDebugLogs = printDebugLogs;
-exports.getUploadValue = getUploadValue;
-exports.getWorkflowRunID = getWorkflowRunID;
-exports.getWorkflowRunAttempt = getWorkflowRunAttempt;
-exports.isSelfHostedRunner = isSelfHostedRunner;
-exports.isDefaultSetup = isDefaultSetup;
-exports.prettyPrintInvocation = prettyPrintInvocation;
-exports.ensureEndsInPeriod = ensureEndsInPeriod;
-exports.runTool = runTool;
-exports.getPullRequestBranches = getPullRequestBranches;
-exports.isAnalyzingPullRequest = isAnalyzingPullRequest;
-exports.fixCodeQualityCategory = fixCodeQualityCategory;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const core = __importStar(require("@actions/core"));
-const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
-const github = __importStar(require("@actions/github"));
-const io = __importStar(require("@actions/io"));
-const util_1 = require("./util");
-// eslint-disable-next-line import/no-commonjs, @typescript-eslint/no-require-imports
-const pkg = require("../package.json");
-/**
- * Wrapper around core.getInput for inputs that always have a value.
- * Also see getOptionalInput.
- *
- * This allows us to get stronger type checking of required/optional inputs.
- */
-const getRequiredInput = function (name) {
-    const value = core.getInput(name);
-    if (!value) {
-        throw new util_1.ConfigurationError(`Input required and not supplied: ${name}`);
-    }
-    return value;
-};
-exports.getRequiredInput = getRequiredInput;
-/**
- * Wrapper around core.getInput that converts empty inputs to undefined.
- * Also see getRequiredInput.
- *
- * This allows us to get stronger type checking of required/optional inputs.
- */
-const getOptionalInput = function (name) {
-    const value = core.getInput(name);
-    return value.length > 0 ? value : undefined;
-};
-exports.getOptionalInput = getOptionalInput;
-function getTemporaryDirectory() {
-    const value = process.env["CODEQL_ACTION_TEMP"];
-    return value !== undefined && value !== ""
-        ? value
-        : (0, util_1.getRequiredEnvParam)("RUNNER_TEMP");
-}
-function getActionVersion() {
-    return pkg.version;
-}
-/**
- * Returns the name of the event that triggered this workflow.
- *
- * This will be "dynamic" for default setup workflow runs.
- */
-function getWorkflowEventName() {
-    return (0, util_1.getRequiredEnvParam)("GITHUB_EVENT_NAME");
-}
-/**
- * Returns whether the current workflow is executing a local copy of the Action, e.g. we're running
- * a workflow on the codeql-action repo itself.
- */
-function isRunningLocalAction() {
-    const relativeScriptPath = getRelativeScriptPath();
-    return (relativeScriptPath.startsWith("..") || path.isAbsolute(relativeScriptPath));
-}
-/**
- * Get the location where the Action is running from.
- *
- * This can be used to get the Action's name or tell if we're running a local Action.
- */
-function getRelativeScriptPath() {
-    const runnerTemp = (0, util_1.getRequiredEnvParam)("RUNNER_TEMP");
-    const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
-    return path.relative(actionsDirectory, __filename);
-}
-/** Returns the contents of `GITHUB_EVENT_PATH` as a JSON object. */
-function getWorkflowEvent() {
-    const eventJsonFile = (0, util_1.getRequiredEnvParam)("GITHUB_EVENT_PATH");
-    try {
-        return JSON.parse(fs.readFileSync(eventJsonFile, "utf-8"));
-    }
-    catch (e) {
-        throw new Error(`Unable to read workflow event JSON from ${eventJsonFile}: ${e}`);
-    }
-}
-async function printDebugLogs(config) {
-    for (const language of config.languages) {
-        const databaseDirectory = (0, util_1.getCodeQLDatabasePath)(config, language);
-        const logsDirectory = path.join(databaseDirectory, "log");
-        if (!(0, util_1.doesDirectoryExist)(logsDirectory)) {
-            core.info(`Directory ${logsDirectory} does not exist.`);
-            continue; // Skip this language database.
-        }
-        const walkLogFiles = (dir) => {
-            const entries = fs.readdirSync(dir, { withFileTypes: true });
-            if (entries.length === 0) {
-                core.info(`No debug logs found at directory ${logsDirectory}.`);
-            }
-            for (const entry of entries) {
-                if (entry.isFile()) {
-                    const absolutePath = path.resolve(dir, entry.name);
-                    core.startGroup(`CodeQL Debug Logs - ${language} - ${entry.name} from file at path ${absolutePath}`);
-                    process.stdout.write(fs.readFileSync(absolutePath));
-                    core.endGroup();
-                }
-                else if (entry.isDirectory()) {
-                    walkLogFiles(path.resolve(dir, entry.name));
-                }
-            }
-        };
-        walkLogFiles(logsDirectory);
-    }
-}
-/**
- * Parses the `upload` input into an `UploadKind`, converting unspecified and deprecated upload
- * inputs appropriately.
- */
-function getUploadValue(input) {
-    switch (input) {
-        case undefined:
-        case "true":
-        case "always":
-            return "always";
-        case "false":
-        case "failure-only":
-            return "failure-only";
-        case "never":
-            return "never";
-        default:
-            core.warning(`Unrecognized 'upload' input to 'analyze' Action: ${input}. Defaulting to 'always'.`);
-            return "always";
-    }
-}
-/**
- * Get the workflow run ID.
- */
-function getWorkflowRunID() {
-    const workflowRunIdString = (0, util_1.getRequiredEnvParam)("GITHUB_RUN_ID");
-    const workflowRunID = parseInt(workflowRunIdString, 10);
-    if (Number.isNaN(workflowRunID)) {
-        throw new Error(`GITHUB_RUN_ID must define a non NaN workflow run ID. Current value is ${workflowRunIdString}`);
-    }
-    if (workflowRunID < 0) {
-        throw new Error(`GITHUB_RUN_ID must be a non-negative integer. Current value is ${workflowRunIdString}`);
-    }
-    return workflowRunID;
-}
-/**
- * Get the workflow run attempt number.
- */
-function getWorkflowRunAttempt() {
-    const workflowRunAttemptString = (0, util_1.getRequiredEnvParam)("GITHUB_RUN_ATTEMPT");
-    const workflowRunAttempt = parseInt(workflowRunAttemptString, 10);
-    if (Number.isNaN(workflowRunAttempt)) {
-        throw new Error(`GITHUB_RUN_ATTEMPT must define a non NaN workflow run attempt. Current value is ${workflowRunAttemptString}`);
-    }
-    if (workflowRunAttempt <= 0) {
-        throw new Error(`GITHUB_RUN_ATTEMPT must be a positive integer. Current value is ${workflowRunAttemptString}`);
-    }
-    return workflowRunAttempt;
-}
-class FileCmdNotFoundError extends Error {
-    constructor(msg) {
-        super(msg);
-        this.name = "FileCmdNotFoundError";
-    }
-}
-exports.FileCmdNotFoundError = FileCmdNotFoundError;
-/**
- * Tries to obtain the output of the `file` command for the file at the specified path.
- * The output will vary depending on the type of `file`, which operating system we are running on, etc.
- */
-const getFileType = async (filePath) => {
-    let stderr = "";
-    let stdout = "";
-    let fileCmdPath;
-    try {
-        fileCmdPath = await io.which("file", true);
-    }
-    catch (e) {
-        throw new FileCmdNotFoundError(`The \`file\` program is required, but does not appear to be installed. Please install it: ${e}`);
-    }
-    try {
-        // The `file` command will output information about the type of file pointed at by `filePath`.
-        // For binary files, this may include e.g. whether they are static of dynamic binaries.
-        // The `-L` switch instructs the command to follow symbolic links.
-        await new toolrunner.ToolRunner(fileCmdPath, ["-L", filePath], {
-            silent: true,
-            listeners: {
-                stdout: (data) => {
-                    stdout += data.toString();
-                },
-                stderr: (data) => {
-                    stderr += data.toString();
-                },
-            },
-        }).exec();
-        return stdout.trim();
-    }
-    catch (e) {
-        core.info(`Could not determine type of ${filePath} from ${stdout}. ${stderr}`);
-        throw e;
-    }
-};
-exports.getFileType = getFileType;
-function isSelfHostedRunner() {
-    return process.env.RUNNER_ENVIRONMENT === "self-hosted";
-}
-/** Determines whether we are running in default setup. */
-function isDefaultSetup() {
-    return getWorkflowEventName() === "dynamic";
-}
-function prettyPrintInvocation(cmd, args) {
-    return [cmd, ...args].map((x) => (x.includes(" ") ? `'${x}'` : x)).join(" ");
-}
-/**
- * An error from a tool invocation, with associated exit code, stderr, etc.
- */
-class CommandInvocationError extends Error {
-    constructor(cmd, args, exitCode, stderr, stdout = "") {
-        const prettyCommand = prettyPrintInvocation(cmd, args);
-        const lastLine = ensureEndsInPeriod(stderr.trim().split("\n").pop()?.trim() || "n/a");
-        super(`Failed to run "${prettyCommand}". ` +
-            `Exit code was ${exitCode} and last log line was: ${lastLine} See the logs for more details.`);
-        this.cmd = cmd;
-        this.args = args;
-        this.exitCode = exitCode;
-        this.stderr = stderr;
-        this.stdout = stdout;
-    }
-}
-exports.CommandInvocationError = CommandInvocationError;
-function ensureEndsInPeriod(text) {
-    return text[text.length - 1] === "." ? text : `${text}.`;
-}
-/**
- * A constant defining the maximum number of characters we will keep from
- * the programs stderr for logging.
- *
- * This serves two purposes:
- * 1. It avoids an OOM if a program fails in a way that results it
- *    printing many log lines.
- * 2. It avoids us hitting the limit of how much data we can send in our
- *    status reports on GitHub.com.
- */
-const MAX_STDERR_BUFFER_SIZE = 20000;
-/**
- * Runs a CLI tool.
- *
- * @returns Standard output produced by the tool.
- * @throws A `CommandInvocationError` if the tool exits with a non-zero status code.
- */
-async function runTool(cmd, args = [], opts = {}) {
-    let stdout = "";
-    let stderr = "";
-    if (!opts.noStreamStdout) {
-        process.stdout.write(`[command]${cmd} ${args.join(" ")}\n`);
-    }
-    const exitCode = await new toolrunner.ToolRunner(cmd, args, {
-        ignoreReturnCode: true,
-        listeners: {
-            stdout: (data) => {
-                stdout += data.toString("utf8");
-                if (!opts.noStreamStdout) {
-                    process.stdout.write(data);
-                }
-            },
-            stderr: (data) => {
-                let readStartIndex = 0;
-                // If the error is too large, then we only take the last MAX_STDERR_BUFFER_SIZE characters
-                if (data.length - MAX_STDERR_BUFFER_SIZE > 0) {
-                    // Eg: if we have MAX_STDERR_BUFFER_SIZE the start index should be 2.
-                    readStartIndex = data.length - MAX_STDERR_BUFFER_SIZE + 1;
-                }
-                stderr += data.toString("utf8", readStartIndex);
-                // Mimic the standard behavior of the toolrunner by writing stderr to stdout
-                process.stdout.write(data);
-            },
-        },
-        silent: true,
-        ...(opts.stdin ? { input: Buffer.from(opts.stdin || "") } : {}),
-    }).exec();
-    if (exitCode !== 0) {
-        throw new CommandInvocationError(cmd, args, exitCode, stderr, stdout);
-    }
-    return stdout;
-}
-const persistedInputsKey = "persisted_inputs";
-/**
- * Persists all inputs to the action as state that can be retrieved later in the post-action.
- * This would be simplified if actions/runner#3514 is addressed.
- * https://github.com/actions/runner/issues/3514
- */
-const persistInputs = function () {
-    const inputEnvironmentVariables = Object.entries(process.env).filter(([name]) => name.startsWith("INPUT_"));
-    core.saveState(persistedInputsKey, JSON.stringify(inputEnvironmentVariables));
-};
-exports.persistInputs = persistInputs;
-/**
- * Restores all inputs to the action from the persisted state.
- */
-const restoreInputs = function () {
-    const persistedInputs = core.getState(persistedInputsKey);
-    if (persistedInputs) {
-        for (const [name, value] of JSON.parse(persistedInputs)) {
-            process.env[name] = value;
-        }
-    }
-};
-exports.restoreInputs = restoreInputs;
-/**
- * Returns the base and head branches of the pull request being analyzed.
- *
- * @returns the base and head branches of the pull request, or undefined if
- * we are not analyzing a pull request.
- */
-function getPullRequestBranches() {
-    const pullRequest = github.context.payload.pull_request;
-    if (pullRequest) {
-        return {
-            base: pullRequest.base.ref,
-            // We use the head label instead of the head ref here, because the head
-            // ref lacks owner information and by itself does not uniquely identify
-            // the head branch (which may be in a forked repository).
-            head: pullRequest.head.label,
-        };
-    }
-    // PR analysis under Default Setup does not have the pull_request context,
-    // but it should set CODE_SCANNING_REF and CODE_SCANNING_BASE_BRANCH.
-    const codeScanningRef = process.env.CODE_SCANNING_REF;
-    const codeScanningBaseBranch = process.env.CODE_SCANNING_BASE_BRANCH;
-    if (codeScanningRef && codeScanningBaseBranch) {
-        return {
-            base: codeScanningBaseBranch,
-            // PR analysis under Default Setup analyzes the PR head commit instead of
-            // the merge commit, so we can use the provided ref directly.
-            head: codeScanningRef,
-        };
-    }
-    return undefined;
-}
-/**
- * Returns whether we are analyzing a pull request.
- */
-function isAnalyzingPullRequest() {
-    return getPullRequestBranches() !== undefined;
-}
-/**
- * A workaround for code quality to map category names from old default setup workflows
- * to ones that the code quality service expects.
- */
-const qualityCategoryMapping = {
-    "c#": "csharp",
-    cpp: "c-cpp",
-    c: "c-cpp",
-    "c++": "c-cpp",
-    java: "java-kotlin",
-    javascript: "javascript-typescript",
-    typescript: "javascript-typescript",
-    kotlin: "java-kotlin",
-};
-/** Adjusts the category string for a Code Quality SARIF file if an "old"
- * category identifier is used by Default Setup.
- */
-function fixCodeQualityCategory(logger, category) {
-    // The `category` should always be set by Default Setup. We perform this check
-    // to avoid potential issues if Code Quality supports Advanced Setup in the future
-    // and before this workaround is removed.
-    if (category !== undefined &&
-        isDefaultSetup() &&
-        category.startsWith("/language:")) {
-        const language = category.substring("/language:".length);
-        const mappedLanguage = qualityCategoryMapping[language];
-        if (mappedLanguage) {
-            const newCategory = `/language:${mappedLanguage}`;
-            logger.info(`Adjusted category for Code Quality from '${category}' to '${newCategory}'.`);
-            return newCategory;
-        }
-    }
-    return category;
-}
-//# sourceMappingURL=actions-util.js.map

lib/actions-util.test.js

@@ -1,192 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const github = __importStar(require("@actions/github"));
-const ava_1 = __importDefault(require("ava"));
-const actions_util_1 = require("./actions-util");
-const api_client_1 = require("./api-client");
-const environment_1 = require("./environment");
-const logging_1 = require("./logging");
-const testing_utils_1 = require("./testing-utils");
-const util_1 = require("./util");
-(0, testing_utils_1.setupTests)(ava_1.default);
-function withMockedContext(mockPayload, testFn) {
-    const originalPayload = github.context.payload;
-    github.context.payload = mockPayload;
-    try {
-        return testFn();
-    }
-    finally {
-        github.context.payload = originalPayload;
-    }
-}
-function withMockedEnv(envVars, testFn) {
-    const originalEnv = { ...process.env };
-    // Apply environment changes
-    for (const [key, value] of Object.entries(envVars)) {
-        if (value === undefined) {
-            delete process.env[key];
-        }
-        else {
-            process.env[key] = value;
-        }
-    }
-    try {
-        return testFn();
-    }
-    finally {
-        // Restore original environment
-        process.env = originalEnv;
-    }
-}
-(0, ava_1.default)("computeAutomationID()", async (t) => {
-    let actualAutomationID = (0, api_client_1.computeAutomationID)(".github/workflows/codeql-analysis.yml:analyze", '{"language": "javascript", "os": "linux"}');
-    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/language:javascript/os:linux/");
-    // check the environment sorting
-    actualAutomationID = (0, api_client_1.computeAutomationID)(".github/workflows/codeql-analysis.yml:analyze", '{"os": "linux", "language": "javascript"}');
-    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/language:javascript/os:linux/");
-    // check that an empty environment produces the right results
-    actualAutomationID = (0, api_client_1.computeAutomationID)(".github/workflows/codeql-analysis.yml:analyze", "{}");
-    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/");
-    // check non string environment values
-    actualAutomationID = (0, api_client_1.computeAutomationID)(".github/workflows/codeql-analysis.yml:analyze", '{"number": 1, "object": {"language": "javascript"}}');
-    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/number:/object:/");
-    // check undefined environment
-    actualAutomationID = (0, api_client_1.computeAutomationID)(".github/workflows/codeql-analysis.yml:analyze", undefined);
-    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/");
-});
-(0, ava_1.default)("getPullRequestBranches() with pull request context", (t) => {
-    withMockedContext({
-        pull_request: {
-            number: 123,
-            base: { ref: "main" },
-            head: { label: "user:feature-branch" },
-        },
-    }, () => {
-        t.deepEqual((0, actions_util_1.getPullRequestBranches)(), {
-            base: "main",
-            head: "user:feature-branch",
-        });
-        t.is((0, actions_util_1.isAnalyzingPullRequest)(), true);
-    });
-});
-(0, ava_1.default)("getPullRequestBranches() returns undefined with push context", (t) => {
-    withMockedContext({
-        push: {
-            ref: "refs/heads/main",
-        },
-    }, () => {
-        t.is((0, actions_util_1.getPullRequestBranches)(), undefined);
-        t.is((0, actions_util_1.isAnalyzingPullRequest)(), false);
-    });
-});
-(0, ava_1.default)("getPullRequestBranches() with Default Setup environment variables", (t) => {
-    withMockedContext({}, () => {
-        withMockedEnv({
-            CODE_SCANNING_REF: "refs/heads/feature-branch",
-            CODE_SCANNING_BASE_BRANCH: "main",
-        }, () => {
-            t.deepEqual((0, actions_util_1.getPullRequestBranches)(), {
-                base: "main",
-                head: "refs/heads/feature-branch",
-            });
-            t.is((0, actions_util_1.isAnalyzingPullRequest)(), true);
-        });
-    });
-});
-(0, ava_1.default)("getPullRequestBranches() returns undefined when only CODE_SCANNING_REF is set", (t) => {
-    withMockedContext({}, () => {
-        withMockedEnv({
-            CODE_SCANNING_REF: "refs/heads/feature-branch",
-            CODE_SCANNING_BASE_BRANCH: undefined,
-        }, () => {
-            t.is((0, actions_util_1.getPullRequestBranches)(), undefined);
-            t.is((0, actions_util_1.isAnalyzingPullRequest)(), false);
-        });
-    });
-});
-(0, ava_1.default)("getPullRequestBranches() returns undefined when only CODE_SCANNING_BASE_BRANCH is set", (t) => {
-    withMockedContext({}, () => {
-        withMockedEnv({
-            CODE_SCANNING_REF: undefined,
-            CODE_SCANNING_BASE_BRANCH: "main",
-        }, () => {
-            t.is((0, actions_util_1.getPullRequestBranches)(), undefined);
-            t.is((0, actions_util_1.isAnalyzingPullRequest)(), false);
-        });
-    });
-});
-(0, ava_1.default)("getPullRequestBranches() returns undefined when no PR context", (t) => {
-    withMockedContext({}, () => {
-        withMockedEnv({
-            CODE_SCANNING_REF: undefined,
-            CODE_SCANNING_BASE_BRANCH: undefined,
-        }, () => {
-            t.is((0, actions_util_1.getPullRequestBranches)(), undefined);
-            t.is((0, actions_util_1.isAnalyzingPullRequest)(), false);
-        });
-    });
-});
-(0, ava_1.default)("initializeEnvironment", (t) => {
-    (0, util_1.initializeEnvironment)("1.2.3");
-    t.deepEqual(process.env[environment_1.EnvVar.VERSION], "1.2.3");
-});
-(0, ava_1.default)("fixCodeQualityCategory", (t) => {
-    withMockedEnv({
-        GITHUB_EVENT_NAME: "dynamic",
-    }, () => {
-        const logger = (0, logging_1.getRunnerLogger)(true);
-        // Categories that should get adjusted.
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:c#"), "/language:csharp");
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:cpp"), "/language:c-cpp");
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:c"), "/language:c-cpp");
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:java"), "/language:java-kotlin");
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:javascript"), "/language:javascript-typescript");
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:typescript"), "/language:javascript-typescript");
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:kotlin"), "/language:java-kotlin");
-        // Categories that should not get adjusted.
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:csharp"), "/language:csharp");
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:go"), "/language:go");
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:actions"), "/language:actions");
-        // Other cases.
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, undefined), undefined);
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "random string"), "random string");
-        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "kotlin"), "kotlin");
-    });
-});
-//# sourceMappingURL=actions-util.test.js.map

lib/analyze-action-env.test.js

@@ -1,107 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const ava_1 = __importDefault(require("ava"));
-const sinon = __importStar(require("sinon"));
-const actionsUtil = __importStar(require("./actions-util"));
-const analyze = __importStar(require("./analyze"));
-const api = __importStar(require("./api-client"));
-const configUtils = __importStar(require("./config-utils"));
-const gitUtils = __importStar(require("./git-utils"));
-const statusReport = __importStar(require("./status-report"));
-const testing_utils_1 = require("./testing-utils");
-const util = __importStar(require("./util"));
-(0, testing_utils_1.setupTests)(ava_1.default);
-// This test needs to be in its own file so that ava would run it in its own
-// nodejs process. The code being tested is in analyze-action.ts, which runs
-// immediately on load. So the file needs to be loaded during part of the test,
-// and that can happen only once per nodejs process. If multiple such tests are
-// in the same test file, ava would run them in the same nodejs process, and all
-// but the first test would fail.
-(0, ava_1.default)("analyze action with RAM & threads from environment variables", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        process.env["GITHUB_SERVER_URL"] = util.GITHUB_DOTCOM_URL;
-        process.env["GITHUB_REPOSITORY"] = "github/codeql-action-fake-repository";
-        process.env["GITHUB_API_URL"] = "https://api.github.com";
-        sinon
-            .stub(statusReport, "createStatusReportBase")
-            .resolves({});
-        sinon.stub(statusReport, "sendStatusReport").resolves();
-        sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
-        const gitHubVersion = {
-            type: util.GitHubVariant.DOTCOM,
-        };
-        sinon.stub(configUtils, "getConfig").resolves({
-            gitHubVersion,
-            augmentationProperties: {},
-            languages: [],
-            packs: [],
-            trapCaches: {},
-        });
-        const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
-        requiredInputStub.withArgs("token").returns("fake-token");
-        requiredInputStub.withArgs("upload-database").returns("false");
-        requiredInputStub.withArgs("output").returns("out");
-        const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
-        optionalInputStub.withArgs("expect-error").returns("false");
-        sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, {});
-        // When there are no action inputs for RAM and threads, the action uses
-        // environment variables (passed down from the init action) to set RAM and
-        // threads usage.
-        process.env["CODEQL_THREADS"] = "-1";
-        process.env["CODEQL_RAM"] = "4992";
-        const runFinalizeStub = sinon.stub(analyze, "runFinalize");
-        const runQueriesStub = sinon.stub(analyze, "runQueries");
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const analyzeAction = require("./analyze-action");
-        // When analyze-action.ts loads, it runs an async function from the top
-        // level but does not wait for it to finish. To ensure that calls to
-        // runFinalize and runQueries are correctly captured by spies, we explicitly
-        // wait for the action promise to complete before starting verification.
-        await analyzeAction.runPromise;
-        t.assert(runFinalizeStub.calledOnce);
-        t.deepEqual(runFinalizeStub.firstCall.args[1], "--threads=-1");
-        t.deepEqual(runFinalizeStub.firstCall.args[2], "--ram=4992");
-        t.assert(runQueriesStub.calledOnce);
-        t.deepEqual(runQueriesStub.firstCall.args[3], "--threads=-1");
-        t.deepEqual(runQueriesStub.firstCall.args[1], "--ram=4992");
-    });
-});
-//# sourceMappingURL=analyze-action-env.test.js.map

lib/analyze-action-env.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"analyze-action-env.test.js","sourceRoot":"","sources":["../src/analyze-action-env.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,mDAAqC;AACrC,kDAAoC;AACpC,4DAA8C;AAC9C,sDAAwC;AACxC,8DAAgD;AAChD,mDAIyB;AACzB,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iCAAiC;AAEjC,IAAA,aAAI,EAAC,8DAA8D,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/E,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,sCAAsC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,wBAAwB,CAAC;QACzD,KAAK;aACF,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC;aAC5C,QAAQ,CAAC,EAAmC,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEhE,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,aAAa;YACb,sBAAsB,EAAE,EAAE;YAC1B,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;SACkB,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5D,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,0CAA0B,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpC,uEAAuE;QACvE,0EAA0E;QAC1E,iBAAiB;QACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;QAEnC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,iEAAiE;QACjE,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,aAAa,CAAC,UAAU,CAAC;QAE/B,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/analyze-action-input.test.js

@@ -1,107 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const ava_1 = __importDefault(require("ava"));
-const sinon = __importStar(require("sinon"));
-const actionsUtil = __importStar(require("./actions-util"));
-const analyze = __importStar(require("./analyze"));
-const api = __importStar(require("./api-client"));
-const configUtils = __importStar(require("./config-utils"));
-const gitUtils = __importStar(require("./git-utils"));
-const statusReport = __importStar(require("./status-report"));
-const testing_utils_1 = require("./testing-utils");
-const util = __importStar(require("./util"));
-(0, testing_utils_1.setupTests)(ava_1.default);
-// This test needs to be in its own file so that ava would run it in its own
-// nodejs process. The code being tested is in analyze-action.ts, which runs
-// immediately on load. So the file needs to be loaded during part of the test,
-// and that can happen only once per nodejs process. If multiple such tests are
-// in the same test file, ava would run them in the same nodejs process, and all
-// but the first test would fail.
-(0, ava_1.default)("analyze action with RAM & threads from action inputs", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        process.env["GITHUB_SERVER_URL"] = util.GITHUB_DOTCOM_URL;
-        process.env["GITHUB_REPOSITORY"] = "github/codeql-action-fake-repository";
-        process.env["GITHUB_API_URL"] = "https://api.github.com";
-        sinon
-            .stub(statusReport, "createStatusReportBase")
-            .resolves({});
-        sinon.stub(statusReport, "sendStatusReport").resolves();
-        const gitHubVersion = {
-            type: util.GitHubVariant.DOTCOM,
-        };
-        sinon.stub(configUtils, "getConfig").resolves({
-            gitHubVersion,
-            augmentationProperties: {},
-            languages: [],
-            packs: [],
-            trapCaches: {},
-        });
-        const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
-        requiredInputStub.withArgs("token").returns("fake-token");
-        requiredInputStub.withArgs("upload-database").returns("false");
-        requiredInputStub.withArgs("output").returns("out");
-        const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
-        optionalInputStub.withArgs("expect-error").returns("false");
-        sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
-        sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, {});
-        process.env["CODEQL_THREADS"] = "1";
-        process.env["CODEQL_RAM"] = "4992";
-        // Action inputs have precedence over environment variables.
-        optionalInputStub.withArgs("threads").returns("-1");
-        optionalInputStub.withArgs("ram").returns("3012");
-        const runFinalizeStub = sinon.stub(analyze, "runFinalize");
-        const runQueriesStub = sinon.stub(analyze, "runQueries");
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const analyzeAction = require("./analyze-action");
-        // When analyze-action.ts loads, it runs an async function from the top
-        // level but does not wait for it to finish. To ensure that calls to
-        // runFinalize and runQueries are correctly captured by spies, we explicitly
-        // wait for the action promise to complete before starting verification.
-        await analyzeAction.runPromise;
-        t.assert(runFinalizeStub.calledOnce);
-        t.deepEqual(runFinalizeStub.firstCall.args[1], "--threads=-1");
-        t.deepEqual(runFinalizeStub.firstCall.args[2], "--ram=3012");
-        t.assert(runQueriesStub.calledOnce);
-        t.deepEqual(runQueriesStub.firstCall.args[3], "--threads=-1");
-        t.deepEqual(runQueriesStub.firstCall.args[1], "--ram=3012");
-    });
-});
-//# sourceMappingURL=analyze-action-input.test.js.map

lib/analyze-action-input.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"analyze-action-input.test.js","sourceRoot":"","sources":["../src/analyze-action-input.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,mDAAqC;AACrC,kDAAoC;AACpC,4DAA8C;AAC9C,sDAAwC;AACxC,8DAAgD;AAChD,mDAIyB;AACzB,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iCAAiC;AAEjC,IAAA,aAAI,EAAC,sDAAsD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvE,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,sCAAsC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,wBAAwB,CAAC;QACzD,KAAK;aACF,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC;aAC5C,QAAQ,CAAC,EAAmC,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,aAAa;YACb,sBAAsB,EAAE,EAAE;YAC1B,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;SACkB,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChE,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,0CAA0B,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;QAEnC,4DAA4D;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,iEAAiE;QACjE,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,aAAa,CAAC,UAAU,CAAC;QAE/B,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/analyze-action-post.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"analyze-action-post.js","sourceRoot":"","sources":["../src/analyze-action-post.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;GAIG;AACH,uCAAyB;AAEzB,oDAAsC;AAEtC,4DAA8C;AAC9C,6CAAgD;AAChD,qCAAqC;AACrC,iDAA2C;AAC3C,kEAAoD;AACpD,6DAAgE;AAChE,+CAAuC;AACvC,uCAA6C;AAC7C,iCAAoE;AAEpE,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,WAAW,CAAC,aAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;QAClC,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAEjD,kFAAkF;QAClF,wFAAwF;QACxF,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAM,CAAC,mBAAmB,CAAC,KAAK,MAAM,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAS,EAC5B,WAAW,CAAC,qBAAqB,EAAE,EACnC,MAAM,CACP,CAAC;YACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1C,MAAM,cAAc,CAAC,4BAA4B,CAC/C,MAAM,EACN,MAAM,CAAC,aAAa,CAAC,IAAI,EACzB,OAAO,CAAC,OAAO,CAChB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,4EAA4E;QAC5E,+BAA+B;QAC/B,MAAM,qBAAqB,GAAG,IAAA,6CAAwB,GAAE,CAAC;QACzD,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CACT,2DAA2D,IAAA,sBAAe,EAAC,KAAK,CAAC,EAAE,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CACZ,oCAAoC,IAAA,sBAAe,EAAC,KAAK,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

lib/analyze.js

@@ -1,575 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.exportedForTesting = exports.defaultSuites = exports.CodeQLAnalysisError = void 0;
-exports.runExtraction = runExtraction;
-exports.dbIsFinalized = dbIsFinalized;
-exports.setupDiffInformedQueryRun = setupDiffInformedQueryRun;
-exports.resolveQuerySuiteAlias = resolveQuerySuiteAlias;
-exports.runQueries = runQueries;
-exports.runFinalize = runFinalize;
-exports.warnIfGoInstalledAfterInit = warnIfGoInstalledAfterInit;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const perf_hooks_1 = require("perf_hooks");
-const io = __importStar(require("@actions/io"));
-const del_1 = __importDefault(require("del"));
-const yaml = __importStar(require("js-yaml"));
-const actions_util_1 = require("./actions-util");
-const api_client_1 = require("./api-client");
-const autobuild_1 = require("./autobuild");
-const dependency_caching_1 = require("./dependency-caching");
-const diagnostics_1 = require("./diagnostics");
-const diff_informed_analysis_utils_1 = require("./diff-informed-analysis-utils");
-const environment_1 = require("./environment");
-const feature_flags_1 = require("./feature-flags");
-const languages_1 = require("./languages");
-const logging_1 = require("./logging");
-const overlay_database_utils_1 = require("./overlay-database-utils");
-const repository_1 = require("./repository");
-const tracer_config_1 = require("./tracer-config");
-const util = __importStar(require("./util"));
-const util_1 = require("./util");
-class CodeQLAnalysisError extends Error {
-    constructor(queriesStatusReport, message, error) {
-        super(message);
-        this.queriesStatusReport = queriesStatusReport;
-        this.message = message;
-        this.error = error;
-        this.name = "CodeQLAnalysisError";
-    }
-}
-exports.CodeQLAnalysisError = CodeQLAnalysisError;
-async function setupPythonExtractor(logger) {
-    const codeqlPython = process.env["CODEQL_PYTHON"];
-    if (codeqlPython === undefined || codeqlPython.length === 0) {
-        // If CODEQL_PYTHON is not set, no dependencies were installed, so we don't need to do anything
-        return;
-    }
-    logger.warning("The CODEQL_PYTHON environment variable is no longer supported. Please remove it from your workflow. This environment variable was originally used to specify a Python executable that included the dependencies of your Python code, however Python analysis no longer uses these dependencies." +
-        "\nIf you used CODEQL_PYTHON to force the version of Python to analyze as, please use CODEQL_EXTRACTOR_PYTHON_ANALYSIS_VERSION instead, such as 'CODEQL_EXTRACTOR_PYTHON_ANALYSIS_VERSION=2.7' or 'CODEQL_EXTRACTOR_PYTHON_ANALYSIS_VERSION=3.11'.");
-    return;
-}
-async function runExtraction(codeql, config, logger) {
-    for (const language of config.languages) {
-        if (dbIsFinalized(config, language, logger)) {
-            logger.debug(`Database for ${language} has already been finalized, skipping extraction.`);
-            continue;
-        }
-        if (await shouldExtractLanguage(codeql, config, language)) {
-            logger.startGroup(`Extracting ${language}`);
-            if (language === languages_1.KnownLanguage.python) {
-                await setupPythonExtractor(logger);
-            }
-            if (config.buildMode) {
-                if (language === languages_1.KnownLanguage.cpp &&
-                    config.buildMode === util_1.BuildMode.Autobuild) {
-                    await (0, autobuild_1.setupCppAutobuild)(codeql, logger);
-                }
-                // The Java `build-mode: none` extractor places dependencies (.jar files) in the
-                // database scratch directory by default. For dependency caching purposes, we want
-                // a stable path that caches can be restored into and that we can cache at the
-                // end of the workflow (i.e. that does not get removed when the scratch directory is).
-                if (language === languages_1.KnownLanguage.java &&
-                    config.buildMode === util_1.BuildMode.None) {
-                    process.env["CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS_DEPENDENCY_DIR"] =
-                        (0, dependency_caching_1.getJavaTempDependencyDir)();
-                }
-                await codeql.extractUsingBuildMode(config, language);
-            }
-            else {
-                await codeql.extractScannedLanguage(config, language);
-            }
-            logger.endGroup();
-        }
-    }
-}
-async function shouldExtractLanguage(codeql, config, language) {
-    return (config.buildMode === util_1.BuildMode.None ||
-        (config.buildMode === util_1.BuildMode.Autobuild &&
-            process.env[environment_1.EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY] !== "true") ||
-        (!config.buildMode && (await codeql.isScannedLanguage(language))));
-}
-function dbIsFinalized(config, language, logger) {
-    const dbPath = util.getCodeQLDatabasePath(config, language);
-    try {
-        const dbInfo = yaml.load(fs.readFileSync(path.resolve(dbPath, "codeql-database.yml"), "utf8"));
-        return !("inProgress" in dbInfo);
-    }
-    catch {
-        logger.warning(`Could not check whether database for ${language} was finalized. Assuming it is not.`);
-        return false;
-    }
-}
-async function finalizeDatabaseCreation(codeql, config, threadsFlag, memoryFlag, logger) {
-    const extractionStart = perf_hooks_1.performance.now();
-    await runExtraction(codeql, config, logger);
-    const extractionTime = perf_hooks_1.performance.now() - extractionStart;
-    const trapImportStart = perf_hooks_1.performance.now();
-    for (const language of config.languages) {
-        if (dbIsFinalized(config, language, logger)) {
-            logger.info(`There is already a finalized database for ${language} at the location where the CodeQL Action places databases, so we did not create one.`);
-        }
-        else {
-            logger.startGroup(`Finalizing ${language}`);
-            await codeql.finalizeDatabase(util.getCodeQLDatabasePath(config, language), threadsFlag, memoryFlag, config.debugMode);
-            logger.endGroup();
-        }
-    }
-    const trapImportTime = perf_hooks_1.performance.now() - trapImportStart;
-    return {
-        scanned_language_extraction_duration_ms: Math.round(extractionTime),
-        trap_import_duration_ms: Math.round(trapImportTime),
-    };
-}
-/**
- * Set up the diff-informed analysis feature.
- *
- * @returns Absolute path to the directory containing the extension pack for
- * the diff range information, or `undefined` if the feature is disabled.
- */
-async function setupDiffInformedQueryRun(branches, logger) {
-    return await (0, logging_1.withGroupAsync)("Generating diff range extension pack", async () => {
-        logger.info(`Calculating diff ranges for ${branches.base}...${branches.head}`);
-        const diffRanges = await getPullRequestEditedDiffRanges(branches, logger);
-        const packDir = writeDiffRangeDataExtensionPack(logger, diffRanges);
-        if (packDir === undefined) {
-            logger.warning("Cannot create diff range extension pack for diff-informed queries; " +
-                "reverting to performing full analysis.");
-        }
-        else {
-            logger.info(`Successfully created diff range extension pack at ${packDir}.`);
-        }
-        return packDir;
-    });
-}
-/**
- * Return the file line ranges that were added or modified in the pull request.
- *
- * @param branches The base and head branches of the pull request.
- * @param logger
- * @returns An array of tuples, where each tuple contains the absolute path of a
- * file, the start line and the end line (both 1-based and inclusive) of an
- * added or modified range in that file. Returns `undefined` if the action was
- * not triggered by a pull request or if there was an error.
- */
-async function getPullRequestEditedDiffRanges(branches, logger) {
-    const fileDiffs = await getFileDiffsWithBasehead(branches, logger);
-    if (fileDiffs === undefined) {
-        return undefined;
-    }
-    if (fileDiffs.length >= 300) {
-        // The "compare two commits" API returns a maximum of 300 changed files. If
-        // we see that many changed files, it is possible that there could be more,
-        // with the rest being truncated. In this case, we should not attempt to
-        // compute the diff ranges, as the result would be incomplete.
-        logger.warning(`Cannot retrieve the full diff because there are too many ` +
-            `(${fileDiffs.length}) changed files in the pull request.`);
-        return undefined;
-    }
-    const results = [];
-    for (const filediff of fileDiffs) {
-        const diffRanges = getDiffRanges(filediff, logger);
-        if (diffRanges === undefined) {
-            return undefined;
-        }
-        results.push(...diffRanges);
-    }
-    return results;
-}
-async function getFileDiffsWithBasehead(branches, logger) {
-    // Check CODE_SCANNING_REPOSITORY first. If it is empty or not set, fall back
-    // to GITHUB_REPOSITORY.
-    const repositoryNwo = (0, repository_1.getRepositoryNwoFromEnv)("CODE_SCANNING_REPOSITORY", "GITHUB_REPOSITORY");
-    const basehead = `${branches.base}...${branches.head}`;
-    try {
-        const response = await (0, api_client_1.getApiClient)().rest.repos.compareCommitsWithBasehead({
-            owner: repositoryNwo.owner,
-            repo: repositoryNwo.repo,
-            basehead,
-            per_page: 1,
-        });
-        logger.debug(`Response from compareCommitsWithBasehead(${basehead}):` +
-            `\n${JSON.stringify(response, null, 2)}`);
-        return response.data.files;
-    }
-    catch (error) {
-        if (error.status) {
-            logger.warning(`Error retrieving diff ${basehead}: ${error.message}`);
-            logger.debug(`Error running compareCommitsWithBasehead(${basehead}):` +
-                `\nRequest: ${JSON.stringify(error.request, null, 2)}` +
-                `\nError Response: ${JSON.stringify(error.response, null, 2)}`);
-            return undefined;
-        }
-        else {
-            throw error;
-        }
-    }
-}
-function getDiffRanges(fileDiff, logger) {
-    // Diff-informed queries expect the file path to be absolute. CodeQL always
-    // uses forward slashes as the path separator, so on Windows we need to
-    // replace any backslashes with forward slashes.
-    const filename = path
-        .join((0, actions_util_1.getRequiredInput)("checkout_path"), fileDiff.filename)
-        .replaceAll(path.sep, "/");
-    if (fileDiff.patch === undefined) {
-        if (fileDiff.changes === 0) {
-            // There are situations where a changed file legitimately has no diff.
-            // For example, the file may be a binary file, or that the file may have
-            // been renamed with no changes to its contents. In these cases, the
-            // file would be reported as having 0 changes, and we can return an empty
-            // array to indicate no diff range in this file.
-            return [];
-        }
-        // If a file is reported to have nonzero changes but no patch, that may be
-        // due to the file diff being too large. In this case, we should fall back
-        // to a special diff range that covers the entire file.
-        return [
-            {
-                path: filename,
-                startLine: 0,
-                endLine: 0,
-            },
-        ];
-    }
-    // The 1-based file line number of the current line
-    let currentLine = 0;
-    // The 1-based file line number that starts the current range of added lines
-    let additionRangeStartLine = undefined;
-    const diffRanges = [];
-    const diffLines = fileDiff.patch.split("\n");
-    // Adding a fake context line at the end ensures that the following loop will
-    // always terminate the last range of added lines.
-    diffLines.push(" ");
-    for (const diffLine of diffLines) {
-        if (diffLine.startsWith("-")) {
-            // Ignore deletions completely -- we do not even want to consider them when
-            // calculating consecutive ranges of added lines.
-            continue;
-        }
-        if (diffLine.startsWith("+")) {
-            if (additionRangeStartLine === undefined) {
-                additionRangeStartLine = currentLine;
-            }
-            currentLine++;
-            continue;
-        }
-        if (additionRangeStartLine !== undefined) {
-            // Any line that does not start with a "+" or "-" terminates the current
-            // range of added lines.
-            diffRanges.push({
-                path: filename,
-                startLine: additionRangeStartLine,
-                endLine: currentLine - 1,
-            });
-            additionRangeStartLine = undefined;
-        }
-        if (diffLine.startsWith("@@ ")) {
-            // A new hunk header line resets the current line number.
-            const match = diffLine.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
-            if (match === null) {
-                logger.warning(`Cannot parse diff hunk header for ${fileDiff.filename}: ${diffLine}`);
-                return undefined;
-            }
-            currentLine = parseInt(match[1], 10);
-            continue;
-        }
-        if (diffLine.startsWith(" ")) {
-            // An unchanged context line advances the current line number.
-            currentLine++;
-            continue;
-        }
-    }
-    return diffRanges;
-}
-/**
- * Create an extension pack in the temporary directory that contains the file
- * line ranges that were added or modified in the pull request.
- *
- * @param logger
- * @param ranges The file line ranges, as returned by
- * `getPullRequestEditedDiffRanges`.
- * @returns The absolute path of the directory containing the extension pack, or
- * `undefined` if no extension pack was created.
- */
-function writeDiffRangeDataExtensionPack(logger, ranges) {
-    if (ranges === undefined) {
-        return undefined;
-    }
-    if (ranges.length === 0) {
-        // An empty diff range means that there are no added or modified lines in
-        // the pull request. But the `restrictAlertsTo` extensible predicate
-        // interprets an empty data extension differently, as an indication that
-        // all alerts should be included. So we need to specifically set the diff
-        // range to a non-empty list that cannot match any alert location.
-        ranges = [{ path: "", startLine: 0, endLine: 0 }];
-    }
-    const diffRangeDir = path.join((0, actions_util_1.getTemporaryDirectory)(), "pr-diff-range");
-    // We expect the Actions temporary directory to already exist, so are mainly
-    // using `recursive: true` to avoid errors if the directory already exists,
-    // for example if the analyze Action is run multiple times in the same job.
-    // This is not really something that is supported, but we make use of it in
-    // tests.
-    fs.mkdirSync(diffRangeDir, { recursive: true });
-    fs.writeFileSync(path.join(diffRangeDir, "qlpack.yml"), `
-name: codeql-action/pr-diff-range
-version: 0.0.0
-library: true
-extensionTargets:
-  codeql/util: '*'
-dataExtensions:
-  - pr-diff-range.yml
-`);
-    const header = `
-extensions:
-  - addsTo:
-      pack: codeql/util
-      extensible: restrictAlertsTo
-      checkPresence: false
-    data:
-`;
-    let data = ranges
-        .map((range) => 
-    // Using yaml.dump() with `forceQuotes: true` ensures that all special
-    // characters are escaped, and that the path is always rendered as a
-    // quoted string on a single line.
-    `      - [${yaml.dump(range.path, { forceQuotes: true }).trim()}, ` +
-        `${range.startLine}, ${range.endLine}]\n`)
-        .join("");
-    if (!data) {
-        // Ensure that the data extension is not empty, so that a pull request with
-        // no edited lines would exclude (instead of accepting) all alerts.
-        data = '      - ["", 0, 0]\n';
-    }
-    const extensionContents = header + data;
-    const extensionFilePath = path.join(diffRangeDir, "pr-diff-range.yml");
-    fs.writeFileSync(extensionFilePath, extensionContents);
-    logger.debug(`Wrote pr-diff-range extension pack to ${extensionFilePath}:\n${extensionContents}`);
-    // Write the diff ranges to a JSON file, for action-side alert filtering by the
-    // upload-lib module.
-    (0, diff_informed_analysis_utils_1.writeDiffRangesJsonFile)(logger, ranges);
-    return diffRangeDir;
-}
-// A set of default query suite names that are understood by the CLI.
-exports.defaultSuites = new Set([
-    "security-experimental",
-    "security-extended",
-    "security-and-quality",
-    "code-quality",
-    "code-scanning",
-]);
-/**
- * If `maybeSuite` is the name of a default query suite, it is resolved into the corresponding
- * query suite name for the given `language`. Otherwise, `maybeSuite` is returned as is.
- *
- * @param language The language for which to resolve the default query suite name.
- * @param maybeSuite The string that potentially contains the name of a default query suite.
- * @returns Returns the resolved query suite name, or the unmodified input.
- */
-function resolveQuerySuiteAlias(language, maybeSuite) {
-    if (exports.defaultSuites.has(maybeSuite)) {
-        return `${language}-${maybeSuite}.qls`;
-    }
-    return maybeSuite;
-}
-// Runs queries and creates sarif files in the given folder
-async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag, diffRangePackDir, automationDetailsId, codeql, config, logger, features) {
-    const statusReport = {};
-    const queryFlags = [memoryFlag, threadsFlag];
-    const incrementalMode = [];
-    // Preserve cached intermediate results for overlay-base databases.
-    if (config.augmentationProperties.overlayDatabaseMode !==
-        overlay_database_utils_1.OverlayDatabaseMode.OverlayBase) {
-        queryFlags.push("--expect-discarded-cache");
-    }
-    statusReport.analysis_is_diff_informed = diffRangePackDir !== undefined;
-    if (diffRangePackDir) {
-        queryFlags.push(`--additional-packs=${diffRangePackDir}`);
-        queryFlags.push("--extension-packs=codeql-action/pr-diff-range");
-        incrementalMode.push("diff-informed");
-    }
-    statusReport.analysis_is_overlay =
-        config.augmentationProperties.overlayDatabaseMode ===
-            overlay_database_utils_1.OverlayDatabaseMode.Overlay;
-    statusReport.analysis_builds_overlay_base_database =
-        config.augmentationProperties.overlayDatabaseMode ===
-            overlay_database_utils_1.OverlayDatabaseMode.OverlayBase;
-    if (config.augmentationProperties.overlayDatabaseMode ===
-        overlay_database_utils_1.OverlayDatabaseMode.Overlay) {
-        incrementalMode.push("overlay");
-    }
-    const sarifRunPropertyFlag = incrementalMode.length > 0
-        ? `--sarif-run-property=incrementalMode=${incrementalMode.join(",")}`
-        : undefined;
-    for (const language of config.languages) {
-        try {
-            const sarifFile = path.join(sarifFolder, `${language}.sarif`);
-            const queries = [];
-            if (config.augmentationProperties.qualityQueriesInput !== undefined) {
-                queries.push(util.getGeneratedSuitePath(config, language));
-                for (const qualityQuery of config.augmentationProperties
-                    .qualityQueriesInput) {
-                    queries.push(resolveQuerySuiteAlias(language, qualityQuery.uses));
-                }
-            }
-            // The work needed to generate the query suites
-            // is done in the CLI. We just need to make a single
-            // call to run all the queries for each language and
-            // another to interpret the results.
-            logger.startGroup(`Running queries for ${language}`);
-            const startTimeRunQueries = new Date().getTime();
-            const databasePath = util.getCodeQLDatabasePath(config, language);
-            await codeql.databaseRunQueries(databasePath, queryFlags, queries);
-            logger.debug(`Finished running queries for ${language}.`);
-            // TODO should not be using `builtin` here. We should be using `all` instead.
-            // The status report does not support `all` yet.
-            statusReport[`analyze_builtin_queries_${language}_duration_ms`] =
-                new Date().getTime() - startTimeRunQueries;
-            logger.startGroup(`Interpreting results for ${language}`);
-            const startTimeInterpretResults = new Date();
-            const analysisSummary = await runInterpretResults(language, undefined, sarifFile, config.debugMode, automationDetailsId);
-            let qualityAnalysisSummary;
-            if (config.augmentationProperties.qualityQueriesInput !== undefined) {
-                logger.info(`Interpreting quality results for ${language}`);
-                const qualityCategory = (0, actions_util_1.fixCodeQualityCategory)(logger, automationDetailsId);
-                const qualitySarifFile = path.join(sarifFolder, `${language}.quality.sarif`);
-                qualityAnalysisSummary = await runInterpretResults(language, config.augmentationProperties.qualityQueriesInput.map((i) => resolveQuerySuiteAlias(language, i.uses)), qualitySarifFile, config.debugMode, qualityCategory);
-            }
-            const endTimeInterpretResults = new Date();
-            statusReport[`interpret_results_${language}_duration_ms`] =
-                endTimeInterpretResults.getTime() - startTimeInterpretResults.getTime();
-            logger.endGroup();
-            logger.info(analysisSummary);
-            if (qualityAnalysisSummary) {
-                logger.info(qualityAnalysisSummary);
-            }
-            if (await features.getValue(feature_flags_1.Feature.QaTelemetryEnabled)) {
-                const perQueryAlertCounts = getPerQueryAlertCounts(sarifFile);
-                const perQueryAlertCountEventReport = {
-                    event: "codeql database interpret-results",
-                    started_at: startTimeInterpretResults.toISOString(),
-                    completed_at: endTimeInterpretResults.toISOString(),
-                    exit_status: "success",
-                    language,
-                    properties: {
-                        alertCounts: perQueryAlertCounts,
-                    },
-                };
-                if (statusReport["event_reports"] === undefined) {
-                    statusReport["event_reports"] = [];
-                }
-                statusReport["event_reports"].push(perQueryAlertCountEventReport);
-            }
-        }
-        catch (e) {
-            statusReport.analyze_failure_language = language;
-            throw new CodeQLAnalysisError(statusReport, `Error running analysis for ${language}: ${util.getErrorMessage(e)}`, util.wrapError(e));
-        }
-    }
-    return statusReport;
-    async function runInterpretResults(language, queries, sarifFile, enableDebugLogging, category) {
-        const databasePath = util.getCodeQLDatabasePath(config, language);
-        return await codeql.databaseInterpretResults(databasePath, queries, sarifFile, addSnippetsFlag, threadsFlag, enableDebugLogging ? "-vv" : "-v", sarifRunPropertyFlag, category, config, features);
-    }
-    /** Get an object with all queries and their counts parsed from a SARIF file path. */
-    function getPerQueryAlertCounts(sarifPath) {
-        const sarifObject = JSON.parse(fs.readFileSync(sarifPath, "utf8"));
-        // We do not need to compute fingerprints because we are not sending data based off of locations.
-        // Generate the query: alert count object
-        const perQueryAlertCounts = {};
-        // All rules (queries), from all results, from all runs
-        for (const sarifRun of sarifObject.runs) {
-            if (sarifRun.results) {
-                for (const result of sarifRun.results) {
-                    const query = result.rule?.id || result.ruleId;
-                    if (query) {
-                        perQueryAlertCounts[query] = (perQueryAlertCounts[query] || 0) + 1;
-                    }
-                }
-            }
-        }
-        return perQueryAlertCounts;
-    }
-}
-async function runFinalize(outputDir, threadsFlag, memoryFlag, codeql, config, logger) {
-    try {
-        await (0, del_1.default)(outputDir, { force: true });
-    }
-    catch (error) {
-        if (error?.code !== "ENOENT") {
-            throw error;
-        }
-    }
-    await fs.promises.mkdir(outputDir, { recursive: true });
-    const timings = await finalizeDatabaseCreation(codeql, config, threadsFlag, memoryFlag, logger);
-    // If we didn't already end tracing in the autobuild Action, end it now.
-    if (process.env[environment_1.EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY] !== "true") {
-        await (0, tracer_config_1.endTracingForCluster)(codeql, config, logger);
-    }
-    return timings;
-}
-async function warnIfGoInstalledAfterInit(config, logger) {
-    // Check that `which go` still points at the same path it did when the `init` Action ran to ensure that no steps
-    // in-between performed any setup. We encourage users to perform all setup tasks before initializing CodeQL so that
-    // the setup tasks do not interfere with our analysis.
-    // Furthermore, if we installed a wrapper script in the `init` Action, we need to ensure that there isn't a step
-    // in the workflow after the `init` step which installs a different version of Go and takes precedence in the PATH,
-    // thus potentially circumventing our workaround that allows tracing to work.
-    const goInitPath = process.env[environment_1.EnvVar.GO_BINARY_LOCATION];
-    if (process.env[environment_1.EnvVar.DID_AUTOBUILD_GOLANG] !== "true" &&
-        goInitPath !== undefined) {
-        const goBinaryPath = await io.which("go", true);
-        if (goInitPath !== goBinaryPath) {
-            logger.warning(`Expected \`which go\` to return ${goInitPath}, but got ${goBinaryPath}: please ensure that the correct version of Go is installed before the \`codeql-action/init\` Action is used.`);
-            (0, diagnostics_1.addDiagnostic)(config, languages_1.KnownLanguage.go, (0, diagnostics_1.makeDiagnostic)("go/workflow/go-installed-after-codeql-init", "Go was installed after the `codeql-action/init` Action was run", {
-                markdownMessage: "To avoid interfering with the CodeQL analysis, perform all installation steps before calling the `github/codeql-action/init` Action.",
-                visibility: {
-                    statusPage: true,
-                    telemetry: true,
-                    cliSummaryTable: true,
-                },
-                severity: "warning",
-            }));
-        }
-    }
-}
-exports.exportedForTesting = {
-    getDiffRanges,
-};
-//# sourceMappingURL=analyze.js.map

lib/analyze.test.js

@@ -1,330 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const ava_1 = __importDefault(require("ava"));
-const sinon = __importStar(require("sinon"));
-const actionsUtil = __importStar(require("./actions-util"));
-const analyze_1 = require("./analyze");
-const codeql_1 = require("./codeql");
-const feature_flags_1 = require("./feature-flags");
-const languages_1 = require("./languages");
-const logging_1 = require("./logging");
-const testing_utils_1 = require("./testing-utils");
-const uploadLib = __importStar(require("./upload-lib"));
-const util = __importStar(require("./util"));
-(0, testing_utils_1.setupTests)(ava_1.default);
-/**
- * Checks the status report produced by the analyze Action.
- *
- * - Checks that the duration fields are populated for the correct language.
- * - Checks that the QA telemetry status report fields are populated when the QA feature flag is enabled.
- */
-(0, ava_1.default)("status report fields", async (t) => {
-    return await util.withTmpDir(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        const memoryFlag = "";
-        const addSnippetsFlag = "";
-        const threadsFlag = "";
-        sinon.stub(uploadLib, "validateSarifFileSchema");
-        for (const language of Object.values(languages_1.KnownLanguage)) {
-            const codeql = (0, codeql_1.createStubCodeQL)({
-                databaseRunQueries: async () => { },
-                databaseInterpretResults: async (_db, _queriesRun, sarifFile) => {
-                    fs.writeFileSync(sarifFile, JSON.stringify({
-                        runs: [
-                            // references a rule with the lines-of-code tag, so baseline should be injected
-                            {
-                                tool: {
-                                    extensions: [
-                                        {
-                                            rules: [
-                                                {
-                                                    properties: {
-                                                        tags: ["lines-of-code"],
-                                                    },
-                                                },
-                                            ],
-                                        },
-                                    ],
-                                },
-                                properties: {
-                                    metricResults: [
-                                        {
-                                            rule: {
-                                                index: 0,
-                                                toolComponent: {
-                                                    index: 0,
-                                                },
-                                            },
-                                            value: 123,
-                                        },
-                                    ],
-                                },
-                            },
-                            {},
-                        ],
-                    }));
-                    return "";
-                },
-                databasePrintBaseline: async () => "",
-            });
-            const config = (0, testing_utils_1.createTestConfig)({
-                languages: [language],
-                tempDir: tmpDir,
-                dbLocation: path.resolve(tmpDir, "codeql_databases"),
-            });
-            fs.mkdirSync(util.getCodeQLDatabasePath(config, language), {
-                recursive: true,
-            });
-            const statusReport = await (0, analyze_1.runQueries)(tmpDir, memoryFlag, addSnippetsFlag, threadsFlag, undefined, undefined, codeql, config, (0, logging_1.getRunnerLogger)(true), (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.QaTelemetryEnabled]));
-            t.deepEqual(Object.keys(statusReport).sort(), [
-                "analysis_builds_overlay_base_database",
-                "analysis_is_diff_informed",
-                "analysis_is_overlay",
-                `analyze_builtin_queries_${language}_duration_ms`,
-                "event_reports",
-                `interpret_results_${language}_duration_ms`,
-            ]);
-            for (const eventReport of statusReport.event_reports) {
-                t.deepEqual(eventReport.event, "codeql database interpret-results");
-                t.true("properties" in eventReport);
-                t.true("alertCounts" in eventReport.properties);
-            }
-        }
-    });
-});
-function runGetDiffRanges(changes, patch) {
-    sinon
-        .stub(actionsUtil, "getRequiredInput")
-        .withArgs("checkout_path")
-        .returns("/checkout/path");
-    return analyze_1.exportedForTesting.getDiffRanges({
-        filename: "test.txt",
-        changes,
-        patch: patch?.join("\n"),
-    }, (0, logging_1.getRunnerLogger)(true));
-}
-(0, ava_1.default)("getDiffRanges: file unchanged", async (t) => {
-    const diffRanges = runGetDiffRanges(0, undefined);
-    t.deepEqual(diffRanges, []);
-});
-(0, ava_1.default)("getDiffRanges: file diff too large", async (t) => {
-    const diffRanges = runGetDiffRanges(1000000, undefined);
-    t.deepEqual(diffRanges, [
-        {
-            path: "/checkout/path/test.txt",
-            startLine: 0,
-            endLine: 0,
-        },
-    ]);
-});
-(0, ava_1.default)("getDiffRanges: diff thunk with single addition range", async (t) => {
-    const diffRanges = runGetDiffRanges(2, [
-        "@@ -30,6 +50,8 @@",
-        " a",
-        " b",
-        " c",
-        "+1",
-        "+2",
-        " d",
-        " e",
-        " f",
-    ]);
-    t.deepEqual(diffRanges, [
-        {
-            path: "/checkout/path/test.txt",
-            startLine: 53,
-            endLine: 54,
-        },
-    ]);
-});
-(0, ava_1.default)("getDiffRanges: diff thunk with single deletion range", async (t) => {
-    const diffRanges = runGetDiffRanges(2, [
-        "@@ -30,8 +50,6 @@",
-        " a",
-        " b",
-        " c",
-        "-1",
-        "-2",
-        " d",
-        " e",
-        " f",
-    ]);
-    t.deepEqual(diffRanges, []);
-});
-(0, ava_1.default)("getDiffRanges: diff thunk with single update range", async (t) => {
-    const diffRanges = runGetDiffRanges(2, [
-        "@@ -30,7 +50,7 @@",
-        " a",
-        " b",
-        " c",
-        "-1",
-        "+2",
-        " d",
-        " e",
-        " f",
-    ]);
-    t.deepEqual(diffRanges, [
-        {
-            path: "/checkout/path/test.txt",
-            startLine: 53,
-            endLine: 53,
-        },
-    ]);
-});
-(0, ava_1.default)("getDiffRanges: diff thunk with addition ranges", async (t) => {
-    const diffRanges = runGetDiffRanges(2, [
-        "@@ -30,7 +50,9 @@",
-        " a",
-        " b",
-        " c",
-        "+1",
-        " c",
-        "+2",
-        " d",
-        " e",
-        " f",
-    ]);
-    t.deepEqual(diffRanges, [
-        {
-            path: "/checkout/path/test.txt",
-            startLine: 53,
-            endLine: 53,
-        },
-        {
-            path: "/checkout/path/test.txt",
-            startLine: 55,
-            endLine: 55,
-        },
-    ]);
-});
-(0, ava_1.default)("getDiffRanges: diff thunk with mixed ranges", async (t) => {
-    const diffRanges = runGetDiffRanges(2, [
-        "@@ -30,7 +50,7 @@",
-        " a",
-        " b",
-        " c",
-        "-1",
-        " d",
-        "-2",
-        "+3",
-        " e",
-        " f",
-        "+4",
-        "+5",
-        " g",
-        " h",
-        " i",
-    ]);
-    t.deepEqual(diffRanges, [
-        {
-            path: "/checkout/path/test.txt",
-            startLine: 54,
-            endLine: 54,
-        },
-        {
-            path: "/checkout/path/test.txt",
-            startLine: 57,
-            endLine: 58,
-        },
-    ]);
-});
-(0, ava_1.default)("getDiffRanges: multiple diff thunks", async (t) => {
-    const diffRanges = runGetDiffRanges(2, [
-        "@@ -30,6 +50,8 @@",
-        " a",
-        " b",
-        " c",
-        "+1",
-        "+2",
-        " d",
-        " e",
-        " f",
-        "@@ -130,6 +150,8 @@",
-        " a",
-        " b",
-        " c",
-        "+1",
-        "+2",
-        " d",
-        " e",
-        " f",
-    ]);
-    t.deepEqual(diffRanges, [
-        {
-            path: "/checkout/path/test.txt",
-            startLine: 53,
-            endLine: 54,
-        },
-        {
-            path: "/checkout/path/test.txt",
-            startLine: 153,
-            endLine: 154,
-        },
-    ]);
-});
-(0, ava_1.default)("getDiffRanges: no diff context lines", async (t) => {
-    const diffRanges = runGetDiffRanges(2, ["@@ -30 +50,2 @@", "+1", "+2"]);
-    t.deepEqual(diffRanges, [
-        {
-            path: "/checkout/path/test.txt",
-            startLine: 50,
-            endLine: 51,
-        },
-    ]);
-});
-(0, ava_1.default)("getDiffRanges: malformed thunk header", async (t) => {
-    const diffRanges = runGetDiffRanges(2, ["@@ 30 +50,2 @@", "+1", "+2"]);
-    t.deepEqual(diffRanges, undefined);
-});
-(0, ava_1.default)("resolveQuerySuiteAlias", (t) => {
-    // default query suite names should resolve to something language-specific ending in `.qls`.
-    for (const suite of analyze_1.defaultSuites) {
-        const resolved = (0, analyze_1.resolveQuerySuiteAlias)(languages_1.KnownLanguage.go, suite);
-        t.assert(resolved.endsWith(".qls"), "Resolved default suite doesn't end in .qls");
-        t.assert(resolved.indexOf(languages_1.KnownLanguage.go) >= 0, "Resolved default suite doesn't contain language name");
-    }
-    // other inputs should be returned unchanged
-    const names = ["foo", "bar", "codeql/go-queries@1.0"];
-    for (const name of names) {
-        t.deepEqual((0, analyze_1.resolveQuerySuiteAlias)(languages_1.KnownLanguage.go, name), name);
-    }
-});
-//# sourceMappingURL=analyze.test.js.map

lib/api-client.js

@@ -1,220 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DisallowedAPIVersionReason = void 0;
-exports.getApiDetails = getApiDetails;
-exports.getApiClient = getApiClient;
-exports.getApiClientWithExternalAuth = getApiClientWithExternalAuth;
-exports.getGitHubVersionFromApi = getGitHubVersionFromApi;
-exports.getGitHubVersion = getGitHubVersion;
-exports.getWorkflowRelativePath = getWorkflowRelativePath;
-exports.getAnalysisKey = getAnalysisKey;
-exports.getAutomationID = getAutomationID;
-exports.computeAutomationID = computeAutomationID;
-exports.listActionsCaches = listActionsCaches;
-exports.deleteActionsCache = deleteActionsCache;
-exports.wrapApiConfigurationError = wrapApiConfigurationError;
-const core = __importStar(require("@actions/core"));
-const githubUtils = __importStar(require("@actions/github/lib/utils"));
-const retry = __importStar(require("@octokit/plugin-retry"));
-const console_log_level_1 = __importDefault(require("console-log-level"));
-const actions_util_1 = require("./actions-util");
-const repository_1 = require("./repository");
-const util_1 = require("./util");
-const GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
-var DisallowedAPIVersionReason;
-(function (DisallowedAPIVersionReason) {
-    DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_OLD"] = 0] = "ACTION_TOO_OLD";
-    DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_NEW"] = 1] = "ACTION_TOO_NEW";
-})(DisallowedAPIVersionReason || (exports.DisallowedAPIVersionReason = DisallowedAPIVersionReason = {}));
-function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
-    const auth = (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth;
-    const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
-    return new retryingOctokit(githubUtils.getOctokitOptions(auth, {
-        baseUrl: apiDetails.apiURL,
-        userAgent: `CodeQL-Action/${(0, actions_util_1.getActionVersion)()}`,
-        log: (0, console_log_level_1.default)({ level: "debug" }),
-    }));
-}
-function getApiDetails() {
-    return {
-        auth: (0, actions_util_1.getRequiredInput)("token"),
-        url: (0, util_1.getRequiredEnvParam)("GITHUB_SERVER_URL"),
-        apiURL: (0, util_1.getRequiredEnvParam)("GITHUB_API_URL"),
-    };
-}
-function getApiClient() {
-    return createApiClientWithDetails(getApiDetails());
-}
-function getApiClientWithExternalAuth(apiDetails) {
-    return createApiClientWithDetails(apiDetails, { allowExternal: true });
-}
-let cachedGitHubVersion = undefined;
-async function getGitHubVersionFromApi(apiClient, apiDetails) {
-    // We can avoid making an API request in the standard dotcom case
-    if ((0, util_1.parseGitHubUrl)(apiDetails.url) === util_1.GITHUB_DOTCOM_URL) {
-        return { type: util_1.GitHubVariant.DOTCOM };
-    }
-    // Doesn't strictly have to be the meta endpoint as we're only
-    // using the response headers which are available on every request.
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-call
-    const response = await apiClient.rest.meta.get();
-    // This happens on dotcom, although we expect to have already returned in that
-    // case. This can also serve as a fallback in cases we haven't foreseen.
-    if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined) {
-        return { type: util_1.GitHubVariant.DOTCOM };
-    }
-    if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === "ghe.com") {
-        return { type: util_1.GitHubVariant.GHE_DOTCOM };
-    }
-    const version = response.headers[GITHUB_ENTERPRISE_VERSION_HEADER];
-    return { type: util_1.GitHubVariant.GHES, version };
-}
-/**
- * Report the GitHub server version. This is a wrapper around
- * util.getGitHubVersion() that automatically supplies GitHub API details using
- * GitHub Action inputs.
- *
- * @returns GitHub version
- */
-async function getGitHubVersion() {
-    if (cachedGitHubVersion === undefined) {
-        cachedGitHubVersion = await getGitHubVersionFromApi(getApiClient(), getApiDetails());
-    }
-    return cachedGitHubVersion;
-}
-/**
- * Get the path of the currently executing workflow relative to the repository root.
- */
-async function getWorkflowRelativePath() {
-    const repo_nwo = (0, repository_1.getRepositoryNwo)();
-    const run_id = Number((0, util_1.getRequiredEnvParam)("GITHUB_RUN_ID"));
-    const apiClient = getApiClient();
-    const runsResponse = await apiClient.request("GET /repos/:owner/:repo/actions/runs/:run_id?exclude_pull_requests=true", {
-        owner: repo_nwo.owner,
-        repo: repo_nwo.repo,
-        run_id,
-    });
-    const workflowUrl = runsResponse.data.workflow_url;
-    const requiredWorkflowRegex = /\/repos\/[^/]+\/[^/]+\/actions\/required_workflows\/[^/]+/;
-    if (!workflowUrl || requiredWorkflowRegex.test(workflowUrl)) {
-        // For required workflows, the workflowUrl is invalid so we cannot fetch more informations
-        // about the workflow.
-        // However, the path is available in the original response.
-        return runsResponse.data.path;
-    }
-    const workflowResponse = await apiClient.request(`GET ${workflowUrl}`);
-    return workflowResponse.data.path;
-}
-/**
- * Get the analysis key parameter for the current job.
- *
- * This will combine the workflow path and current job name.
- * Computing this the first time requires making requests to
- * the GitHub API, but after that the result will be cached.
- */
-async function getAnalysisKey() {
-    const analysisKeyEnvVar = "CODEQL_ACTION_ANALYSIS_KEY";
-    let analysisKey = process.env[analysisKeyEnvVar];
-    if (analysisKey !== undefined) {
-        return analysisKey;
-    }
-    const workflowPath = await getWorkflowRelativePath();
-    const jobName = (0, util_1.getRequiredEnvParam)("GITHUB_JOB");
-    analysisKey = `${workflowPath}:${jobName}`;
-    core.exportVariable(analysisKeyEnvVar, analysisKey);
-    return analysisKey;
-}
-async function getAutomationID() {
-    const analysis_key = await getAnalysisKey();
-    const environment = (0, actions_util_1.getRequiredInput)("matrix");
-    return computeAutomationID(analysis_key, environment);
-}
-function computeAutomationID(analysis_key, environment) {
-    let automationID = `${analysis_key}/`;
-    const matrix = (0, util_1.parseMatrixInput)(environment);
-    if (matrix !== undefined) {
-        // the id has to be deterministic so we sort the fields
-        for (const entry of Object.entries(matrix).sort()) {
-            if (typeof entry[1] === "string") {
-                automationID += `${entry[0]}:${entry[1]}/`;
-            }
-            else {
-                // In code scanning we just handle the string values,
-                // the rest get converted to the empty string
-                automationID += `${entry[0]}:/`;
-            }
-        }
-    }
-    return automationID;
-}
-/** List all Actions cache entries matching the provided key and ref. */
-async function listActionsCaches(key, ref) {
-    const repositoryNwo = (0, repository_1.getRepositoryNwo)();
-    return await getApiClient().paginate("GET /repos/{owner}/{repo}/actions/caches", {
-        owner: repositoryNwo.owner,
-        repo: repositoryNwo.repo,
-        key,
-        ref,
-    });
-}
-/** Delete an Actions cache item by its ID. */
-async function deleteActionsCache(id) {
-    const repositoryNwo = (0, repository_1.getRepositoryNwo)();
-    await getApiClient().rest.actions.deleteActionsCacheById({
-        owner: repositoryNwo.owner,
-        repo: repositoryNwo.repo,
-        cache_id: id,
-    });
-}
-function wrapApiConfigurationError(e) {
-    if ((0, util_1.isHTTPError)(e)) {
-        if (e.message.includes("API rate limit exceeded for installation") ||
-            e.message.includes("commit not found") ||
-            e.message.includes("Resource not accessible by integration") ||
-            /ref .* not found in this repository/.test(e.message)) {
-            return new util_1.ConfigurationError(e.message);
-        }
-        else if (e.message.includes("Bad credentials") ||
-            e.message.includes("Not Found")) {
-            return new util_1.ConfigurationError("Please check that your token is valid and has the required permissions: contents: read, security-events: write");
-        }
-    }
-    return e;
-}
-//# sourceMappingURL=api-client.js.map

lib/api-client.test.js

@@ -1,159 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const github = __importStar(require("@actions/github"));
-const githubUtils = __importStar(require("@actions/github/lib/utils"));
-const ava_1 = __importDefault(require("ava"));
-const sinon = __importStar(require("sinon"));
-const actionsUtil = __importStar(require("./actions-util"));
-const api = __importStar(require("./api-client"));
-const testing_utils_1 = require("./testing-utils");
-const util = __importStar(require("./util"));
-(0, testing_utils_1.setupTests)(ava_1.default);
-ava_1.default.beforeEach(() => {
-    util.initializeEnvironment(actionsUtil.getActionVersion());
-});
-(0, ava_1.default)("getApiClient", async (t) => {
-    const pluginStub = sinon.stub(githubUtils.GitHub, "plugin");
-    const githubStub = sinon.stub();
-    pluginStub.returns(githubStub);
-    sinon.stub(actionsUtil, "getRequiredInput").withArgs("token").returns("xyz");
-    const requiredEnvParamStub = sinon.stub(util, "getRequiredEnvParam");
-    requiredEnvParamStub
-        .withArgs("GITHUB_SERVER_URL")
-        .returns("http://github.localhost");
-    requiredEnvParamStub
-        .withArgs("GITHUB_API_URL")
-        .returns("http://api.github.localhost");
-    api.getApiClient();
-    t.assert(githubStub.calledOnceWithExactly({
-        auth: "token xyz",
-        baseUrl: "http://api.github.localhost",
-        log: sinon.match.any,
-        userAgent: `CodeQL-Action/${actionsUtil.getActionVersion()}`,
-    }));
-});
-function mockGetMetaVersionHeader(versionHeader) {
-    // Passing an auth token is required, so we just use a dummy value
-    const client = github.getOctokit("123");
-    const response = {
-        headers: {
-            "x-github-enterprise-version": versionHeader,
-        },
-    };
-    const spyGetContents = sinon
-        .stub(client.rest.meta, "get")
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-        .resolves(response);
-    sinon.stub(api, "getApiClient").value(() => client);
-    return spyGetContents;
-}
-(0, ava_1.default)("getGitHubVersion for Dotcom", async (t) => {
-    const apiDetails = {
-        auth: "",
-        url: "https://github.com",
-        apiURL: "",
-    };
-    sinon.stub(api, "getApiDetails").returns(apiDetails);
-    const v = await api.getGitHubVersionFromApi(github.getOctokit("123"), apiDetails);
-    t.deepEqual(util.GitHubVariant.DOTCOM, v.type);
-});
-(0, ava_1.default)("getGitHubVersion for GHES", async (t) => {
-    mockGetMetaVersionHeader("2.0");
-    const v2 = await api.getGitHubVersionFromApi(api.getApiClient(), {
-        auth: "",
-        url: "https://ghe.example.com",
-        apiURL: undefined,
-    });
-    t.deepEqual({ type: util.GitHubVariant.GHES, version: "2.0" }, v2);
-});
-(0, ava_1.default)("getGitHubVersion for different domain", async (t) => {
-    mockGetMetaVersionHeader(undefined);
-    const v3 = await api.getGitHubVersionFromApi(api.getApiClient(), {
-        auth: "",
-        url: "https://ghe.example.com",
-        apiURL: undefined,
-    });
-    t.deepEqual({ type: util.GitHubVariant.DOTCOM }, v3);
-});
-(0, ava_1.default)("getGitHubVersion for GHE_DOTCOM", async (t) => {
-    mockGetMetaVersionHeader("ghe.com");
-    const gheDotcom = await api.getGitHubVersionFromApi(api.getApiClient(), {
-        auth: "",
-        url: "https://foo.ghe.com",
-        apiURL: undefined,
-    });
-    t.deepEqual({ type: util.GitHubVariant.GHE_DOTCOM }, gheDotcom);
-});
-(0, ava_1.default)("wrapApiConfigurationError correctly wraps specific configuration errors", (t) => {
-    // We don't reclassify arbitrary errors
-    const arbitraryError = new Error("arbitrary error");
-    let res = api.wrapApiConfigurationError(arbitraryError);
-    t.is(res, arbitraryError);
-    // Same goes for arbitrary errors
-    const configError = new util.ConfigurationError("arbitrary error");
-    res = api.wrapApiConfigurationError(configError);
-    t.is(res, configError);
-    // If an HTTP error doesn't contain a specific error message, we don't
-    // wrap is an an API error.
-    const httpError = new util.HTTPError("arbitrary HTTP error", 456);
-    res = api.wrapApiConfigurationError(httpError);
-    t.is(res, httpError);
-    // For other HTTP errors, we wrap them as Configuration errors if they contain
-    // specific error messages.
-    const httpNotFoundError = new util.HTTPError("commit not found", 404);
-    res = api.wrapApiConfigurationError(httpNotFoundError);
-    t.deepEqual(res, new util.ConfigurationError("commit not found"));
-    const refNotFoundError = new util.HTTPError("ref 'refs/heads/jitsi' not found in this repository - https://docs.github.com/rest", 404);
-    res = api.wrapApiConfigurationError(refNotFoundError);
-    t.deepEqual(res, new util.ConfigurationError("ref 'refs/heads/jitsi' not found in this repository - https://docs.github.com/rest"));
-    const apiRateLimitError = new util.HTTPError("API rate limit exceeded for installation", 403);
-    res = api.wrapApiConfigurationError(apiRateLimitError);
-    t.deepEqual(res, new util.ConfigurationError("API rate limit exceeded for installation"));
-    const tokenSuggestionMessage = "Please check that your token is valid and has the required permissions: contents: read, security-events: write";
-    const badCredentialsError = new util.HTTPError("Bad credentials", 401);
-    res = api.wrapApiConfigurationError(badCredentialsError);
-    t.deepEqual(res, new util.ConfigurationError(tokenSuggestionMessage));
-    const notFoundError = new util.HTTPError("Not Found", 404);
-    res = api.wrapApiConfigurationError(notFoundError);
-    t.deepEqual(res, new util.ConfigurationError(tokenSuggestionMessage));
-    const resourceNotAccessibleError = new util.HTTPError("Resource not accessible by integration", 403);
-    res = api.wrapApiConfigurationError(resourceNotAccessibleError);
-    t.deepEqual(res, new util.ConfigurationError("Resource not accessible by integration"));
-});
-//# sourceMappingURL=api-client.test.js.map

lib/api-compatibility.json

@@ -1 +0,0 @@
-{ "maximumVersion": "3.18", "minimumVersion": "3.14" }

lib/autobuild-action.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"autobuild-action.js","sourceRoot":"","sources":["../src/autobuild-action.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,iDAIwB;AACxB,6CAAgD;AAChD,2CAAwE;AACxE,qCAAqC;AACrC,iDAAmD;AACnD,+CAAuC;AAEvC,uCAAqD;AACrD,mDAMyB;AACzB,mDAAuD;AACvD,iCAOgB;AAShB,KAAK,UAAU,yBAAyB,CACtC,MAA0B,EAC1B,MAAc,EACd,SAAe,EACf,YAAsB,EACtB,eAAwB,EACxB,KAAa;IAEb,IAAA,4BAAqB,EAAC,IAAA,+BAAgB,GAAE,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAA,gCAAgB,EAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,MAAM,IAAA,sCAAsB,EACnD,0BAAU,CAAC,SAAS,EACpB,MAAM,EACN,SAAS,EACT,MAAM,EACN,MAAM,IAAA,qBAAc,EAAC,MAAM,CAAC,EAC5B,MAAM,EACN,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,KAAK,CACb,CAAC;IACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,YAAY,GAA0B;YAC1C,GAAG,gBAAgB;YACnB,mBAAmB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3C,iBAAiB,EAAE,eAAe;SACnC,CAAC;QACF,MAAM,IAAA,gCAAgB,EAAC,YAAY,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAClC,IAAI,MAA0B,CAAC;IAC/B,IAAI,eAAqC,CAAC;IAC1C,IAAI,SAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,IAAA,sCAAsB,EACnD,0BAAU,CAAC,SAAS,EACpB,UAAU,EACV,SAAS,EACT,MAAM,EACN,MAAM,IAAA,qBAAc,EAAC,MAAM,CAAC,EAC5B,MAAM,CACP,CAAC;QACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAA,gCAAgB,EAAC,gBAAgB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACjD,IAAA,yBAAkB,EAAC,IAAA,+BAAgB,GAAE,EAAE,aAAa,CAAC,CAAC;QAEtD,MAAM,GAAG,MAAM,IAAA,wBAAS,EAAC,IAAA,oCAAqB,GAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,SAAS,GAAG,MAAM,IAAA,uCAA2B,EAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,gBAAgB,GAAG,IAAA,+BAAgB,EAAC,mBAAmB,CAAC,CAAC;YAC/D,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CACT,6CAA6C,gBAAgB,EAAE,CAChE,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAClC,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,eAAe,GAAG,QAAQ,CAAC;gBAC3B,MAAM,IAAA,wBAAY,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,+FAA+F;QAC/F,oBAAoB;QACpB,MAAM,IAAA,oCAAoB,EAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,cAAc,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,cAAc,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CACZ,kIAAkI,KAAK,CAAC,OAAO,EAAE,CAClJ,CAAC;QACF,MAAM,yBAAyB,CAC7B,MAAM,EACN,MAAM,EACN,SAAS,EACT,SAAS,IAAI,EAAE,EACf,eAAe,EACf,KAAK,CACN,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,oBAAM,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;IAExE,MAAM,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CAAC,4BAA4B,IAAA,sBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

lib/autobuild.js

@@ -1,162 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.determineAutobuildLanguages = determineAutobuildLanguages;
-exports.setupCppAutobuild = setupCppAutobuild;
-exports.runAutobuild = runAutobuild;
-const core = __importStar(require("@actions/core"));
-const actions_util_1 = require("./actions-util");
-const api_client_1 = require("./api-client");
-const codeql_1 = require("./codeql");
-const doc_url_1 = require("./doc-url");
-const environment_1 = require("./environment");
-const feature_flags_1 = require("./feature-flags");
-const languages_1 = require("./languages");
-const repository_1 = require("./repository");
-const util_1 = require("./util");
-async function determineAutobuildLanguages(codeql, config, logger) {
-    if (config.buildMode === util_1.BuildMode.None ||
-        config.buildMode === util_1.BuildMode.Manual) {
-        logger.info(`Using build mode "${config.buildMode}", nothing to autobuild. ` +
-            `See ${doc_url_1.DocUrl.CODEQL_BUILD_MODES} for more information.`);
-        return undefined;
-    }
-    // Attempt to find a language to autobuild
-    // We want pick the dominant language in the repo from the ones we're able to build
-    // The languages are sorted in order specified by user or by lines of code if we got
-    // them from the GitHub API, so try to build the first language on the list.
-    const autobuildLanguages = await (0, util_1.asyncFilter)(config.languages, async (language) => await codeql.isTracedLanguage(language));
-    if (autobuildLanguages.length === 0) {
-        logger.info("None of the languages in this project require extra build steps");
-        return undefined;
-    }
-    /**
-     * Additionally autobuild Go in the autobuild Action to ensure backwards
-     * compatibility for users performing a multi-language build within a single
-     * job.
-     *
-     * For example, consider a user with the following workflow file:
-     *
-     * ```yml
-     * - uses: github/codeql-action/init@v3
-     *   with:
-     *     languages: go, java
-     * - uses: github/codeql-action/autobuild@v3
-     * - uses: github/codeql-action/analyze@v3
-     * ```
-     *
-     * - With Go extraction disabled, we will run the Java autobuilder in the
-     *   autobuild Action, ensuring we extract both Java and Go code.
-     * - With Go extraction enabled, taking the previous behavior we'd run the Go
-     *   autobuilder, since Go is first on the list of languages. We wouldn't run
-     *   the Java autobuilder at all and so we'd only extract Go code.
-     *
-     * We therefore introduce a special case here such that we'll autobuild Go
-     * in addition to the primary non-Go traced language in the autobuild Action.
-     *
-     * This special case behavior should be removed as part of the next major
-     * version of the CodeQL Action.
-     */
-    const autobuildLanguagesWithoutGo = autobuildLanguages.filter((l) => l !== languages_1.KnownLanguage.go);
-    const languages = [];
-    // First run the autobuilder for the first non-Go traced language, if one
-    // exists.
-    if (autobuildLanguagesWithoutGo[0] !== undefined) {
-        languages.push(autobuildLanguagesWithoutGo[0]);
-    }
-    // If Go is requested, run the Go autobuilder last to ensure it doesn't
-    // interfere with the other autobuilder.
-    if (autobuildLanguages.length !== autobuildLanguagesWithoutGo.length) {
-        languages.push(languages_1.KnownLanguage.go);
-    }
-    logger.debug(`Will autobuild ${languages.join(" and ")}.`);
-    // In general the autobuilders for other traced languages may conflict with
-    // each other. Therefore if a user has requested more than one non-Go traced
-    // language, we ask for manual build steps.
-    // Matrixing the build would also work, but that would change the SARIF
-    // categories, potentially leading to a "stale tips" situation where alerts
-    // that should be fixed remain on a repo since they are linked to SARIF
-    // categories that are no longer updated.
-    if (autobuildLanguagesWithoutGo.length > 1) {
-        logger.warning(`We will only automatically build ${languages.join(" and ")} code. If you wish to scan ${autobuildLanguagesWithoutGo
-            .slice(1)
-            .join(" and ")}, you must replace the autobuild step of your workflow with custom build steps. ` +
-            `See ${doc_url_1.DocUrl.SPECIFY_BUILD_STEPS_MANUALLY} for more information.`);
-    }
-    return languages;
-}
-async function setupCppAutobuild(codeql, logger) {
-    const envVar = feature_flags_1.featureConfig[feature_flags_1.Feature.CppDependencyInstallation].envVar;
-    const featureName = "C++ automatic installation of dependencies";
-    const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
-    const repositoryNwo = (0, repository_1.getRepositoryNwo)();
-    const features = new feature_flags_1.Features(gitHubVersion, repositoryNwo, (0, actions_util_1.getTemporaryDirectory)(), logger);
-    if (await features.getValue(feature_flags_1.Feature.CppDependencyInstallation, codeql)) {
-        // disable autoinstall on self-hosted runners unless explicitly requested
-        if (process.env["RUNNER_ENVIRONMENT"] === "self-hosted" &&
-            process.env[envVar] !== "true") {
-            logger.info(`Disabling ${featureName} as we are on a self-hosted runner.${(0, actions_util_1.getWorkflowEventName)() !== "dynamic"
-                ? ` To override this, set the ${envVar} environment variable to 'true' in your workflow. See ${doc_url_1.DocUrl.DEFINE_ENV_VARIABLES} for more information.`
-                : ""}`);
-            core.exportVariable(envVar, "false");
-        }
-        else {
-            logger.info(`Enabling ${featureName}. This can be disabled by setting the ${envVar} environment variable to 'false'. See ${doc_url_1.DocUrl.DEFINE_ENV_VARIABLES} for more information.`);
-            core.exportVariable(envVar, "true");
-        }
-    }
-    else {
-        logger.info(`Disabling ${featureName}.`);
-        core.exportVariable(envVar, "false");
-    }
-}
-async function runAutobuild(config, language, logger) {
-    logger.startGroup(`Attempting to automatically build ${language} code`);
-    const codeQL = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
-    if (language === languages_1.KnownLanguage.cpp) {
-        await setupCppAutobuild(codeQL, logger);
-    }
-    if (config.buildMode) {
-        await codeQL.extractUsingBuildMode(config, language);
-    }
-    else {
-        await codeQL.runAutobuild(config, language);
-    }
-    if (language === languages_1.KnownLanguage.go) {
-        core.exportVariable(environment_1.EnvVar.DID_AUTOBUILD_GOLANG, "true");
-    }
-    logger.endGroup();
-}
-//# sourceMappingURL=autobuild.js.map

lib/autobuild.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"autobuild.js","sourceRoot":"","sources":["../src/autobuild.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,kEAkGC;AAED,8CAmCC;AAED,oCAmBC;AA1KD,oDAAsC;AAEtC,iDAA6E;AAC7E,6CAAgD;AAChD,qCAA6C;AAE7C,uCAAmC;AACnC,+CAAuC;AACvC,mDAAmE;AACnE,2CAAsD;AAEtD,6CAAgD;AAChD,iCAAgD;AAEzC,KAAK,UAAU,2BAA2B,CAC/C,MAAc,EACd,MAA0B,EAC1B,MAAc;IAEd,IACE,MAAM,CAAC,SAAS,KAAK,gBAAS,CAAC,IAAI;QACnC,MAAM,CAAC,SAAS,KAAK,gBAAS,CAAC,MAAM,EACrC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,qBAAqB,MAAM,CAAC,SAAS,2BAA2B;YAC9D,OAAO,gBAAM,CAAC,kBAAkB,wBAAwB,CAC3D,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0CAA0C;IAC1C,mFAAmF;IACnF,oFAAoF;IACpF,4EAA4E;IAC5E,MAAM,kBAAkB,GAAG,MAAM,IAAA,kBAAW,EAC1C,MAAM,CAAC,SAAS,EAChB,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAC5D,CAAC;IAEF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,iEAAiE,CAClE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,2BAA2B,GAAG,kBAAkB,CAAC,MAAM,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,yBAAa,CAAC,EAAE,CAC9B,CAAC;IAEF,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,yEAAyE;IACzE,UAAU;IACV,IAAI,2BAA2B,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACjD,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,uEAAuE;IACvE,wCAAwC;IACxC,IAAI,kBAAkB,CAAC,MAAM,KAAK,2BAA2B,CAAC,MAAM,EAAE,CAAC;QACrE,SAAS,CAAC,IAAI,CAAC,yBAAa,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3D,2EAA2E;IAC3E,4EAA4E;IAC5E,2CAA2C;IAC3C,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,yCAAyC;IACzC,IAAI,2BAA2B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,OAAO,CACZ,oCAAoC,SAAS,CAAC,IAAI,CAChD,OAAO,CACR,8BAA8B,2BAA2B;aACvD,KAAK,CAAC,CAAC,CAAC;aACR,IAAI,CACH,OAAO,CACR,kFAAkF;YACnF,OAAO,gBAAM,CAAC,4BAA4B,wBAAwB,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,6BAAa,CAAC,uBAAO,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,WAAW,GAAG,4CAA4C,CAAC;IACjE,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAA,6BAAgB,GAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,wBAAQ,CAC3B,aAAa,EACb,aAAa,EACb,IAAA,oCAAqB,GAAE,EACvB,MAAM,CACP,CAAC;IACF,IAAI,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,EAAE,CAAC;QACvE,yEAAyE;QACzE,IACE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,aAAa;YACnD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,EAC9B,CAAC;YACD,MAAM,CAAC,IAAI,CACT,aAAa,WAAW,sCACtB,IAAA,mCAAoB,GAAE,KAAK,SAAS;gBAClC,CAAC,CAAC,8BAA8B,MAAM,yDAAyD,gBAAM,CAAC,oBAAoB,wBAAwB;gBAClJ,CAAC,CAAC,EACN,EAAE,CACH,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,YAAY,WAAW,yCAAyC,MAAM,yCAAyC,gBAAM,CAAC,oBAAoB,wBAAwB,CACnK,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,aAAa,WAAW,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAA0B,EAC1B,QAAkB,EAClB,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,qCAAqC,QAAQ,OAAO,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,QAAQ,KAAK,yBAAa,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,QAAQ,KAAK,yBAAa,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,oBAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC"}

lib/caching-utils.js

@@ -1,117 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CachingKind = void 0;
-exports.getTotalCacheSize = getTotalCacheSize;
-exports.shouldStoreCache = shouldStoreCache;
-exports.shouldRestoreCache = shouldRestoreCache;
-exports.getCachingKind = getCachingKind;
-exports.getDependencyCachingEnabled = getDependencyCachingEnabled;
-const core = __importStar(require("@actions/core"));
-const actions_util_1 = require("./actions-util");
-const environment_1 = require("./environment");
-const util_1 = require("./util");
-/**
- * Returns the total size of all the specified paths.
- * @param paths The paths for which to calculate the total size.
- * @param logger A logger to record some informational messages to.
- * @param quiet A value indicating whether to suppress logging warnings (default: false).
- * @returns The total size of all specified paths.
- */
-async function getTotalCacheSize(paths, logger, quiet = false) {
-    const sizes = await Promise.all(paths.map((cacheDir) => (0, util_1.tryGetFolderBytes)(cacheDir, logger, quiet)));
-    return sizes.map((a) => a || 0).reduce((a, b) => a + b, 0);
-}
-/* Enumerates caching modes. */
-var CachingKind;
-(function (CachingKind) {
-    /** Do not restore or store any caches. */
-    CachingKind["None"] = "none";
-    /** Store caches, but do not restore any existing ones. */
-    CachingKind["Store"] = "store";
-    /** Restore existing caches, but do not store any new ones. */
-    CachingKind["Restore"] = "restore";
-    /** Restore existing caches, and store new ones. */
-    CachingKind["Full"] = "full";
-})(CachingKind || (exports.CachingKind = CachingKind = {}));
-/** Returns a value indicating whether new caches should be stored, based on `kind`. */
-function shouldStoreCache(kind) {
-    return kind === CachingKind.Full || kind === CachingKind.Store;
-}
-/** Returns a value indicating whether existing caches should be restored, based on `kind`. */
-function shouldRestoreCache(kind) {
-    return kind === CachingKind.Full || kind === CachingKind.Restore;
-}
-/**
- * Parses the `upload` input into an `UploadKind`.
- */
-function getCachingKind(input) {
-    switch (input) {
-        case undefined:
-        case "none":
-        case "off":
-        case "false":
-            return CachingKind.None;
-        case "full":
-        case "on":
-        case "true":
-            return CachingKind.Full;
-        case "store":
-            return CachingKind.Store;
-        case "restore":
-            return CachingKind.Restore;
-        default:
-            core.warning(`Unrecognized 'dependency-caching' input: ${input}. Defaulting to 'none'.`);
-            return CachingKind.None;
-    }
-}
-/** Determines whether dependency caching is enabled. */
-function getDependencyCachingEnabled() {
-    // If the workflow specified something always respect that
-    const dependencyCaching = (0, actions_util_1.getOptionalInput)("dependency-caching") ||
-        process.env[environment_1.EnvVar.DEPENDENCY_CACHING];
-    if (dependencyCaching !== undefined)
-        return getCachingKind(dependencyCaching);
-    // On self-hosted runners which may have dependencies installed centrally, disable caching by default
-    if (!(0, util_1.isHostedRunner)())
-        return CachingKind.None;
-    // Disable in advanced workflows by default.
-    if (!(0, actions_util_1.isDefaultSetup)())
-        return CachingKind.None;
-    // On hosted runners, disable dependency caching by default.
-    // TODO: Review later whether we can enable this by default.
-    return CachingKind.None;
-}
-//# sourceMappingURL=caching-utils.js.map

lib/caching-utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"caching-utils.js","sourceRoot":"","sources":["../src/caching-utils.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,8CASC;AAeD,4CAEC;AAGD,gDAEC;AAKD,wCAqBC;AAGD,kEAgBC;AA1FD,oDAAsC;AAEtC,iDAAkE;AAClE,+CAAuC;AAEvC,iCAA2D;AAE3D;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB,CACrC,KAAe,EACf,MAAc,EACd,QAAiB,KAAK;IAEtB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAA,wBAAiB,EAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CACpE,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,+BAA+B;AAC/B,IAAY,WASX;AATD,WAAY,WAAW;IACrB,0CAA0C;IAC1C,4BAAa,CAAA;IACb,0DAA0D;IAC1D,8BAAe,CAAA;IACf,8DAA8D;IAC9D,kCAAmB,CAAA;IACnB,mDAAmD;IACnD,4BAAa,CAAA;AACf,CAAC,EATW,WAAW,2BAAX,WAAW,QAStB;AAED,uFAAuF;AACvF,SAAgB,gBAAgB,CAAC,IAAiB;IAChD,OAAO,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,IAAI,KAAK,WAAW,CAAC,KAAK,CAAC;AACjE,CAAC;AAED,8FAA8F;AAC9F,SAAgB,kBAAkB,CAAC,IAAiB;IAClD,OAAO,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,KAAyB;IACtD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK,CAAC;QACX,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,IAAI,CAAC;QAC1B,KAAK,MAAM,CAAC;QACZ,KAAK,IAAI,CAAC;QACV,KAAK,MAAM;YACT,OAAO,WAAW,CAAC,IAAI,CAAC;QAC1B,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,KAAK,CAAC;QAC3B,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,OAAO,CAAC;QAC7B;YACE,IAAI,CAAC,OAAO,CACV,4CAA4C,KAAK,yBAAyB,CAC3E,CAAC;YACF,OAAO,WAAW,CAAC,IAAI,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAgB,2BAA2B;IACzC,0DAA0D;IAC1D,MAAM,iBAAiB,GACrB,IAAA,+BAAgB,EAAC,oBAAoB,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,oBAAM,CAAC,kBAAkB,CAAC,CAAC;IACzC,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAE9E,qGAAqG;IACrG,IAAI,CAAC,IAAA,qBAAc,GAAE;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAE/C,4CAA4C;IAC5C,IAAI,CAAC,IAAA,6BAAc,GAAE;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC;IAE/C,4DAA4D;IAC5D,4DAA4D;IAC5D,OAAO,WAAW,CAAC,IAAI,CAAC;AAC1B,CAAC"}

lib/cli-errors.js

@@ -1,314 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.cliErrorsConfig = exports.CliConfigErrorCategory = exports.CliError = void 0;
-exports.wrapCliConfigurationError = wrapCliConfigurationError;
-const actions_util_1 = require("./actions-util");
-const doc_url_1 = require("./doc-url");
-const util_1 = require("./util");
-const SUPPORTED_PLATFORMS = [
-    ["linux", "x64"],
-    ["win32", "x64"],
-    ["darwin", "x64"],
-    ["darwin", "arm64"],
-];
-/**
- * An error from a CodeQL CLI invocation, with associated exit code, stderr, etc.
- */
-class CliError extends Error {
-    constructor({ cmd, args, exitCode, stderr }) {
-        const prettyCommand = (0, actions_util_1.prettyPrintInvocation)(cmd, args);
-        const fatalErrors = extractFatalErrors(stderr);
-        const autobuildErrors = extractAutobuildErrors(stderr);
-        let message;
-        if (fatalErrors) {
-            message =
-                `Encountered a fatal error while running "${prettyCommand}". ` +
-                    `Exit code was ${exitCode} and error was: ${(0, actions_util_1.ensureEndsInPeriod)(fatalErrors.trim())} See the logs for more details.`;
-        }
-        else if (autobuildErrors) {
-            message =
-                "We were unable to automatically build your code. Please provide manual build steps. " +
-                    `See ${doc_url_1.DocUrl.AUTOMATIC_BUILD_FAILED} for more information. ` +
-                    `Encountered the following error: ${autobuildErrors}`;
-        }
-        else {
-            const lastLine = (0, actions_util_1.ensureEndsInPeriod)(stderr.trim().split("\n").pop()?.trim() || "n/a");
-            message =
-                `Encountered a fatal error while running "${prettyCommand}". ` +
-                    `Exit code was ${exitCode} and last log line was: ${lastLine} See the logs for more details.`;
-        }
-        super(message);
-        this.exitCode = exitCode;
-        this.stderr = stderr;
-    }
-}
-exports.CliError = CliError;
-/**
- * Provide a better error message from the stderr of a CLI invocation that failed with a fatal
- * error.
- *
- * - If the CLI invocation failed with a fatal error, this returns that fatal error, followed by
- *   any fatal errors that occurred in plumbing commands.
- * - If the CLI invocation did not fail with a fatal error, this returns `undefined`.
- *
- * ### Example
- *
- * ```
- * Running TRAP import for CodeQL database at /home/runner/work/_temp/codeql_databases/javascript...
- * A fatal error occurred: Evaluator heap must be at least 384.00 MiB
- * A fatal error occurred: Dataset import for
- * /home/runner/work/_temp/codeql_databases/javascript/db-javascript failed with code 2
- * ```
- *
- * becomes
- *
- * ```
- * Encountered a fatal error while running "codeql-for-testing database finalize --finalize-dataset
- * --threads=2 --ram=2048 db". Exit code was 32 and error was: A fatal error occurred: Dataset
- * import for /home/runner/work/_temp/codeql_databases/javascript/db-javascript failed with code 2.
- * Context: A fatal error occurred: Evaluator heap must be at least 384.00 MiB.
- * ```
- *
- * Where possible, this tries to summarize the error into a single line, as this displays better in
- * the Actions UI.
- */
-function extractFatalErrors(error) {
-    const fatalErrorRegex = /.*fatal (internal )?error occurr?ed(. Details)?:/gi;
-    let fatalErrors = [];
-    let lastFatalErrorIndex;
-    let match;
-    while ((match = fatalErrorRegex.exec(error)) !== null) {
-        if (lastFatalErrorIndex !== undefined) {
-            fatalErrors.push(error.slice(lastFatalErrorIndex, match.index).trim());
-        }
-        lastFatalErrorIndex = match.index;
-    }
-    if (lastFatalErrorIndex !== undefined) {
-        const lastError = error.slice(lastFatalErrorIndex).trim();
-        if (fatalErrors.length === 0) {
-            // No other errors
-            return lastError;
-        }
-        const isOneLiner = !fatalErrors.some((e) => e.includes("\n"));
-        if (isOneLiner) {
-            fatalErrors = fatalErrors.map(actions_util_1.ensureEndsInPeriod);
-        }
-        return [
-            (0, actions_util_1.ensureEndsInPeriod)(lastError),
-            "Context:",
-            ...fatalErrors.reverse(),
-        ].join(isOneLiner ? " " : "\n");
-    }
-    return undefined;
-}
-function extractAutobuildErrors(error) {
-    const pattern = /.*\[autobuild\] \[ERROR\] (.*)/gi;
-    let errorLines = [...error.matchAll(pattern)].map((match) => match[1]);
-    // Truncate if there are more than 10 matching lines.
-    if (errorLines.length > 10) {
-        errorLines = errorLines.slice(0, 10);
-        errorLines.push("(truncated)");
-    }
-    return errorLines.join("\n") || undefined;
-}
-/** Error messages from the CLI that we consider configuration errors and handle specially. */
-var CliConfigErrorCategory;
-(function (CliConfigErrorCategory) {
-    CliConfigErrorCategory["AutobuildError"] = "AutobuildError";
-    CliConfigErrorCategory["CouldNotCreateTempDir"] = "CouldNotCreateTempDir";
-    CliConfigErrorCategory["ExternalRepositoryCloneFailed"] = "ExternalRepositoryCloneFailed";
-    CliConfigErrorCategory["GradleBuildFailed"] = "GradleBuildFailed";
-    CliConfigErrorCategory["IncompatibleWithActionVersion"] = "IncompatibleWithActionVersion";
-    CliConfigErrorCategory["InitCalledTwice"] = "InitCalledTwice";
-    CliConfigErrorCategory["InvalidConfigFile"] = "InvalidConfigFile";
-    CliConfigErrorCategory["InvalidExternalRepoSpecifier"] = "InvalidExternalRepoSpecifier";
-    CliConfigErrorCategory["InvalidSourceRoot"] = "InvalidSourceRoot";
-    CliConfigErrorCategory["MavenBuildFailed"] = "MavenBuildFailed";
-    CliConfigErrorCategory["NoBuildCommandAutodetected"] = "NoBuildCommandAutodetected";
-    CliConfigErrorCategory["NoBuildMethodAutodetected"] = "NoBuildMethodAutodetected";
-    CliConfigErrorCategory["NoSourceCodeSeen"] = "NoSourceCodeSeen";
-    CliConfigErrorCategory["NoSupportedBuildCommandSucceeded"] = "NoSupportedBuildCommandSucceeded";
-    CliConfigErrorCategory["NoSupportedBuildSystemDetected"] = "NoSupportedBuildSystemDetected";
-    CliConfigErrorCategory["NotFoundInRegistry"] = "NotFoundInRegistry";
-    CliConfigErrorCategory["OutOfMemoryOrDisk"] = "OutOfMemoryOrDisk";
-    CliConfigErrorCategory["PackCannotBeFound"] = "PackCannotBeFound";
-    CliConfigErrorCategory["PackMissingAuth"] = "PackMissingAuth";
-    CliConfigErrorCategory["SwiftBuildFailed"] = "SwiftBuildFailed";
-    CliConfigErrorCategory["UnsupportedBuildMode"] = "UnsupportedBuildMode";
-})(CliConfigErrorCategory || (exports.CliConfigErrorCategory = CliConfigErrorCategory = {}));
-/**
- * All of our caught CLI error messages that we handle specially: ie. if we
- * would like to categorize an error as a configuration error or not.
- */
-exports.cliErrorsConfig = {
-    [CliConfigErrorCategory.AutobuildError]: {
-        cliErrorMessageCandidates: [
-            new RegExp("We were unable to automatically build your code"),
-        ],
-    },
-    [CliConfigErrorCategory.CouldNotCreateTempDir]: {
-        cliErrorMessageCandidates: [new RegExp("Could not create temp directory")],
-    },
-    [CliConfigErrorCategory.ExternalRepositoryCloneFailed]: {
-        cliErrorMessageCandidates: [
-            new RegExp("Failed to clone external Git repository"),
-        ],
-    },
-    [CliConfigErrorCategory.GradleBuildFailed]: {
-        cliErrorMessageCandidates: [
-            new RegExp("\\[autobuild\\] FAILURE: Build failed with an exception."),
-        ],
-    },
-    // Version of CodeQL CLI is incompatible with this version of the CodeQL Action
-    [CliConfigErrorCategory.IncompatibleWithActionVersion]: {
-        cliErrorMessageCandidates: [
-            new RegExp("is not compatible with this CodeQL CLI"),
-        ],
-    },
-    [CliConfigErrorCategory.InitCalledTwice]: {
-        cliErrorMessageCandidates: [
-            new RegExp("Refusing to create databases .* but could not process any of it"),
-        ],
-        additionalErrorMessageToAppend: `Is the "init" action called twice in the same job?`,
-    },
-    [CliConfigErrorCategory.InvalidConfigFile]: {
-        cliErrorMessageCandidates: [
-            new RegExp("Config file .* is not valid"),
-            new RegExp("The supplied config file is empty"),
-        ],
-    },
-    [CliConfigErrorCategory.InvalidExternalRepoSpecifier]: {
-        cliErrorMessageCandidates: [
-            new RegExp("Specifier for external repository is invalid"),
-        ],
-    },
-    // Expected source location for database creation does not exist
-    [CliConfigErrorCategory.InvalidSourceRoot]: {
-        cliErrorMessageCandidates: [new RegExp("Invalid source root")],
-    },
-    [CliConfigErrorCategory.MavenBuildFailed]: {
-        cliErrorMessageCandidates: [
-            new RegExp("\\[autobuild\\] \\[ERROR\\] Failed to execute goal"),
-        ],
-    },
-    [CliConfigErrorCategory.NoBuildCommandAutodetected]: {
-        cliErrorMessageCandidates: [
-            new RegExp("Could not auto-detect a suitable build method"),
-        ],
-    },
-    [CliConfigErrorCategory.NoBuildMethodAutodetected]: {
-        cliErrorMessageCandidates: [
-            new RegExp("Could not detect a suitable build command for the source checkout"),
-        ],
-    },
-    // Usually when a manual build script has failed, or if an autodetected language
-    // was unintended to have CodeQL analysis run on it.
-    [CliConfigErrorCategory.NoSourceCodeSeen]: {
-        exitCode: 32,
-        cliErrorMessageCandidates: [
-            new RegExp("CodeQL detected code written in .* but could not process any of it"),
-            new RegExp("CodeQL did not detect any code written in languages supported by CodeQL"),
-        ],
-    },
-    [CliConfigErrorCategory.NoSupportedBuildCommandSucceeded]: {
-        cliErrorMessageCandidates: [
-            new RegExp("No supported build command succeeded"),
-        ],
-    },
-    [CliConfigErrorCategory.NoSupportedBuildSystemDetected]: {
-        cliErrorMessageCandidates: [
-            new RegExp("No supported build system detected"),
-        ],
-    },
-    [CliConfigErrorCategory.OutOfMemoryOrDisk]: {
-        cliErrorMessageCandidates: [
-            new RegExp("CodeQL is out of memory."),
-            new RegExp("out of disk"),
-            new RegExp("No space left on device"),
-        ],
-        additionalErrorMessageToAppend: "For more information, see https://gh.io/troubleshooting-code-scanning/out-of-disk-or-memory",
-    },
-    [CliConfigErrorCategory.PackCannotBeFound]: {
-        cliErrorMessageCandidates: [
-            new RegExp("Query pack .* cannot be found\\. Check the spelling of the pack\\."),
-        ],
-    },
-    [CliConfigErrorCategory.PackMissingAuth]: {
-        cliErrorMessageCandidates: [
-            new RegExp("GitHub Container registry .* 403 Forbidden"),
-            new RegExp("Do you need to specify a token to authenticate to the registry?"),
-        ],
-    },
-    [CliConfigErrorCategory.SwiftBuildFailed]: {
-        cliErrorMessageCandidates: [
-            new RegExp("\\[autobuilder/build\\] \\[build-command-failed\\] `autobuild` failed to run the build command"),
-        ],
-    },
-    [CliConfigErrorCategory.UnsupportedBuildMode]: {
-        cliErrorMessageCandidates: [
-            new RegExp("does not support the .* build mode. Please try using one of the following build modes instead"),
-        ],
-    },
-    [CliConfigErrorCategory.NotFoundInRegistry]: {
-        cliErrorMessageCandidates: [
-            new RegExp("'.*' not found in the registry '.*'"),
-        ],
-    },
-};
-/**
- * Check if the given CLI error or exit code, if applicable, apply to any known
- * CLI errors in the configuration record. If either the CLI error message matches one of
- * the error messages in the config record, or the exit codes match, return the error category;
- * if not, return undefined.
- */
-function getCliConfigCategoryIfExists(cliError) {
-    for (const [category, configuration] of Object.entries(exports.cliErrorsConfig)) {
-        if (cliError.exitCode !== undefined &&
-            configuration.exitCode !== undefined &&
-            cliError.exitCode === configuration.exitCode) {
-            return category;
-        }
-        for (const e of configuration.cliErrorMessageCandidates) {
-            if (cliError.message.match(e) || cliError.stderr.match(e)) {
-                return category;
-            }
-        }
-    }
-    return undefined;
-}
-/**
- * Check if we are running on an unsupported platform/architecture combination.
- */
-function isUnsupportedPlatform() {
-    return !SUPPORTED_PLATFORMS.some(([platform, arch]) => platform === process.platform && arch === process.arch);
-}
-/**
- * Transform a CLI error into a ConfigurationError for an unsupported platform.
- */
-function getUnsupportedPlatformError(cliError) {
-    return new util_1.ConfigurationError("The CodeQL CLI does not support the platform/architecture combination of " +
-        `${process.platform}/${process.arch} ` +
-        `(see ${doc_url_1.DocUrl.SYSTEM_REQUIREMENTS}). ` +
-        `The underlying error was: ${cliError.message}`);
-}
-/**
- * Changes an error received from the CLI to a ConfigurationError with the message
- * optionally being transformed, if it is a known configuration error. Otherwise,
- * simply returns the original error.
- */
-function wrapCliConfigurationError(cliError) {
-    if (isUnsupportedPlatform()) {
-        return getUnsupportedPlatformError(cliError);
-    }
-    const cliConfigErrorCategory = getCliConfigCategoryIfExists(cliError);
-    if (cliConfigErrorCategory === undefined) {
-        return cliError;
-    }
-    let errorMessageBuilder = cliError.message;
-    const additionalErrorMessageToAppend = exports.cliErrorsConfig[cliConfigErrorCategory].additionalErrorMessageToAppend;
-    if (additionalErrorMessageToAppend !== undefined) {
-        errorMessageBuilder = `${errorMessageBuilder} ${additionalErrorMessageToAppend}`;
-    }
-    return new util_1.ConfigurationError(errorMessageBuilder);
-}
-//# sourceMappingURL=cli-errors.js.map

lib/cli-errors.test.js

@@ -1,220 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const ava_1 = __importDefault(require("ava"));
-const sinon = __importStar(require("sinon"));
-const actions_util_1 = require("./actions-util");
-const cli_errors_1 = require("./cli-errors");
-const testing_utils_1 = require("./testing-utils");
-const util_1 = require("./util");
-(0, testing_utils_1.setupTests)(ava_1.default);
-(0, ava_1.default)("CliError constructor with fatal errors", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "finalize"], 32, "Running TRAP import for CodeQL database...\nA fatal error occurred: Evaluator heap must be at least 384.00 MiB\nA fatal error occurred: Dataset import failed with code 2");
-    const cliError = new cli_errors_1.CliError(commandError);
-    t.is(cliError.exitCode, 32);
-    t.is(cliError.stderr, "Running TRAP import for CodeQL database...\nA fatal error occurred: Evaluator heap must be at least 384.00 MiB\nA fatal error occurred: Dataset import failed with code 2");
-    t.true(cliError.message.includes("A fatal error occurred: Dataset import failed with code 2."));
-    t.true(cliError.message.includes("Context: A fatal error occurred: Evaluator heap must be at least 384.00 MiB."));
-});
-(0, ava_1.default)("CliError constructor with single fatal error", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "A fatal error occurred: Out of memory");
-    const cliError = new cli_errors_1.CliError(commandError);
-    t.is(cliError.exitCode, 1);
-    t.true(cliError.message.includes("A fatal error occurred: Out of memory"));
-    t.false(cliError.message.includes("Context:"));
-});
-(0, ava_1.default)("CliError constructor with autobuild errors", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "[autobuild] [ERROR] Build failed\n[autobuild] [ERROR] Compilation error");
-    const cliError = new cli_errors_1.CliError(commandError);
-    t.is(cliError.exitCode, 1);
-    t.true(cliError.message.includes("We were unable to automatically build your code"));
-    t.true(cliError.message.includes("Build failed\nCompilation error"));
-});
-(0, ava_1.default)("CliError constructor with truncated autobuild errors", (t) => {
-    const stderr = Array.from({ length: 12 }, (_, i) => `[autobuild] [ERROR] Error ${i + 1}`).join("\n");
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, stderr);
-    const cliError = new cli_errors_1.CliError(commandError);
-    t.true(cliError.message.includes("(truncated)"));
-    // Should only include first 10 errors plus truncation message
-    const errorLines = cliError.message
-        .split("Encountered the following error: ")[1]
-        .split("\n");
-    t.is(errorLines.length, 11); // 10 errors + "(truncated)"
-});
-(0, ava_1.default)("CliError constructor with generic error", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["version"], 1, "Some generic error message\nLast line of error");
-    const cliError = new cli_errors_1.CliError(commandError);
-    t.is(cliError.exitCode, 1);
-    t.true(cliError.message.includes('Encountered a fatal error while running "codeql version"'));
-    t.true(cliError.message.includes("Exit code was 1 and last log line was: Last line of error."));
-});
-(0, ava_1.default)("CliError constructor with empty stderr", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["version"], 1, "");
-    const cliError = new cli_errors_1.CliError(commandError);
-    t.true(cliError.message.includes("last log line was: n/a"));
-});
-for (const [platform, arch] of [
-    ["weird_plat", "x64"],
-    ["linux", "arm64"],
-    ["win32", "arm64"],
-]) {
-    (0, ava_1.default)(`wrapCliConfigurationError - ${platform}/${arch} unsupported`, (t) => {
-        sinon.stub(process, "platform").value(platform);
-        sinon.stub(process, "arch").value(arch);
-        const commandError = new actions_util_1.CommandInvocationError("codeql", ["version"], 1, "Some error");
-        const cliError = new cli_errors_1.CliError(commandError);
-        const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-        t.true(wrappedError instanceof util_1.ConfigurationError);
-        t.true(wrappedError.message.includes("CodeQL CLI does not support the platform/architecture combination"));
-        t.true(wrappedError.message.includes(`${platform}/${arch}`));
-    });
-}
-(0, ava_1.default)("wrapCliConfigurationError - supported platform", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["version"], 1, "Some error");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    // Should return the original error since platform is supported
-    t.is(wrappedError, cliError);
-});
-(0, ava_1.default)("wrapCliConfigurationError - autobuild error", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "We were unable to automatically build your code");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    t.true(wrappedError instanceof util_1.ConfigurationError);
-    t.true(wrappedError.message.includes("We were unable to automatically build your code"));
-});
-(0, ava_1.default)("wrapCliConfigurationError - init called twice", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "Refusing to create databases /some/path but could not process any of it");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    t.true(wrappedError instanceof util_1.ConfigurationError);
-    t.true(wrappedError.message.includes('Is the "init" action called twice in the same job?'));
-});
-(0, ava_1.default)("wrapCliConfigurationError - no source code seen by exit code", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "finalize"], 32, "Some other error message");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    t.true(wrappedError instanceof util_1.ConfigurationError);
-});
-(0, ava_1.default)("wrapCliConfigurationError - no source code seen by message", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "finalize"], 1, "CodeQL detected code written in JavaScript but could not process any of it");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    t.true(wrappedError instanceof util_1.ConfigurationError);
-});
-(0, ava_1.default)("wrapCliConfigurationError - out of memory error with additional message", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "analyze"], 1, "CodeQL is out of memory.");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    t.true(wrappedError instanceof util_1.ConfigurationError);
-    t.true(wrappedError.message.includes("For more information, see https://gh.io/troubleshooting-code-scanning/out-of-disk-or-memory"));
-});
-(0, ava_1.default)("wrapCliConfigurationError - gradle build failed", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "[autobuild] FAILURE: Build failed with an exception.");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    t.true(wrappedError instanceof util_1.ConfigurationError);
-});
-(0, ava_1.default)("wrapCliConfigurationError - maven build failed", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "[autobuild] [ERROR] Failed to execute goal");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    t.true(wrappedError instanceof util_1.ConfigurationError);
-});
-(0, ava_1.default)("wrapCliConfigurationError - swift build failed", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "[autobuilder/build] [build-command-failed] `autobuild` failed to run the build command");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    t.true(wrappedError instanceof util_1.ConfigurationError);
-});
-(0, ava_1.default)("wrapCliConfigurationError - pack cannot be found", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["pack", "install"], 1, "Query pack my-pack cannot be found. Check the spelling of the pack.");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    t.true(wrappedError instanceof util_1.ConfigurationError);
-});
-(0, ava_1.default)("wrapCliConfigurationError - pack missing auth", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["pack", "download"], 1, "GitHub Container registry returned 403 Forbidden");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    t.true(wrappedError instanceof util_1.ConfigurationError);
-});
-(0, ava_1.default)("wrapCliConfigurationError - invalid config file", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "Config file .codeql/config.yml is not valid");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    t.true(wrappedError instanceof util_1.ConfigurationError);
-});
-(0, ava_1.default)("wrapCliConfigurationError - incompatible CLI version", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["version"], 1, "is not compatible with this CodeQL CLI");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    t.true(wrappedError instanceof util_1.ConfigurationError);
-});
-(0, ava_1.default)("wrapCliConfigurationError - unknown error remains unchanged", (t) => {
-    const commandError = new actions_util_1.CommandInvocationError("codeql", ["version"], 1, "Some unknown error that doesn't match any patterns");
-    const cliError = new cli_errors_1.CliError(commandError);
-    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
-    // Should return the original CliError since it doesn't match any known patterns
-    t.is(wrappedError, cliError);
-    t.true(wrappedError instanceof cli_errors_1.CliError);
-    t.false(wrappedError instanceof util_1.ConfigurationError);
-});
-// Test all error categories to ensure they're properly configured
-(0, ava_1.default)("all CLI config error categories have valid configurations", (t) => {
-    const allCategories = Object.values(cli_errors_1.CliConfigErrorCategory);
-    for (const category of allCategories) {
-        // Each category should be a string
-        t.is(typeof category, "string");
-        // Create a test error that matches this category
-        let testError;
-        switch (category) {
-            case cli_errors_1.CliConfigErrorCategory.NoSourceCodeSeen:
-                // This category matches by exit code
-                testError = new cli_errors_1.CliError(new actions_util_1.CommandInvocationError("codeql", [], 32, "some error"));
-                break;
-            default:
-                // For other categories, we'll test with a generic message that should not match
-                testError = new cli_errors_1.CliError(new actions_util_1.CommandInvocationError("codeql", [], 1, "generic error"));
-                break;
-        }
-        // The test should not throw an error when processing
-        t.notThrows(() => (0, cli_errors_1.wrapCliConfigurationError)(testError));
-    }
-});
-//# sourceMappingURL=cli-errors.test.js.map

lib/codeql.js

@@ -1,784 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.setupCodeQL = setupCodeQL;
-exports.getCodeQL = getCodeQL;
-exports.setCodeQL = setCodeQL;
-exports.createStubCodeQL = createStubCodeQL;
-exports.getCodeQLForTesting = getCodeQLForTesting;
-exports.getCodeQLForCmd = getCodeQLForCmd;
-exports.getExtraOptions = getExtraOptions;
-exports.getTrapCachingExtractorConfigArgs = getTrapCachingExtractorConfigArgs;
-exports.getTrapCachingExtractorConfigArgsForLang = getTrapCachingExtractorConfigArgsForLang;
-exports.getGeneratedCodeScanningConfigPath = getGeneratedCodeScanningConfigPath;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const core = __importStar(require("@actions/core"));
-const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
-const yaml = __importStar(require("js-yaml"));
-const actions_util_1 = require("./actions-util");
-const cli_errors_1 = require("./cli-errors");
-const config_utils_1 = require("./config-utils");
-const doc_url_1 = require("./doc-url");
-const environment_1 = require("./environment");
-const feature_flags_1 = require("./feature-flags");
-const git_utils_1 = require("./git-utils");
-const overlay_database_utils_1 = require("./overlay-database-utils");
-const setupCodeql = __importStar(require("./setup-codeql"));
-const tools_features_1 = require("./tools-features");
-const tracer_config_1 = require("./tracer-config");
-const util = __importStar(require("./util"));
-const util_1 = require("./util");
-/**
- * Stores the CodeQL object, and is populated by `setupCodeQL` or `getCodeQL`.
- */
-let cachedCodeQL = undefined;
-/**
- * The oldest version of CodeQL that the Action will run with. This should be
- * at least three minor versions behind the current version and must include the
- * CLI versions shipped with each supported version of GHES.
- *
- * The version flags below can be used to conditionally enable certain features
- * on versions newer than this.
- */
-const CODEQL_MINIMUM_VERSION = "2.16.6";
-/**
- * This version will shortly become the oldest version of CodeQL that the Action will run with.
- */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";
-/**
- * This is the version of GHES that was most recently deprecated.
- */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";
-/**
- * This is the deprecation date for the version of GHES that was most recently deprecated.
- */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";
-/** The CLI verbosity level to use for extraction in debug mode. */
-const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
-/*
- * Deprecated in favor of ToolsFeature.
- *
- * Versions of CodeQL that version-flag certain functionality in the Action.
- * For convenience, please keep these in descending order. Once a version
- * flag is older than the oldest supported version above, it may be removed.
- */
-/**
- * Versions 2.17.1+ of the CodeQL CLI support the `--cache-cleanup` option.
- */
-const CODEQL_VERSION_CACHE_CLEANUP = "2.17.1";
-/**
- * Set up CodeQL CLI access.
- *
- * @param toolsInput
- * @param apiDetails
- * @param tempDir
- * @param variant
- * @param defaultCliVersion
- * @param logger
- * @param checkVersion Whether to check that CodeQL CLI meets the minimum
- *        version requirement. Must be set to true outside tests.
- * @returns a { CodeQL, toolsVersion } object.
- */
-async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, logger, checkVersion) {
-    try {
-        const { codeqlFolder, toolsDownloadStatusReport, toolsSource, toolsVersion, zstdAvailability, } = await setupCodeql.setupCodeQLBundle(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, logger);
-        logger.debug(`Bundle download status report: ${JSON.stringify(toolsDownloadStatusReport)}`);
-        let codeqlCmd = path.join(codeqlFolder, "codeql", "codeql");
-        if (process.platform === "win32") {
-            codeqlCmd += ".exe";
-        }
-        else if (process.platform !== "linux" && process.platform !== "darwin") {
-            throw new util.ConfigurationError(`Unsupported platform: ${process.platform}`);
-        }
-        cachedCodeQL = await getCodeQLForCmd(codeqlCmd, checkVersion);
-        return {
-            codeql: cachedCodeQL,
-            toolsDownloadStatusReport,
-            toolsSource,
-            toolsVersion,
-            zstdAvailability,
-        };
-    }
-    catch (e) {
-        const ErrorClass = e instanceof util.ConfigurationError ||
-            (e instanceof Error && e.message.includes("ENOSPC")) // out of disk space
-            ? util.ConfigurationError
-            : Error;
-        throw new ErrorClass(`Unable to download and extract CodeQL CLI: ${(0, util_1.getErrorMessage)(e)}${e instanceof Error && e.stack ? `\n\nDetails: ${e.stack}` : ""}`);
-    }
-}
-/**
- * Use the CodeQL executable located at the given path.
- */
-async function getCodeQL(cmd) {
-    if (cachedCodeQL === undefined) {
-        cachedCodeQL = await getCodeQLForCmd(cmd, true);
-    }
-    return cachedCodeQL;
-}
-/**
- * Overrides the CodeQL object. Only for use in tests that cannot override
- * CodeQL via dependency injection.
- *
- * Accepts a partial object. Any undefined methods will be implemented
- * to immediately throw an exception indicating which method is missing.
- */
-function setCodeQL(codeql) {
-    cachedCodeQL = createStubCodeQL(codeql);
-}
-function resolveFunction(partialCodeql, methodName, defaultImplementation) {
-    if (typeof partialCodeql[methodName] !== "function") {
-        if (defaultImplementation !== undefined) {
-            return defaultImplementation;
-        }
-        const dummyMethod = () => {
-            throw new Error(`CodeQL ${methodName} method not correctly defined`);
-        };
-        return dummyMethod;
-    }
-    return partialCodeql[methodName];
-}
-/**
- * Creates a stub CodeQL object. Only for use in tests.
- *
- * Accepts a partial object. Any undefined methods will be implemented
- * to immediately throw an exception indicating which method is missing.
- */
-function createStubCodeQL(partialCodeql) {
-    return {
-        getPath: resolveFunction(partialCodeql, "getPath", () => "/tmp/dummy-path"),
-        getVersion: resolveFunction(partialCodeql, "getVersion", async () => ({
-            version: "1.0.0",
-        })),
-        printVersion: resolveFunction(partialCodeql, "printVersion"),
-        supportsFeature: resolveFunction(partialCodeql, "supportsFeature", async (feature) => !!partialCodeql.getVersion &&
-            (0, tools_features_1.isSupportedToolsFeature)(await partialCodeql.getVersion(), feature)),
-        isTracedLanguage: resolveFunction(partialCodeql, "isTracedLanguage"),
-        isScannedLanguage: resolveFunction(partialCodeql, "isScannedLanguage"),
-        databaseInitCluster: resolveFunction(partialCodeql, "databaseInitCluster"),
-        runAutobuild: resolveFunction(partialCodeql, "runAutobuild"),
-        extractScannedLanguage: resolveFunction(partialCodeql, "extractScannedLanguage"),
-        extractUsingBuildMode: resolveFunction(partialCodeql, "extractUsingBuildMode"),
-        finalizeDatabase: resolveFunction(partialCodeql, "finalizeDatabase"),
-        resolveLanguages: resolveFunction(partialCodeql, "resolveLanguages"),
-        betterResolveLanguages: resolveFunction(partialCodeql, "betterResolveLanguages", async () => ({ aliases: {}, extractors: {} })),
-        resolveBuildEnvironment: resolveFunction(partialCodeql, "resolveBuildEnvironment"),
-        databaseCleanupCluster: resolveFunction(partialCodeql, "databaseCleanupCluster"),
-        databaseBundle: resolveFunction(partialCodeql, "databaseBundle"),
-        databaseRunQueries: resolveFunction(partialCodeql, "databaseRunQueries"),
-        databaseInterpretResults: resolveFunction(partialCodeql, "databaseInterpretResults"),
-        databasePrintBaseline: resolveFunction(partialCodeql, "databasePrintBaseline"),
-        databaseExportDiagnostics: resolveFunction(partialCodeql, "databaseExportDiagnostics"),
-        diagnosticsExport: resolveFunction(partialCodeql, "diagnosticsExport"),
-        resolveExtractor: resolveFunction(partialCodeql, "resolveExtractor"),
-        resolveQueriesStartingPacks: resolveFunction(partialCodeql, "resolveQueriesStartingPacks"),
-        mergeResults: resolveFunction(partialCodeql, "mergeResults"),
-    };
-}
-/**
- * Get a real, newly created CodeQL instance for testing. The instance refers to
- * a non-existent placeholder codeql command, so tests that use this function
- * should also stub the toolrunner.ToolRunner constructor.
- */
-async function getCodeQLForTesting(cmd = "codeql-for-testing") {
-    return getCodeQLForCmd(cmd, false);
-}
-/**
- * Return a CodeQL object for CodeQL CLI access.
- *
- * @param cmd Path to CodeQL CLI
- * @param checkVersion Whether to check that CodeQL CLI meets the minimum
- *        version requirement. Must be set to true outside tests.
- * @returns A new CodeQL object
- */
-async function getCodeQLForCmd(cmd, checkVersion) {
-    const codeql = {
-        getPath() {
-            return cmd;
-        },
-        async getVersion() {
-            let result = util.getCachedCodeQlVersion();
-            if (result === undefined) {
-                const output = await runCli(cmd, ["version", "--format=json"], {
-                    noStreamStdout: true,
-                });
-                try {
-                    result = JSON.parse(output);
-                }
-                catch {
-                    throw Error(`Invalid JSON output from \`version --format=json\`: ${output}`);
-                }
-                util.cacheCodeQlVersion(result);
-            }
-            return result;
-        },
-        async printVersion() {
-            await runCli(cmd, ["version", "--format=json"]);
-        },
-        async supportsFeature(feature) {
-            return (0, tools_features_1.isSupportedToolsFeature)(await this.getVersion(), feature);
-        },
-        async isTracedLanguage(language) {
-            const extractorPath = await this.resolveExtractor(language);
-            const tracingConfigPath = path.join(extractorPath, "tools", "tracing-config.lua");
-            return fs.existsSync(tracingConfigPath);
-        },
-        async isScannedLanguage(language) {
-            return !(await this.isTracedLanguage(language));
-        },
-        async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, logger) {
-            const extraArgs = config.languages.map((language) => `--language=${language}`);
-            if (await (0, tracer_config_1.shouldEnableIndirectTracing)(codeql, config)) {
-                extraArgs.push("--begin-tracing");
-                extraArgs.push(...(await getTrapCachingExtractorConfigArgs(config)));
-                extraArgs.push(`--trace-process-name=${processName}`);
-            }
-            const codeScanningConfigFile = await writeCodeScanningConfigFile(config, logger);
-            const externalRepositoryToken = (0, actions_util_1.getOptionalInput)("external-repository-token");
-            extraArgs.push(`--codescanning-config=${codeScanningConfigFile}`);
-            if (externalRepositoryToken) {
-                extraArgs.push("--external-repository-token-stdin");
-            }
-            if (config.buildMode !== undefined) {
-                extraArgs.push(`--build-mode=${config.buildMode}`);
-            }
-            if (qlconfigFile !== undefined) {
-                extraArgs.push(`--qlconfig-file=${qlconfigFile}`);
-            }
-            const overwriteFlag = (0, tools_features_1.isSupportedToolsFeature)(await this.getVersion(), tools_features_1.ToolsFeature.ForceOverwrite)
-                ? "--force-overwrite"
-                : "--overwrite";
-            const overlayDatabaseMode = config.augmentationProperties.overlayDatabaseMode;
-            if (overlayDatabaseMode === overlay_database_utils_1.OverlayDatabaseMode.Overlay) {
-                const overlayChangesFile = await (0, overlay_database_utils_1.writeOverlayChangesFile)(config, sourceRoot, logger);
-                extraArgs.push(`--overlay-changes=${overlayChangesFile}`);
-            }
-            else if (overlayDatabaseMode === overlay_database_utils_1.OverlayDatabaseMode.OverlayBase) {
-                extraArgs.push("--overlay-base");
-            }
-            await runCli(cmd, [
-                "database",
-                "init",
-                ...(overlayDatabaseMode === overlay_database_utils_1.OverlayDatabaseMode.Overlay
-                    ? []
-                    : [overwriteFlag]),
-                "--db-cluster",
-                config.dbLocation,
-                `--source-root=${sourceRoot}`,
-                "--calculate-language-specific-baseline",
-                "--extractor-include-aliases",
-                "--sublanguage-file-coverage",
-                ...extraArgs,
-                ...getExtraOptionsFromEnv(["database", "init"], {
-                    ignoringOptions: ["--overwrite"],
-                }),
-            ], { stdin: externalRepositoryToken });
-            if (overlayDatabaseMode === overlay_database_utils_1.OverlayDatabaseMode.OverlayBase) {
-                await (0, overlay_database_utils_1.writeBaseDatabaseOidsFile)(config, sourceRoot);
-            }
-        },
-        async runAutobuild(config, language) {
-            applyAutobuildAzurePipelinesTimeoutFix();
-            const autobuildCmd = path.join(await this.resolveExtractor(language), "tools", process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh");
-            // Bump the verbosity of the autobuild command if we're in debug mode
-            if (config.debugMode) {
-                process.env[environment_1.EnvVar.CLI_VERBOSITY] =
-                    process.env[environment_1.EnvVar.CLI_VERBOSITY] || EXTRACTION_DEBUG_MODE_VERBOSITY;
-            }
-            // On macOS, System Integrity Protection (SIP) typically interferes with
-            // CodeQL build tracing of protected binaries.
-            // The usual workaround is to prefix `$CODEQL_RUNNER` to build commands:
-            // `$CODEQL_RUNNER` (not to be confused with the deprecated CodeQL Runner tool)
-            // points to a simple wrapper binary included with the CLI, and the extra layer of
-            // process indirection helps the tracer bypass SIP.
-            // The above SIP workaround is *not* needed here.
-            // At the `autobuild` step in the Actions workflow, we assume the `init` step
-            // has successfully run, and will have exported `DYLD_INSERT_LIBRARIES`
-            // into the environment of subsequent steps, to activate the tracer.
-            // When `DYLD_INSERT_LIBRARIES` is set in the environment for a step,
-            // the Actions runtime introduces its own workaround for SIP
-            // (https://github.com/actions/runner/pull/416).
-            await runCli(autobuildCmd);
-        },
-        async extractScannedLanguage(config, language) {
-            await runCli(cmd, [
-                "database",
-                "trace-command",
-                "--index-traceless-dbs",
-                ...(await getTrapCachingExtractorConfigArgsForLang(config, language)),
-                ...getExtractionVerbosityArguments(config.debugMode),
-                ...getExtraOptionsFromEnv(["database", "trace-command"]),
-                util.getCodeQLDatabasePath(config, language),
-            ]);
-        },
-        async extractUsingBuildMode(config, language) {
-            if (config.buildMode === util_1.BuildMode.Autobuild) {
-                applyAutobuildAzurePipelinesTimeoutFix();
-            }
-            try {
-                await runCli(cmd, [
-                    "database",
-                    "trace-command",
-                    "--use-build-mode",
-                    "--working-dir",
-                    process.cwd(),
-                    ...(await getTrapCachingExtractorConfigArgsForLang(config, language)),
-                    ...getExtractionVerbosityArguments(config.debugMode),
-                    ...getExtraOptionsFromEnv(["database", "trace-command"]),
-                    util.getCodeQLDatabasePath(config, language),
-                ]);
-            }
-            catch (e) {
-                if (config.buildMode === util_1.BuildMode.Autobuild) {
-                    const prefix = "We were unable to automatically build your code. " +
-                        "Please change the build mode for this language to manual and specify build steps " +
-                        `for your project. See ${doc_url_1.DocUrl.AUTOMATIC_BUILD_FAILED} for more information.`;
-                    throw new util.ConfigurationError(`${prefix} ${(0, util_1.getErrorMessage)(e)}`);
-                }
-                else {
-                    throw e;
-                }
-            }
-        },
-        async finalizeDatabase(databasePath, threadsFlag, memoryFlag, enableDebugLogging) {
-            const args = [
-                "database",
-                "finalize",
-                "--finalize-dataset",
-                threadsFlag,
-                memoryFlag,
-                ...getExtractionVerbosityArguments(enableDebugLogging),
-                ...getExtraOptionsFromEnv(["database", "finalize"]),
-                databasePath,
-            ];
-            await runCli(cmd, args);
-        },
-        async resolveLanguages() {
-            const codeqlArgs = [
-                "resolve",
-                "languages",
-                "--format=json",
-                ...getExtraOptionsFromEnv(["resolve", "languages"]),
-            ];
-            const output = await runCli(cmd, codeqlArgs);
-            try {
-                return JSON.parse(output);
-            }
-            catch (e) {
-                throw new Error(`Unexpected output from codeql resolve languages: ${e}`);
-            }
-        },
-        async betterResolveLanguages() {
-            const codeqlArgs = [
-                "resolve",
-                "languages",
-                "--format=betterjson",
-                "--extractor-options-verbosity=4",
-                "--extractor-include-aliases",
-                ...getExtraOptionsFromEnv(["resolve", "languages"]),
-            ];
-            const output = await runCli(cmd, codeqlArgs);
-            try {
-                return JSON.parse(output);
-            }
-            catch (e) {
-                throw new Error(`Unexpected output from codeql resolve languages with --format=betterjson: ${e}`);
-            }
-        },
-        async resolveBuildEnvironment(workingDir, language) {
-            const codeqlArgs = [
-                "resolve",
-                "build-environment",
-                `--language=${language}`,
-                "--extractor-include-aliases",
-                ...getExtraOptionsFromEnv(["resolve", "build-environment"]),
-            ];
-            if (workingDir !== undefined) {
-                codeqlArgs.push("--working-dir", workingDir);
-            }
-            const output = await runCli(cmd, codeqlArgs);
-            try {
-                return JSON.parse(output);
-            }
-            catch (e) {
-                throw new Error(`Unexpected output from codeql resolve build-environment: ${e} in\n${output}`);
-            }
-        },
-        async databaseRunQueries(databasePath, flags, queries = []) {
-            const codeqlArgs = [
-                "database",
-                "run-queries",
-                ...flags,
-                databasePath,
-                "--intra-layer-parallelism",
-                "--min-disk-free=1024", // Try to leave at least 1GB free
-                "-v",
-                ...queries,
-                ...getExtraOptionsFromEnv(["database", "run-queries"], {
-                    ignoringOptions: ["--expect-discarded-cache"],
-                }),
-            ];
-            await runCli(cmd, codeqlArgs);
-        },
-        async databaseInterpretResults(databasePath, querySuitePaths, sarifFile, addSnippetsFlag, threadsFlag, verbosityFlag, sarifRunPropertyFlag, automationDetailsId, config, features) {
-            const shouldExportDiagnostics = await features.getValue(feature_flags_1.Feature.ExportDiagnosticsEnabled, this);
-            const codeqlArgs = [
-                "database",
-                "interpret-results",
-                threadsFlag,
-                "--format=sarif-latest",
-                verbosityFlag,
-                `--output=${sarifFile}`,
-                addSnippetsFlag,
-                "--print-diagnostics-summary",
-                "--print-metrics-summary",
-                "--sarif-add-baseline-file-info",
-                `--sarif-codescanning-config=${getGeneratedCodeScanningConfigPath(config)}`,
-                "--sarif-group-rules-by-pack",
-                "--sarif-include-query-help=always",
-                "--sublanguage-file-coverage",
-                ...(await getJobRunUuidSarifOptions(this)),
-                ...getExtraOptionsFromEnv(["database", "interpret-results"]),
-            ];
-            if (sarifRunPropertyFlag !== undefined) {
-                codeqlArgs.push(sarifRunPropertyFlag);
-            }
-            if (automationDetailsId !== undefined) {
-                codeqlArgs.push("--sarif-category", automationDetailsId);
-            }
-            if (shouldExportDiagnostics) {
-                codeqlArgs.push("--sarif-include-diagnostics");
-            }
-            else {
-                codeqlArgs.push("--no-sarif-include-diagnostics");
-            }
-            if (!(0, tools_features_1.isSupportedToolsFeature)(await this.getVersion(), tools_features_1.ToolsFeature.AnalysisSummaryV2IsDefault)) {
-                codeqlArgs.push("--new-analysis-summary");
-            }
-            codeqlArgs.push(databasePath);
-            if (querySuitePaths) {
-                codeqlArgs.push(...querySuitePaths);
-            }
-            // Capture the stdout, which contains the analysis summary. Don't stream it to the Actions
-            // logs to avoid printing it twice.
-            return await runCli(cmd, codeqlArgs, {
-                noStreamStdout: true,
-            });
-        },
-        async databasePrintBaseline(databasePath) {
-            const codeqlArgs = [
-                "database",
-                "print-baseline",
-                ...getExtraOptionsFromEnv(["database", "print-baseline"]),
-                databasePath,
-            ];
-            return await runCli(cmd, codeqlArgs);
-        },
-        async databaseCleanupCluster(config, cleanupLevel) {
-            const cacheCleanupFlag = (await util.codeQlVersionAtLeast(this, CODEQL_VERSION_CACHE_CLEANUP))
-                ? "--cache-cleanup"
-                : "--mode";
-            for (const language of config.languages) {
-                const databasePath = util.getCodeQLDatabasePath(config, language);
-                const codeqlArgs = [
-                    "database",
-                    "cleanup",
-                    databasePath,
-                    `${cacheCleanupFlag}=${cleanupLevel}`,
-                    ...getExtraOptionsFromEnv(["database", "cleanup"]),
-                ];
-                await runCli(cmd, codeqlArgs);
-            }
-        },
-        async databaseBundle(databasePath, outputFilePath, databaseName) {
-            const args = [
-                "database",
-                "bundle",
-                databasePath,
-                `--output=${outputFilePath}`,
-                `--name=${databaseName}`,
-                ...getExtraOptionsFromEnv(["database", "bundle"]),
-            ];
-            await new toolrunner.ToolRunner(cmd, args).exec();
-        },
-        async databaseExportDiagnostics(databasePath, sarifFile, automationDetailsId) {
-            const args = [
-                "database",
-                "export-diagnostics",
-                `${databasePath}`,
-                "--db-cluster", // Database is always a cluster for CodeQL versions that support diagnostics.
-                "--format=sarif-latest",
-                `--output=${sarifFile}`,
-                "--sarif-include-diagnostics", // ExportDiagnosticsEnabled is always true if this command is run.
-                "-vvv",
-                ...getExtraOptionsFromEnv(["diagnostics", "export"]),
-            ];
-            if (automationDetailsId !== undefined) {
-                args.push("--sarif-category", automationDetailsId);
-            }
-            await new toolrunner.ToolRunner(cmd, args).exec();
-        },
-        async diagnosticsExport(sarifFile, automationDetailsId, config) {
-            const args = [
-                "diagnostics",
-                "export",
-                "--format=sarif-latest",
-                `--output=${sarifFile}`,
-                `--sarif-codescanning-config=${getGeneratedCodeScanningConfigPath(config)}`,
-                ...getExtraOptionsFromEnv(["diagnostics", "export"]),
-            ];
-            if (automationDetailsId !== undefined) {
-                args.push("--sarif-category", automationDetailsId);
-            }
-            await new toolrunner.ToolRunner(cmd, args).exec();
-        },
-        async resolveExtractor(language) {
-            // Request it using `format=json` so we don't need to strip the trailing new line generated by
-            // the CLI.
-            let extractorPath = "";
-            await new toolrunner.ToolRunner(cmd, [
-                "resolve",
-                "extractor",
-                "--format=json",
-                `--language=${language}`,
-                "--extractor-include-aliases",
-                ...getExtraOptionsFromEnv(["resolve", "extractor"]),
-            ], {
-                silent: true,
-                listeners: {
-                    stdout: (data) => {
-                        extractorPath += data.toString();
-                    },
-                    stderr: (data) => {
-                        process.stderr.write(data);
-                    },
-                },
-            }).exec();
-            return JSON.parse(extractorPath);
-        },
-        async resolveQueriesStartingPacks(queries) {
-            const codeqlArgs = [
-                "resolve",
-                "queries",
-                "--format=startingpacks",
-                ...getExtraOptionsFromEnv(["resolve", "queries"]),
-                ...queries,
-            ];
-            const output = await runCli(cmd, codeqlArgs, { noStreamStdout: true });
-            try {
-                return JSON.parse(output);
-            }
-            catch (e) {
-                throw new Error(`Unexpected output from codeql resolve queries --format=startingpacks: ${e}`);
-            }
-        },
-        async mergeResults(sarifFiles, outputFile, { mergeRunsFromEqualCategory = false, }) {
-            const args = [
-                "github",
-                "merge-results",
-                "--output",
-                outputFile,
-                ...getExtraOptionsFromEnv(["github", "merge-results"]),
-            ];
-            for (const sarifFile of sarifFiles) {
-                args.push("--sarif", sarifFile);
-            }
-            if (mergeRunsFromEqualCategory) {
-                args.push("--sarif-merge-runs-from-equal-category");
-            }
-            await runCli(cmd, args);
-        },
-    };
-    // To ensure that status reports include the CodeQL CLI version wherever
-    // possible, we want to call getVersion(), which populates the version value
-    // used by status reporting, at the earliest opportunity. But invoking
-    // getVersion() directly here breaks tests that only pretend to create a
-    // CodeQL object. So instead we rely on the assumption that all non-test
-    // callers would set checkVersion to true, and util.codeQlVersionAbove()
-    // would call getVersion(), so the CLI version would be cached as soon as the
-    // CodeQL object is created.
-    if (checkVersion &&
-        !(await util.codeQlVersionAtLeast(codeql, CODEQL_MINIMUM_VERSION))) {
-        throw new util.ConfigurationError(`Expected a CodeQL CLI with version at least ${CODEQL_MINIMUM_VERSION} but got version ${(await codeql.getVersion()).version}`);
-    }
-    else if (checkVersion &&
-        process.env[environment_1.EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING] !== "true" &&
-        !(await util.codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION))) {
-        const result = await codeql.getVersion();
-        core.warning(`CodeQL CLI version ${result.version} was discontinued on ` +
-            `${GHES_MOST_RECENT_DEPRECATION_DATE} alongside GitHub Enterprise Server ` +
-            `${GHES_VERSION_MOST_RECENTLY_DEPRECATED} and will not be supported by the next minor ` +
-            `release of the CodeQL Action. Please update to CodeQL CLI version ` +
-            `${CODEQL_NEXT_MINIMUM_VERSION} or later. For instance, if you have specified a custom ` +
-            "version of the CLI using the 'tools' input to the 'init' Action, you can remove this " +
-            "input to use the default version.\n\n" +
-            "Alternatively, if you want to continue using CodeQL CLI version " +
-            `${result.version}, you can replace 'github/codeql-action/*@v${(0, actions_util_1.getActionVersion)().split(".")[0]}' by 'github/codeql-action/*@v${(0, actions_util_1.getActionVersion)()}' in your code scanning workflow to ` +
-            "continue using this version of the CodeQL Action.");
-        core.exportVariable(environment_1.EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
-    }
-    return codeql;
-}
-/**
- * Gets the options for `path` of `options` as an array of extra option strings.
- *
- * @param ignoringOptions Options that should be ignored, for example because they have already
- *                        been passed and it is an error to pass them more than once.
- */
-function getExtraOptionsFromEnv(paths, { ignoringOptions } = {}) {
-    const options = util.getExtraOptionsEnvParam();
-    return getExtraOptions(options, paths, []).filter((option) => !ignoringOptions?.includes(option));
-}
-/**
- * Gets `options` as an array of extra option strings.
- *
- * - throws an exception mentioning `pathInfo` if this conversion is impossible.
- */
-function asExtraOptions(options, pathInfo) {
-    if (options === undefined) {
-        return [];
-    }
-    if (!Array.isArray(options)) {
-        const msg = `The extra options for '${pathInfo.join(".")}' ('${JSON.stringify(options)}') are not in an array.`;
-        throw new Error(msg);
-    }
-    return options.map((o) => {
-        const t = typeof o;
-        if (t !== "string" && t !== "number" && t !== "boolean") {
-            const msg = `The extra option for '${pathInfo.join(".")}' ('${JSON.stringify(o)}') is not a primitive value.`;
-            throw new Error(msg);
-        }
-        return `${o}`;
-    });
-}
-/**
- * Gets the options for `path` of `options` as an array of extra option strings.
- *
- * - the special terminal step name '*' in `options` matches all path steps
- * - throws an exception if this conversion is impossible.
- *
- * Exported for testing.
- */
-function getExtraOptions(options, paths, pathInfo) {
-    const all = asExtraOptions(options?.["*"], pathInfo.concat("*"));
-    const specific = paths.length === 0
-        ? asExtraOptions(options, pathInfo)
-        : getExtraOptions(options?.[paths[0]], paths?.slice(1), pathInfo.concat(paths[0]));
-    return all.concat(specific);
-}
-async function runCli(cmd, args = [], opts = {}) {
-    try {
-        return await (0, actions_util_1.runTool)(cmd, args, opts);
-    }
-    catch (e) {
-        if (e instanceof actions_util_1.CommandInvocationError) {
-            throw (0, cli_errors_1.wrapCliConfigurationError)(new cli_errors_1.CliError(e));
-        }
-        throw e;
-    }
-}
-/**
- * Generates a code scanning configuration that is to be used for a scan.
- *
- * @param codeql The CodeQL object to use.
- * @param config The configuration to use.
- * @returns the path to the generated user configuration file.
- */
-async function writeCodeScanningConfigFile(config, logger) {
-    const codeScanningConfigFile = getGeneratedCodeScanningConfigPath(config);
-    const augmentedConfig = (0, config_utils_1.generateCodeScanningConfig)(config.originalUserInput, config.augmentationProperties);
-    logger.info(`Writing augmented user configuration file to ${codeScanningConfigFile}`);
-    logger.startGroup("Augmented user configuration file contents");
-    logger.info(yaml.dump(augmentedConfig));
-    logger.endGroup();
-    fs.writeFileSync(codeScanningConfigFile, yaml.dump(augmentedConfig));
-    return codeScanningConfigFile;
-}
-// This constant sets the size of each TRAP cache in megabytes.
-const TRAP_CACHE_SIZE_MB = 1024;
-async function getTrapCachingExtractorConfigArgs(config) {
-    const result = [];
-    for (const language of config.languages)
-        result.push(await getTrapCachingExtractorConfigArgsForLang(config, language));
-    return result.flat();
-}
-async function getTrapCachingExtractorConfigArgsForLang(config, language) {
-    const cacheDir = config.trapCaches[language];
-    if (cacheDir === undefined)
-        return [];
-    const write = await (0, git_utils_1.isAnalyzingDefaultBranch)();
-    return [
-        `-O=${language}.trap.cache.dir=${cacheDir}`,
-        `-O=${language}.trap.cache.bound=${TRAP_CACHE_SIZE_MB}`,
-        `-O=${language}.trap.cache.write=${write}`,
-    ];
-}
-/**
- * Get the path to the code scanning configuration generated by the CLI.
- *
- * This will not exist if the configuration is being parsed in the Action.
- */
-function getGeneratedCodeScanningConfigPath(config) {
-    return path.resolve(config.tempDir, "user-config.yaml");
-}
-function getExtractionVerbosityArguments(enableDebugLogging) {
-    return enableDebugLogging
-        ? [`--verbosity=${EXTRACTION_DEBUG_MODE_VERBOSITY}`]
-        : [];
-}
-/**
- * Updates the `JAVA_TOOL_OPTIONS` environment variable to resolve an issue with Azure Pipelines
- * timing out connections after 4 minutes and Maven not properly handling closed connections.
- *
- * Without the fix, long build processes will timeout when pulling down Java packages
- * https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html
- */
-function applyAutobuildAzurePipelinesTimeoutFix() {
-    const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
-    process.env["JAVA_TOOL_OPTIONS"] = [
-        ...javaToolOptions.split(/\s+/),
-        "-Dhttp.keepAlive=false",
-        "-Dmaven.wagon.http.pool=false",
-    ].join(" ");
-}
-async function getJobRunUuidSarifOptions(codeql) {
-    const jobRunUuid = process.env[environment_1.EnvVar.JOB_RUN_UUID];
-    return jobRunUuid &&
-        (await codeql.supportsFeature(tools_features_1.ToolsFeature.DatabaseInterpretResultsSupportsSarifRunProperty))
-        ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`]
-        : [];
-}
-//# sourceMappingURL=codeql.js.map

lib/codeql.test.js

@@ -1,666 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.stubToolRunnerConstructor = stubToolRunnerConstructor;
-const fs = __importStar(require("fs"));
-const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
-const io = __importStar(require("@actions/io"));
-const toolcache = __importStar(require("@actions/tool-cache"));
-const ava_1 = __importDefault(require("ava"));
-const del_1 = __importDefault(require("del"));
-const yaml = __importStar(require("js-yaml"));
-const nock_1 = __importDefault(require("nock"));
-const sinon = __importStar(require("sinon"));
-const actionsUtil = __importStar(require("./actions-util"));
-const cli_errors_1 = require("./cli-errors");
-const codeql = __importStar(require("./codeql"));
-const config_utils_1 = require("./config-utils");
-const defaults = __importStar(require("./defaults.json"));
-const doc_url_1 = require("./doc-url");
-const languages_1 = require("./languages");
-const logging_1 = require("./logging");
-const setup_codeql_1 = require("./setup-codeql");
-const testing_utils_1 = require("./testing-utils");
-const tools_features_1 = require("./tools-features");
-const util = __importStar(require("./util"));
-const util_1 = require("./util");
-(0, testing_utils_1.setupTests)(ava_1.default);
-let stubConfig;
-ava_1.default.beforeEach(() => {
-    (0, util_1.initializeEnvironment)("1.2.3");
-    stubConfig = (0, testing_utils_1.createTestConfig)({
-        languages: [languages_1.KnownLanguage.cpp],
-    });
-});
-async function installIntoToolcache({ apiDetails = testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, cliVersion, isPinned, tagName, tmpDir, }) {
-    const url = (0, testing_utils_1.mockBundleDownloadApi)({ apiDetails, isPinned, tagName });
-    await codeql.setupCodeQL(cliVersion !== undefined ? undefined : url, apiDetails, tmpDir, util.GitHubVariant.GHES, cliVersion !== undefined
-        ? { cliVersion, tagName }
-        : testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
-}
-function mockReleaseApi({ apiDetails = testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, assetNames, tagName, }) {
-    return (0, nock_1.default)(apiDetails.apiURL)
-        .get(`/repos/github/codeql-action/releases/tags/${tagName}`)
-        .reply(200, {
-        assets: assetNames.map((name) => ({
-            name,
-        })),
-        tag_name: tagName,
-    });
-}
-function mockApiDetails(apiDetails) {
-    // This is a workaround to mock `api.getApiDetails()` since it doesn't seem to be possible to
-    // mock this directly. The difficulty is that `getApiDetails()` is called locally in
-    // `api-client.ts`, but `sinon.stub(api, "getApiDetails")` only affects calls to
-    // `getApiDetails()` via an imported `api` module.
-    sinon
-        .stub(actionsUtil, "getRequiredInput")
-        .withArgs("token")
-        .returns(apiDetails.auth);
-    process.env["GITHUB_SERVER_URL"] = apiDetails.url;
-    process.env["GITHUB_API_URL"] = apiDetails.apiURL || "";
-}
-async function stubCodeql() {
-    const codeqlObject = await codeql.getCodeQLForTesting();
-    sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
-    sinon
-        .stub(codeqlObject, "isTracedLanguage")
-        .withArgs(languages_1.KnownLanguage.cpp)
-        .resolves(true);
-    return codeqlObject;
-}
-(0, ava_1.default)("downloads and caches explicitly requested bundles that aren't in the toolcache", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        const versions = ["20200601", "20200610"];
-        for (let i = 0; i < versions.length; i++) {
-            const version = versions[i];
-            const url = (0, testing_utils_1.mockBundleDownloadApi)({
-                tagName: `codeql-bundle-${version}`,
-                isPinned: false,
-            });
-            const result = await codeql.setupCodeQL(url, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
-            t.assert(toolcache.find("CodeQL", `0.0.0-${version}`));
-            t.is(result.toolsVersion, `0.0.0-${version}`);
-            t.is(result.toolsSource, setup_codeql_1.ToolsSource.Download);
-        }
-        t.is(toolcache.findAllVersions("CodeQL").length, 2);
-    });
-});
-(0, ava_1.default)("caches semantically versioned bundles using their semantic version number", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        const url = (0, testing_utils_1.mockBundleDownloadApi)({
-            tagName: `codeql-bundle-v2.15.0`,
-            isPinned: false,
-        });
-        const result = await codeql.setupCodeQL(url, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
-        t.is(toolcache.findAllVersions("CodeQL").length, 1);
-        t.assert(toolcache.find("CodeQL", `2.15.0`));
-        t.is(result.toolsVersion, `2.15.0`);
-        t.is(result.toolsSource, setup_codeql_1.ToolsSource.Download);
-        if (result.toolsDownloadStatusReport) {
-            assertDurationsInteger(t, result.toolsDownloadStatusReport);
-        }
-    });
-});
-(0, ava_1.default)("downloads an explicitly requested bundle even if a different version is cached", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        await installIntoToolcache({
-            tagName: "codeql-bundle-20200601",
-            isPinned: true,
-            tmpDir,
-        });
-        const url = (0, testing_utils_1.mockBundleDownloadApi)({
-            tagName: "codeql-bundle-20200610",
-        });
-        const result = await codeql.setupCodeQL(url, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
-        t.assert(toolcache.find("CodeQL", "0.0.0-20200610"));
-        t.deepEqual(result.toolsVersion, "0.0.0-20200610");
-        t.is(result.toolsSource, setup_codeql_1.ToolsSource.Download);
-        if (result.toolsDownloadStatusReport) {
-            assertDurationsInteger(t, result.toolsDownloadStatusReport);
-        }
-    });
-});
-const EXPLICITLY_REQUESTED_BUNDLE_TEST_CASES = [
-    {
-        tagName: "codeql-bundle-2.17.6",
-        expectedToolcacheVersion: "2.17.6",
-    },
-    {
-        tagName: "codeql-bundle-20240805",
-        expectedToolcacheVersion: "0.0.0-20240805",
-    },
-];
-for (const { tagName, expectedToolcacheVersion, } of EXPLICITLY_REQUESTED_BUNDLE_TEST_CASES) {
-    (0, ava_1.default)(`caches explicitly requested bundle ${tagName} as ${expectedToolcacheVersion}`, async (t) => {
-        await util.withTmpDir(async (tmpDir) => {
-            (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-            mockApiDetails(testing_utils_1.SAMPLE_DOTCOM_API_DETAILS);
-            sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
-            const url = (0, testing_utils_1.mockBundleDownloadApi)({
-                tagName,
-            });
-            const result = await codeql.setupCodeQL(url, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
-            t.assert(toolcache.find("CodeQL", expectedToolcacheVersion));
-            t.deepEqual(result.toolsVersion, expectedToolcacheVersion);
-            t.is(result.toolsSource, setup_codeql_1.ToolsSource.Download);
-            t.assert(Number.isInteger(result.toolsDownloadStatusReport?.downloadDurationMs));
-        });
-    });
-}
-for (const toolcacheVersion of [
-    // Test that we use the tools from the toolcache when `SAMPLE_DEFAULT_CLI_VERSION` is requested
-    // and `SAMPLE_DEFAULT_CLI_VERSION-` is in the toolcache.
-    testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION.cliVersion,
-    `${testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION.cliVersion}-20230101`,
-]) {
-    (0, ava_1.default)(`uses tools from toolcache when ${testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION.cliVersion} is requested and ` +
-        `${toolcacheVersion} is installed`, async (t) => {
-        await util.withTmpDir(async (tmpDir) => {
-            (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-            sinon
-                .stub(toolcache, "find")
-                .withArgs("CodeQL", toolcacheVersion)
-                .returns("path/to/cached/codeql");
-            sinon.stub(toolcache, "findAllVersions").returns([toolcacheVersion]);
-            const result = await codeql.setupCodeQL(undefined, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
-            t.is(result.toolsVersion, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION.cliVersion);
-            t.is(result.toolsSource, setup_codeql_1.ToolsSource.Toolcache);
-            t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined);
-            t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined);
-            t.is(result.toolsDownloadStatusReport?.extractionDurationMs, undefined);
-        });
-    });
-}
-(0, ava_1.default)(`uses a cached bundle when no tools input is given on GHES`, async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        await installIntoToolcache({
-            tagName: "codeql-bundle-20200601",
-            isPinned: true,
-            tmpDir,
-        });
-        const result = await codeql.setupCodeQL(undefined, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.GHES, {
-            cliVersion: defaults.cliVersion,
-            tagName: defaults.bundleVersion,
-        }, (0, logging_1.getRunnerLogger)(true), false);
-        t.deepEqual(result.toolsVersion, "0.0.0-20200601");
-        t.is(result.toolsSource, setup_codeql_1.ToolsSource.Toolcache);
-        t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined);
-        t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined);
-        t.is(result.toolsDownloadStatusReport?.extractionDurationMs, undefined);
-        const cachedVersions = toolcache.findAllVersions("CodeQL");
-        t.is(cachedVersions.length, 1);
-    });
-});
-(0, ava_1.default)(`downloads bundle if only an unpinned version is cached on GHES`, async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        await installIntoToolcache({
-            tagName: "codeql-bundle-20200601",
-            isPinned: false,
-            tmpDir,
-        });
-        (0, testing_utils_1.mockBundleDownloadApi)({
-            tagName: defaults.bundleVersion,
-        });
-        const result = await codeql.setupCodeQL(undefined, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.GHES, {
-            cliVersion: defaults.cliVersion,
-            tagName: defaults.bundleVersion,
-        }, (0, logging_1.getRunnerLogger)(true), false);
-        t.deepEqual(result.toolsVersion, defaults.cliVersion);
-        t.is(result.toolsSource, setup_codeql_1.ToolsSource.Download);
-        if (result.toolsDownloadStatusReport) {
-            assertDurationsInteger(t, result.toolsDownloadStatusReport);
-        }
-        const cachedVersions = toolcache.findAllVersions("CodeQL");
-        t.is(cachedVersions.length, 2);
-    });
-});
-(0, ava_1.default)('downloads bundle if "latest" tools specified but not cached', async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        await installIntoToolcache({
-            tagName: "codeql-bundle-20200601",
-            isPinned: true,
-            tmpDir,
-        });
-        (0, testing_utils_1.mockBundleDownloadApi)({
-            tagName: defaults.bundleVersion,
-        });
-        const result = await codeql.setupCodeQL("latest", testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
-        t.deepEqual(result.toolsVersion, defaults.cliVersion);
-        t.is(result.toolsSource, setup_codeql_1.ToolsSource.Download);
-        if (result.toolsDownloadStatusReport) {
-            assertDurationsInteger(t, result.toolsDownloadStatusReport);
-        }
-        const cachedVersions = toolcache.findAllVersions("CodeQL");
-        t.is(cachedVersions.length, 2);
-    });
-});
-(0, ava_1.default)("bundle URL from another repo is cached as 0.0.0-bundleVersion", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        mockApiDetails(testing_utils_1.SAMPLE_DOTCOM_API_DETAILS);
-        sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
-        const releasesApiMock = mockReleaseApi({
-            assetNames: ["cli-version-2.14.6.txt"],
-            tagName: "codeql-bundle-20230203",
-        });
-        (0, testing_utils_1.mockBundleDownloadApi)({
-            repo: "codeql-testing/codeql-cli-nightlies",
-            platformSpecific: false,
-            tagName: "codeql-bundle-20230203",
-        });
-        const result = await codeql.setupCodeQL("https://github.com/codeql-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20230203/codeql-bundle.tar.gz", testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
-        t.is(result.toolsVersion, "0.0.0-20230203");
-        t.is(result.toolsSource, setup_codeql_1.ToolsSource.Download);
-        if (result.toolsDownloadStatusReport) {
-            assertDurationsInteger(t, result.toolsDownloadStatusReport);
-        }
-        const cachedVersions = toolcache.findAllVersions("CodeQL");
-        t.is(cachedVersions.length, 1);
-        t.is(cachedVersions[0], "0.0.0-20230203");
-        t.false(releasesApiMock.isDone());
-    });
-});
-function assertDurationsInteger(t, statusReport) {
-    t.assert(Number.isInteger(statusReport?.combinedDurationMs));
-    if (statusReport.downloadDurationMs !== undefined) {
-        t.assert(Number.isInteger(statusReport?.downloadDurationMs));
-        t.assert(Number.isInteger(statusReport?.extractionDurationMs));
-    }
-}
-(0, ava_1.default)("getExtraOptions works for explicit paths", (t) => {
-    t.deepEqual(codeql.getExtraOptions({}, ["foo"], []), []);
-    t.deepEqual(codeql.getExtraOptions({ foo: [42] }, ["foo"], []), ["42"]);
-    t.deepEqual(codeql.getExtraOptions({ foo: { bar: [42] } }, ["foo", "bar"], []), ["42"]);
-});
-(0, ava_1.default)("getExtraOptions works for wildcards", (t) => {
-    t.deepEqual(codeql.getExtraOptions({ "*": [42] }, ["foo"], []), ["42"]);
-});
-(0, ava_1.default)("getExtraOptions works for wildcards and explicit paths", (t) => {
-    const o1 = { "*": [42], foo: [87] };
-    t.deepEqual(codeql.getExtraOptions(o1, ["foo"], []), ["42", "87"]);
-    const o2 = { "*": [42], foo: [87] };
-    t.deepEqual(codeql.getExtraOptions(o2, ["foo", "bar"], []), ["42"]);
-    const o3 = { "*": [42], foo: { "*": [87], bar: [99] } };
-    const p = ["foo", "bar"];
-    t.deepEqual(codeql.getExtraOptions(o3, p, []), ["42", "87", "99"]);
-});
-(0, ava_1.default)("getExtraOptions throws for bad content", (t) => {
-    t.throws(() => codeql.getExtraOptions({ "*": 42 }, ["foo"], []));
-    t.throws(() => codeql.getExtraOptions({ foo: 87 }, ["foo"], []));
-    t.throws(() => codeql.getExtraOptions({ "*": [42], foo: { "*": 87, bar: [99] } }, ["foo", "bar"], []));
-});
-// Test macro for ensuring different variants of injected augmented configurations
-const injectedConfigMacro = ava_1.default.macro({
-    exec: async (t, augmentationProperties, configOverride, expectedConfig) => {
-        await util.withTmpDir(async (tempDir) => {
-            const runnerConstructorStub = stubToolRunnerConstructor();
-            const codeqlObject = await stubCodeql();
-            const thisStubConfig = {
-                ...stubConfig,
-                ...configOverride,
-                tempDir,
-                augmentationProperties,
-            };
-            await codeqlObject.databaseInitCluster(thisStubConfig, "", undefined, undefined, (0, logging_1.getRunnerLogger)(true));
-            const args = runnerConstructorStub.firstCall.args[1];
-            // should have used an config file
-            const configArg = args.find((arg) => arg.startsWith("--codescanning-config="));
-            t.truthy(configArg, "Should have injected a codescanning config");
-            const configFile = configArg.split("=")[1];
-            const augmentedConfig = yaml.load(fs.readFileSync(configFile, "utf8"));
-            t.deepEqual(augmentedConfig, expectedConfig);
-            await (0, del_1.default)(configFile, { force: true });
-        });
-    },
-    title: (providedTitle = "") => `databaseInitCluster() injected config: ${providedTitle}`,
-});
-(0, ava_1.default)("basic", injectedConfigMacro, {
-    ...config_utils_1.defaultAugmentationProperties,
-}, {}, {});
-(0, ava_1.default)("injected packs from input", injectedConfigMacro, {
-    ...config_utils_1.defaultAugmentationProperties,
-    packsInput: ["xxx", "yyy"],
-}, {}, {
-    packs: ["xxx", "yyy"],
-});
-(0, ava_1.default)("injected packs from input with existing packs combines", injectedConfigMacro, {
-    ...config_utils_1.defaultAugmentationProperties,
-    packsInputCombines: true,
-    packsInput: ["xxx", "yyy"],
-}, {
-    originalUserInput: {
-        packs: {
-            cpp: ["codeql/something-else"],
-        },
-    },
-}, {
-    packs: {
-        cpp: ["codeql/something-else", "xxx", "yyy"],
-    },
-});
-(0, ava_1.default)("injected packs from input with existing packs overrides", injectedConfigMacro, {
-    ...config_utils_1.defaultAugmentationProperties,
-    packsInput: ["xxx", "yyy"],
-}, {
-    originalUserInput: {
-        packs: {
-            cpp: ["codeql/something-else"],
-        },
-    },
-}, {
-    packs: ["xxx", "yyy"],
-});
-// similar, but with queries
-(0, ava_1.default)("injected queries from input", injectedConfigMacro, {
-    ...config_utils_1.defaultAugmentationProperties,
-    queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
-}, {}, {
-    queries: [
-        {
-            uses: "xxx",
-        },
-        {
-            uses: "yyy",
-        },
-    ],
-});
-(0, ava_1.default)("injected queries from input overrides", injectedConfigMacro, {
-    ...config_utils_1.defaultAugmentationProperties,
-    queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
-}, {
-    originalUserInput: {
-        queries: [{ uses: "zzz" }],
-    },
-}, {
-    queries: [
-        {
-            uses: "xxx",
-        },
-        {
-            uses: "yyy",
-        },
-    ],
-});
-(0, ava_1.default)("injected queries from input combines", injectedConfigMacro, {
-    ...config_utils_1.defaultAugmentationProperties,
-    queriesInputCombines: true,
-    queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
-}, {
-    originalUserInput: {
-        queries: [{ uses: "zzz" }],
-    },
-}, {
-    queries: [
-        {
-            uses: "zzz",
-        },
-        {
-            uses: "xxx",
-        },
-        {
-            uses: "yyy",
-        },
-    ],
-});
-(0, ava_1.default)("injected queries from input combines 2", injectedConfigMacro, {
-    ...config_utils_1.defaultAugmentationProperties,
-    queriesInputCombines: true,
-    packsInputCombines: true,
-    queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
-}, {}, {
-    queries: [
-        {
-            uses: "xxx",
-        },
-        {
-            uses: "yyy",
-        },
-    ],
-});
-(0, ava_1.default)("injected queries and packs, but empty", injectedConfigMacro, {
-    ...config_utils_1.defaultAugmentationProperties,
-    queriesInputCombines: true,
-    packsInputCombines: true,
-    queriesInput: [],
-    packsInput: [],
-}, {
-    originalUserInput: {
-        packs: [],
-        queries: [],
-    },
-}, {});
-(0, ava_1.default)("passes a code scanning config AND qlconfig to the CLI", async (t) => {
-    await util.withTmpDir(async (tempDir) => {
-        const runnerConstructorStub = stubToolRunnerConstructor();
-        const codeqlObject = await stubCodeql();
-        await codeqlObject.databaseInitCluster({ ...stubConfig, tempDir }, "", undefined, "/path/to/qlconfig.yml", (0, logging_1.getRunnerLogger)(true));
-        const args = runnerConstructorStub.firstCall.args[1];
-        // should have used a config file
-        const hasCodeScanningConfigArg = args.some((arg) => arg.startsWith("--codescanning-config="));
-        t.true(hasCodeScanningConfigArg, "Should have injected a qlconfig");
-        // should have passed a qlconfig file
-        const hasQlconfigArg = args.some((arg) => arg.startsWith("--qlconfig-file="));
-        t.truthy(hasQlconfigArg, "Should have injected a codescanning config");
-    });
-});
-(0, ava_1.default)("does not pass a qlconfig to the CLI when it is undefined", async (t) => {
-    await util.withTmpDir(async (tempDir) => {
-        const runnerConstructorStub = stubToolRunnerConstructor();
-        const codeqlObject = await stubCodeql();
-        await codeqlObject.databaseInitCluster({ ...stubConfig, tempDir }, "", undefined, undefined, // undefined qlconfigFile
-        (0, logging_1.getRunnerLogger)(true));
-        const args = runnerConstructorStub.firstCall.args[1];
-        const hasQlconfigArg = args.some((arg) => arg.startsWith("--qlconfig-file="));
-        t.false(hasQlconfigArg, "should NOT have injected a qlconfig");
-    });
-});
-const NEW_ANALYSIS_SUMMARY_TEST_CASES = [
-    {
-        codeqlVersion: (0, testing_utils_1.makeVersionInfo)("2.15.0", {
-            [tools_features_1.ToolsFeature.AnalysisSummaryV2IsDefault]: true,
-        }),
-        githubVersion: {
-            type: util.GitHubVariant.DOTCOM,
-        },
-        flagPassed: false,
-        negativeFlagPassed: false,
-    },
-    {
-        codeqlVersion: (0, testing_utils_1.makeVersionInfo)("2.15.0"),
-        githubVersion: {
-            type: util.GitHubVariant.DOTCOM,
-        },
-        flagPassed: true,
-        negativeFlagPassed: false,
-    },
-    {
-        codeqlVersion: (0, testing_utils_1.makeVersionInfo)("2.15.0"),
-        githubVersion: {
-            type: util.GitHubVariant.GHES,
-            version: "3.10.0",
-        },
-        flagPassed: true,
-        negativeFlagPassed: false,
-    },
-];
-for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of NEW_ANALYSIS_SUMMARY_TEST_CASES) {
-    (0, ava_1.default)(`database interpret-results passes ${flagPassed
-        ? "--new-analysis-summary"
-        : negativeFlagPassed
-            ? "--no-new-analysis-summary"
-            : "nothing"} for CodeQL version ${JSON.stringify(codeqlVersion)} and ${util.GitHubVariant[githubVersion.type]} ${githubVersion.version ? ` ${githubVersion.version}` : ""}`, async (t) => {
-        const runnerConstructorStub = stubToolRunnerConstructor();
-        const codeqlObject = await codeql.getCodeQLForTesting();
-        sinon.stub(codeqlObject, "getVersion").resolves(codeqlVersion);
-        // io throws because of the test CodeQL object.
-        sinon.stub(io, "which").resolves("");
-        await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", undefined, "", Object.assign({}, stubConfig, { gitHubVersion: githubVersion }), (0, testing_utils_1.createFeatures)([]));
-        const actualArgs = runnerConstructorStub.firstCall.args[1];
-        t.is(actualArgs.includes("--new-analysis-summary"), flagPassed, `--new-analysis-summary should${flagPassed ? "" : "n't"} be passed`);
-        t.is(actualArgs.includes("--no-new-analysis-summary"), negativeFlagPassed, `--no-new-analysis-summary should${negativeFlagPassed ? "" : "n't"} be passed`);
-    });
-}
-(0, ava_1.default)("runTool summarizes several fatal errors", async (t) => {
-    const heapError = "A fatal error occurred: Evaluator heap must be at least 384.00 MiB";
-    const datasetImportError = "A fatal error occurred: Dataset import for /home/runner/work/_temp/codeql_databases/javascript/db-javascript failed with code 2";
-    const cliStderr = `Running TRAP import for CodeQL database at /home/runner/work/_temp/codeql_databases/javascript...\n` +
-        `${heapError}\n${datasetImportError}.`;
-    stubToolRunnerConstructor(32, cliStderr);
-    const codeqlObject = await stubCodeql();
-    // io throws because of the test CodeQL object.
-    sinon.stub(io, "which").resolves("");
-    await t.throwsAsync(async () => await codeqlObject.finalizeDatabase("db", "--threads=2", "--ram=2048", false), {
-        instanceOf: util.ConfigurationError,
-        message: new RegExp('Encountered a fatal error while running \\"codeql-for-testing database finalize --finalize-dataset --threads=2 --ram=2048 db\\"\\. ' +
-            `Exit code was 32 and error was: ${datasetImportError.replaceAll(".", "\\.")}\\. Context: ${heapError.replaceAll(".", "\\.")}\\. See the logs for more details\\.`),
-    });
-});
-(0, ava_1.default)("runTool summarizes autobuilder errors", async (t) => {
-    const stderr = `
-    [2019-09-18 12:00:00] [autobuild] A non-error message
-    [2019-09-18 12:00:00] Untagged message
-    [2019-09-18 12:00:00] [autobuild] [ERROR] Start of the error message
-    [2019-09-18 12:00:00] [autobuild] An interspersed non-error message
-    [2019-09-18 12:00:01] [autobuild] [ERROR]   Some more context about the error message
-    [2019-09-18 12:00:01] [autobuild] [ERROR]   continued
-    [2019-09-18 12:00:01] [autobuild] [ERROR]   and finished here.
-    [2019-09-18 12:00:01] [autobuild] A non-error message
-  `;
-    stubToolRunnerConstructor(1, stderr);
-    const codeqlObject = await codeql.getCodeQLForTesting();
-    sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
-    sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
-    // io throws because of the test CodeQL object.
-    sinon.stub(io, "which").resolves("");
-    await t.throwsAsync(async () => await codeqlObject.runAutobuild(stubConfig, languages_1.KnownLanguage.java), {
-        instanceOf: util.ConfigurationError,
-        message: "We were unable to automatically build your code. Please provide manual build steps. " +
-            `See ${doc_url_1.DocUrl.AUTOMATIC_BUILD_FAILED} for more information. ` +
-            "Encountered the following error: Start of the error message\n" +
-            "  Some more context about the error message\n" +
-            "  continued\n" +
-            "  and finished here.",
-    });
-});
-(0, ava_1.default)("runTool truncates long autobuilder errors", async (t) => {
-    const stderr = Array.from({ length: 20 }, (_, i) => `[2019-09-18 12:00:00] [autobuild] [ERROR] line${i + 1}`).join("\n");
-    stubToolRunnerConstructor(1, stderr);
-    const codeqlObject = await stubCodeql();
-    sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
-    // io throws because of the test CodeQL object.
-    sinon.stub(io, "which").resolves("");
-    await t.throwsAsync(async () => await codeqlObject.runAutobuild(stubConfig, languages_1.KnownLanguage.java), {
-        instanceOf: util.ConfigurationError,
-        message: "We were unable to automatically build your code. Please provide manual build steps. " +
-            `See ${doc_url_1.DocUrl.AUTOMATIC_BUILD_FAILED} for more information. ` +
-            "Encountered the following error: " +
-            `${Array.from({ length: 10 }, (_, i) => `line${i + 1}`).join("\n")}\n(truncated)`,
-    });
-});
-(0, ava_1.default)("runTool recognizes fatal internal errors", async (t) => {
-    const stderr = `
-    [11/31 eval 8m19s] Evaluation done; writing results to codeql/go-queries/Security/CWE-020/MissingRegexpAnchor.bqrs.
-    Oops! A fatal internal error occurred. Details:
-    com.semmle.util.exception.CatastrophicError: An error occurred while evaluating ControlFlowGraph::ControlFlow::Root.isRootOf/1#dispred#f610e6ed/2@86282cc8
-    Severe disk cache trouble (corruption or out of space) at /home/runner/work/_temp/codeql_databases/go/db-go/default/cache/pages/28/33.pack: Failed to write item to disk`;
-    stubToolRunnerConstructor(1, stderr);
-    const codeqlObject = await codeql.getCodeQLForTesting();
-    sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
-    sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
-    // io throws because of the test CodeQL object.
-    sinon.stub(io, "which").resolves("");
-    await t.throwsAsync(async () => await codeqlObject.databaseRunQueries(stubConfig.dbLocation, []), {
-        instanceOf: cli_errors_1.CliError,
-        message: `Encountered a fatal error while running "codeql-for-testing database run-queries  --intra-layer-parallelism --min-disk-free=1024 -v". Exit code was 1 and error was: Oops! A fatal internal error occurred. Details:
-    com.semmle.util.exception.CatastrophicError: An error occurred while evaluating ControlFlowGraph::ControlFlow::Root.isRootOf/1#dispred#f610e6ed/2@86282cc8
-    Severe disk cache trouble (corruption or out of space) at /home/runner/work/_temp/codeql_databases/go/db-go/default/cache/pages/28/33.pack: Failed to write item to disk. See the logs for more details.`,
-    });
-});
-(0, ava_1.default)("runTool outputs last line of stderr if fatal error could not be found", async (t) => {
-    const cliStderr = "line1\nline2\nline3\nline4\nline5";
-    stubToolRunnerConstructor(32, cliStderr);
-    const codeqlObject = await stubCodeql();
-    // io throws because of the test CodeQL object.
-    sinon.stub(io, "which").resolves("");
-    await t.throwsAsync(async () => await codeqlObject.finalizeDatabase("db", "--threads=2", "--ram=2048", false), {
-        instanceOf: util.ConfigurationError,
-        message: new RegExp('Encountered a fatal error while running \\"codeql-for-testing database finalize --finalize-dataset --threads=2 --ram=2048 db\\"\\. ' +
-            "Exit code was 32 and last log line was: line5\\. See the logs for more details\\."),
-    });
-});
-(0, ava_1.default)("Avoids duplicating --overwrite flag if specified in CODEQL_ACTION_EXTRA_OPTIONS", async (t) => {
-    const runnerConstructorStub = stubToolRunnerConstructor();
-    const codeqlObject = await stubCodeql();
-    // io throws because of the test CodeQL object.
-    sinon.stub(io, "which").resolves("");
-    process.env["CODEQL_ACTION_EXTRA_OPTIONS"] =
-        '{ "database": { "init": ["--overwrite"] } }';
-    await codeqlObject.databaseInitCluster(stubConfig, "sourceRoot", undefined, undefined, (0, logging_1.getRunnerLogger)(false));
-    t.true(runnerConstructorStub.calledOnce);
-    const args = runnerConstructorStub.firstCall.args[1];
-    t.is(args.filter((option) => option === "--overwrite").length, 1, "--overwrite should only be passed once");
-    // Clean up
-    const configArg = args.find((arg) => arg.startsWith("--codescanning-config="));
-    t.truthy(configArg, "Should have injected a codescanning config");
-    const configFile = configArg.split("=")[1];
-    await (0, del_1.default)(configFile, { force: true });
-});
-function stubToolRunnerConstructor(exitCode = 0, stderr) {
-    const runnerObjectStub = sinon.createStubInstance(toolrunner.ToolRunner);
-    const runnerConstructorStub = sinon.stub(toolrunner, "ToolRunner");
-    let stderrListener = undefined;
-    runnerConstructorStub.callsFake((_cmd, _args, options) => {
-        stderrListener = options.listeners?.stderr;
-        return runnerObjectStub;
-    });
-    runnerObjectStub.exec.callsFake(async () => {
-        if (stderrListener !== undefined && stderr !== undefined) {
-            stderrListener(Buffer.from(stderr));
-        }
-        return exitCode;
-    });
-    return runnerConstructorStub;
-}
-//# sourceMappingURL=codeql.test.js.map

lib/config-utils.js

@@ -1,923 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.defaultAugmentationProperties = void 0;
-exports.getPacksStrInvalid = getPacksStrInvalid;
-exports.getConfigFileOutsideWorkspaceErrorMessage = getConfigFileOutsideWorkspaceErrorMessage;
-exports.getConfigFileDoesNotExistErrorMessage = getConfigFileDoesNotExistErrorMessage;
-exports.getConfigFileRepoFormatInvalidMessage = getConfigFileRepoFormatInvalidMessage;
-exports.getConfigFileFormatInvalidMessage = getConfigFileFormatInvalidMessage;
-exports.getConfigFileDirectoryGivenMessage = getConfigFileDirectoryGivenMessage;
-exports.getNoLanguagesError = getNoLanguagesError;
-exports.getUnknownLanguagesError = getUnknownLanguagesError;
-exports.getSupportedLanguageMap = getSupportedLanguageMap;
-exports.hasActionsWorkflows = hasActionsWorkflows;
-exports.getRawLanguagesInRepo = getRawLanguagesInRepo;
-exports.getLanguages = getLanguages;
-exports.getRawLanguagesNoAutodetect = getRawLanguagesNoAutodetect;
-exports.getRawLanguages = getRawLanguages;
-exports.getDefaultConfig = getDefaultConfig;
-exports.calculateAugmentation = calculateAugmentation;
-exports.getOverlayDatabaseMode = getOverlayDatabaseMode;
-exports.parsePacksFromInput = parsePacksFromInput;
-exports.parsePacksSpecification = parsePacksSpecification;
-exports.validatePackSpecification = validatePackSpecification;
-exports.initConfig = initConfig;
-exports.parseRegistriesWithoutCredentials = parseRegistriesWithoutCredentials;
-exports.getPathToParsedConfigFile = getPathToParsedConfigFile;
-exports.getConfig = getConfig;
-exports.generateRegistries = generateRegistries;
-exports.wrapEnvironment = wrapEnvironment;
-exports.parseBuildModeInput = parseBuildModeInput;
-exports.generateCodeScanningConfig = generateCodeScanningConfig;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const perf_hooks_1 = require("perf_hooks");
-const yaml = __importStar(require("js-yaml"));
-const semver = __importStar(require("semver"));
-const actions_util_1 = require("./actions-util");
-const api = __importStar(require("./api-client"));
-const caching_utils_1 = require("./caching-utils");
-const diff_informed_analysis_utils_1 = require("./diff-informed-analysis-utils");
-const feature_flags_1 = require("./feature-flags");
-const git_utils_1 = require("./git-utils");
-const languages_1 = require("./languages");
-const overlay_database_utils_1 = require("./overlay-database-utils");
-const trap_caching_1 = require("./trap-caching");
-const util_1 = require("./util");
-// Property names from the user-supplied config file.
-const PACKS_PROPERTY = "packs";
-/**
- * The default, empty augmentation properties. This is most useful
- * for tests.
- */
-exports.defaultAugmentationProperties = {
-    queriesInputCombines: false,
-    packsInputCombines: false,
-    packsInput: undefined,
-    queriesInput: undefined,
-    qualityQueriesInput: undefined,
-    extraQueryExclusions: [],
-    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
-    useOverlayDatabaseCaching: false,
-};
-function getPacksStrInvalid(packStr, configFile) {
-    return configFile
-        ? getConfigFilePropertyError(configFile, PACKS_PROPERTY, `"${packStr}" is not a valid pack`)
-        : `"${packStr}" is not a valid pack`;
-}
-function getConfigFileOutsideWorkspaceErrorMessage(configFile) {
-    return `The configuration file "${configFile}" is outside of the workspace`;
-}
-function getConfigFileDoesNotExistErrorMessage(configFile) {
-    return `The configuration file "${configFile}" does not exist`;
-}
-function getConfigFileRepoFormatInvalidMessage(configFile) {
-    let error = `The configuration file "${configFile}" is not a supported remote file reference.`;
-    error += " Expected format <owner>/<repository>/<file-path>@<ref>";
-    return error;
-}
-function getConfigFileFormatInvalidMessage(configFile) {
-    return `The configuration file "${configFile}" could not be read`;
-}
-function getConfigFileDirectoryGivenMessage(configFile) {
-    return `The configuration file "${configFile}" looks like a directory, not a file`;
-}
-function getConfigFilePropertyError(configFile, property, error) {
-    if (configFile === undefined) {
-        return `The workflow property "${property}" is invalid: ${error}`;
-    }
-    else {
-        return `The configuration file "${configFile}" is invalid: property "${property}" ${error}`;
-    }
-}
-function getNoLanguagesError() {
-    return ("Did not detect any languages to analyze. " +
-        "Please update input in workflow or check that GitHub detects the correct languages in your repository.");
-}
-function getUnknownLanguagesError(languages) {
-    return `Did not recognize the following languages: ${languages.join(", ")}`;
-}
-async function getSupportedLanguageMap(codeql) {
-    const resolveResult = await codeql.betterResolveLanguages();
-    const supportedLanguages = {};
-    // Populate canonical language names
-    for (const extractor of Object.keys(resolveResult.extractors)) {
-        // Require the language to be a known language.
-        // This is a temporary workaround since we have extractors that are not
-        // supported languages, such as `csv`, `html`, `properties`, `xml`, and
-        // `yaml`. We should replace this with a more robust solution in the future.
-        if (languages_1.KnownLanguage[extractor] !== undefined) {
-            supportedLanguages[extractor] = extractor;
-        }
-    }
-    // Populate language aliases
-    if (resolveResult.aliases) {
-        for (const [alias, extractor] of Object.entries(resolveResult.aliases)) {
-            supportedLanguages[alias] = extractor;
-        }
-    }
-    return supportedLanguages;
-}
-const baseWorkflowsPath = ".github/workflows";
-/**
- * Determines if there exists a `.github/workflows` directory with at least
- * one file in it, which we use as an indicator that there are Actions
- * workflows in the workspace. This doesn't perfectly detect whether there
- * are actually workflows, but should be a good approximation.
- *
- * Alternatively, we could check specifically for yaml files, or call the
- * API to check if it knows about workflows.
- *
- * @returns True if the non-empty directory exists, false if not.
- */
-function hasActionsWorkflows(sourceRoot) {
-    const workflowsPath = path.resolve(sourceRoot, baseWorkflowsPath);
-    const stats = fs.lstatSync(workflowsPath);
-    return (stats !== undefined &&
-        stats.isDirectory() &&
-        fs.readdirSync(workflowsPath).length > 0);
-}
-/**
- * Gets the set of languages in the current repository.
- */
-async function getRawLanguagesInRepo(repository, sourceRoot, logger) {
-    logger.debug(`Automatically detecting languages (${repository.owner}/${repository.repo})`);
-    const response = await api.getApiClient().rest.repos.listLanguages({
-        owner: repository.owner,
-        repo: repository.repo,
-    });
-    logger.debug(`Languages API response: ${JSON.stringify(response)}`);
-    const result = Object.keys(response.data).map((language) => language.trim().toLowerCase());
-    if (hasActionsWorkflows(sourceRoot)) {
-        logger.debug(`Found a .github/workflows directory`);
-        result.push("actions");
-    }
-    logger.debug(`Raw languages in repository: ${result.join(", ")}`);
-    return result;
-}
-/**
- * Get the languages to analyse.
- *
- * The result is obtained from the action input parameter 'languages' if that
- * has been set, otherwise it is deduced as all languages in the repo that
- * can be analysed.
- *
- * If no languages could be detected from either the workflow or the repository
- * then throw an error.
- */
-async function getLanguages(codeql, languagesInput, repository, sourceRoot, logger) {
-    // Obtain languages without filtering them.
-    const { rawLanguages, autodetected } = await getRawLanguages(languagesInput, repository, sourceRoot, logger);
-    const languageMap = await getSupportedLanguageMap(codeql);
-    const languagesSet = new Set();
-    const unknownLanguages = [];
-    // Make sure they are supported
-    for (const language of rawLanguages) {
-        const extractorName = languageMap[language];
-        if (extractorName === undefined) {
-            unknownLanguages.push(language);
-        }
-        else {
-            languagesSet.add(extractorName);
-        }
-    }
-    const languages = Array.from(languagesSet);
-    if (!autodetected && unknownLanguages.length > 0) {
-        throw new util_1.ConfigurationError(getUnknownLanguagesError(unknownLanguages));
-    }
-    // If the languages parameter was not given and no languages were
-    // detected then fail here as this is a workflow configuration error.
-    if (languages.length === 0) {
-        throw new util_1.ConfigurationError(getNoLanguagesError());
-    }
-    if (autodetected) {
-        logger.info(`Autodetected languages: ${languages.join(", ")}`);
-    }
-    else {
-        logger.info(`Languages from configuration: ${languages.join(", ")}`);
-    }
-    return languages;
-}
-function getRawLanguagesNoAutodetect(languagesInput) {
-    return (languagesInput || "")
-        .split(",")
-        .map((x) => x.trim().toLowerCase())
-        .filter((x) => x.length > 0);
-}
-/**
- * Gets the set of languages in the current repository without checking to
- * see if these languages are actually supported by CodeQL.
- *
- * @param languagesInput The languages from the workflow input
- * @param repository the owner/name of the repository
- * @param logger a logger
- * @returns A tuple containing a list of languages in this repository that might be
- * analyzable and whether or not this list was determined automatically.
- */
-async function getRawLanguages(languagesInput, repository, sourceRoot, logger) {
-    // If the user has specified languages, use those.
-    const languagesFromInput = getRawLanguagesNoAutodetect(languagesInput);
-    if (languagesFromInput.length > 0) {
-        return { rawLanguages: languagesFromInput, autodetected: false };
-    }
-    // Otherwise, autodetect languages in the repository.
-    return {
-        rawLanguages: await getRawLanguagesInRepo(repository, sourceRoot, logger),
-        autodetected: true,
-    };
-}
-/**
- * Get the default config, populated without user configuration file.
- */
-async function getDefaultConfig({ languagesInput, queriesInput, qualityQueriesInput, packsInput, buildModeInput, dbLocation, trapCachingEnabled, dependencyCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeql, sourceRoot, githubVersion, features, logger, }) {
-    const languages = await getLanguages(codeql, languagesInput, repository, sourceRoot, logger);
-    const buildMode = await parseBuildModeInput(buildModeInput, languages, features, logger);
-    const augmentationProperties = await calculateAugmentation(packsInput, queriesInput, qualityQueriesInput, languages);
-    const { trapCaches, trapCacheDownloadTime } = await downloadCacheWithTime(trapCachingEnabled, codeql, languages, logger);
-    return {
-        languages,
-        buildMode,
-        originalUserInput: {},
-        tempDir,
-        codeQLCmd: codeql.getPath(),
-        gitHubVersion: githubVersion,
-        dbLocation: dbLocationOrDefault(dbLocation, tempDir),
-        debugMode,
-        debugArtifactName,
-        debugDatabaseName,
-        augmentationProperties,
-        trapCaches,
-        trapCacheDownloadTime,
-        dependencyCachingEnabled: (0, caching_utils_1.getCachingKind)(dependencyCachingEnabled),
-    };
-}
-async function downloadCacheWithTime(trapCachingEnabled, codeQL, languages, logger) {
-    let trapCaches = {};
-    let trapCacheDownloadTime = 0;
-    if (trapCachingEnabled) {
-        const start = perf_hooks_1.performance.now();
-        trapCaches = await (0, trap_caching_1.downloadTrapCaches)(codeQL, languages, logger);
-        trapCacheDownloadTime = perf_hooks_1.performance.now() - start;
-    }
-    return { trapCaches, trapCacheDownloadTime };
-}
-async function loadUserConfig(configFile, workspacePath, apiDetails, tempDir) {
-    if (isLocal(configFile)) {
-        if (configFile !== userConfigFromActionPath(tempDir)) {
-            // If the config file is not generated by the Action, it should be relative to the workspace.
-            configFile = path.resolve(workspacePath, configFile);
-            // Error if the config file is now outside of the workspace
-            if (!(configFile + path.sep).startsWith(workspacePath + path.sep)) {
-                throw new util_1.ConfigurationError(getConfigFileOutsideWorkspaceErrorMessage(configFile));
-            }
-        }
-        return getLocalConfig(configFile);
-    }
-    else {
-        return await getRemoteConfig(configFile, apiDetails);
-    }
-}
-/**
- * Calculates how the codeql config file needs to be augmented before passing
- * it to the CLI. The reason this is necessary is the codeql-action can be called
- * with extra inputs from the workflow. These inputs are not part of the config
- * and the CLI does not know about these inputs so we need to inject them into
- * the config file sent to the CLI.
- *
- * @param rawPacksInput The packs input from the action configuration.
- * @param rawQueriesInput The queries input from the action configuration.
- * @param languages The languages that the config file is for. If the packs input
- *    is non-empty, then there must be exactly one language. Otherwise, an
- *    error is thrown.
- *
- * @returns The properties that need to be augmented in the config file.
- *
- * @throws An error if the packs input is non-empty and the languages input does
- *     not have exactly one language.
- */
-// exported for testing.
-async function calculateAugmentation(rawPacksInput, rawQueriesInput, rawQualityQueriesInput, languages) {
-    const packsInputCombines = shouldCombine(rawPacksInput);
-    const packsInput = parsePacksFromInput(rawPacksInput, languages, packsInputCombines);
-    const queriesInputCombines = shouldCombine(rawQueriesInput);
-    const queriesInput = parseQueriesFromInput(rawQueriesInput, queriesInputCombines);
-    const qualityQueriesInput = parseQueriesFromInput(rawQualityQueriesInput, false);
-    return {
-        packsInputCombines,
-        packsInput: packsInput?.[languages[0]],
-        queriesInput,
-        queriesInputCombines,
-        qualityQueriesInput,
-        extraQueryExclusions: [],
-        overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
-        useOverlayDatabaseCaching: false,
-    };
-}
-function parseQueriesFromInput(rawQueriesInput, queriesInputCombines) {
-    if (!rawQueriesInput) {
-        return undefined;
-    }
-    const trimmedInput = queriesInputCombines
-        ? rawQueriesInput.trim().slice(1).trim()
-        : (rawQueriesInput?.trim() ?? "");
-    if (queriesInputCombines && trimmedInput.length === 0) {
-        throw new util_1.ConfigurationError(getConfigFilePropertyError(undefined, "queries", "A '+' was used in the 'queries' input to specify that you wished to add some packs to your CodeQL analysis. However, no packs were specified. Please either remove the '+' or specify some packs."));
-    }
-    return trimmedInput.split(",").map((query) => ({ uses: query.trim() }));
-}
-const OVERLAY_ANALYSIS_FEATURES = {
-    actions: feature_flags_1.Feature.OverlayAnalysisActions,
-    cpp: feature_flags_1.Feature.OverlayAnalysisCpp,
-    csharp: feature_flags_1.Feature.OverlayAnalysisCsharp,
-    go: feature_flags_1.Feature.OverlayAnalysisGo,
-    java: feature_flags_1.Feature.OverlayAnalysisJava,
-    javascript: feature_flags_1.Feature.OverlayAnalysisJavascript,
-    python: feature_flags_1.Feature.OverlayAnalysisPython,
-    ruby: feature_flags_1.Feature.OverlayAnalysisRuby,
-    rust: feature_flags_1.Feature.OverlayAnalysisRust,
-    swift: feature_flags_1.Feature.OverlayAnalysisSwift,
-};
-const OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
-    actions: feature_flags_1.Feature.OverlayAnalysisCodeScanningActions,
-    cpp: feature_flags_1.Feature.OverlayAnalysisCodeScanningCpp,
-    csharp: feature_flags_1.Feature.OverlayAnalysisCodeScanningCsharp,
-    go: feature_flags_1.Feature.OverlayAnalysisCodeScanningGo,
-    java: feature_flags_1.Feature.OverlayAnalysisCodeScanningJava,
-    javascript: feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript,
-    python: feature_flags_1.Feature.OverlayAnalysisCodeScanningPython,
-    ruby: feature_flags_1.Feature.OverlayAnalysisCodeScanningRuby,
-    rust: feature_flags_1.Feature.OverlayAnalysisCodeScanningRust,
-    swift: feature_flags_1.Feature.OverlayAnalysisCodeScanningSwift,
-};
-async function isOverlayAnalysisFeatureEnabled(repository, features, codeql, languages, codeScanningConfig) {
-    // TODO: Remove the repository owner check once support for overlay analysis
-    // stabilizes, and no more backward-incompatible changes are expected.
-    if (!["github", "dsp-testing"].includes(repository.owner)) {
-        return false;
-    }
-    if (!(await features.getValue(feature_flags_1.Feature.OverlayAnalysis, codeql))) {
-        return false;
-    }
-    let enableForCodeScanningOnly = false;
-    for (const language of languages) {
-        const feature = OVERLAY_ANALYSIS_FEATURES[language];
-        if (feature && (await features.getValue(feature, codeql))) {
-            continue;
-        }
-        const codeScanningFeature = OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES[language];
-        if (codeScanningFeature &&
-            (await features.getValue(codeScanningFeature, codeql))) {
-            enableForCodeScanningOnly = true;
-            continue;
-        }
-        return false;
-    }
-    if (enableForCodeScanningOnly) {
-        // A code-scanning configuration runs only the (default) code-scanning suite
-        // if the default queries are not disabled, and no packs, queries, or
-        // query-filters are specified.
-        return (codeScanningConfig["disable-default-queries"] !== true &&
-            codeScanningConfig.packs === undefined &&
-            codeScanningConfig.queries === undefined &&
-            codeScanningConfig["query-filters"] === undefined);
-    }
-    return true;
-}
-/**
- * Calculate and validate the overlay database mode and caching to use.
- *
- * - If the environment variable `CODEQL_OVERLAY_DATABASE_MODE` is set, use it.
- *   In this case, the workflow is responsible for managing database storage and
- *   retrieval, and the action will not perform overlay database caching. Think
- *   of it as a "manual control" mode where the calling workflow is responsible
- *   for making sure that everything is set up correctly.
- * - Otherwise, if `Feature.OverlayAnalysis` is enabled, calculate the mode
- *   based on what we are analyzing. Think of it as a "automatic control" mode
- *   where the action will do the right thing by itself.
- *   - If we are analyzing a pull request, use `Overlay` with caching.
- *   - If we are analyzing the default branch, use `OverlayBase` with caching.
- * - Otherwise, use `None`.
- *
- * For `Overlay` and `OverlayBase`, the function performs further checks and
- * reverts to `None` if any check should fail.
- *
- * @returns An object containing the overlay database mode and whether the
- * action should perform overlay-base database caching.
- */
-async function getOverlayDatabaseMode(codeql, repository, features, languages, sourceRoot, buildMode, codeScanningConfig, logger) {
-    let overlayDatabaseMode = overlay_database_utils_1.OverlayDatabaseMode.None;
-    let useOverlayDatabaseCaching = false;
-    const modeEnv = process.env.CODEQL_OVERLAY_DATABASE_MODE;
-    // Any unrecognized CODEQL_OVERLAY_DATABASE_MODE value will be ignored and
-    // treated as if the environment variable was not set.
-    if (modeEnv === overlay_database_utils_1.OverlayDatabaseMode.Overlay ||
-        modeEnv === overlay_database_utils_1.OverlayDatabaseMode.OverlayBase ||
-        modeEnv === overlay_database_utils_1.OverlayDatabaseMode.None) {
-        overlayDatabaseMode = modeEnv;
-        logger.info(`Setting overlay database mode to ${overlayDatabaseMode} ` +
-            "from the CODEQL_OVERLAY_DATABASE_MODE environment variable.");
-    }
-    else if (await isOverlayAnalysisFeatureEnabled(repository, features, codeql, languages, codeScanningConfig)) {
-        if ((0, actions_util_1.isAnalyzingPullRequest)()) {
-            overlayDatabaseMode = overlay_database_utils_1.OverlayDatabaseMode.Overlay;
-            useOverlayDatabaseCaching = true;
-            logger.info(`Setting overlay database mode to ${overlayDatabaseMode} ` +
-                "with caching because we are analyzing a pull request.");
-        }
-        else if (await (0, git_utils_1.isAnalyzingDefaultBranch)()) {
-            overlayDatabaseMode = overlay_database_utils_1.OverlayDatabaseMode.OverlayBase;
-            useOverlayDatabaseCaching = true;
-            logger.info(`Setting overlay database mode to ${overlayDatabaseMode} ` +
-                "with caching because we are analyzing the default branch.");
-        }
-    }
-    const nonOverlayAnalysis = {
-        overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
-        useOverlayDatabaseCaching: false,
-    };
-    if (overlayDatabaseMode === overlay_database_utils_1.OverlayDatabaseMode.None) {
-        return nonOverlayAnalysis;
-    }
-    if (buildMode !== util_1.BuildMode.None &&
-        (await Promise.all(languages.map(async (l) => await codeql.isTracedLanguage(l)))).some(Boolean)) {
-        logger.warning(`Cannot build an ${overlayDatabaseMode} database because ` +
-            `build-mode is set to "${buildMode}" instead of "none". ` +
-            "Falling back to creating a normal full database instead.");
-        return nonOverlayAnalysis;
-    }
-    if (!(await (0, util_1.codeQlVersionAtLeast)(codeql, overlay_database_utils_1.CODEQL_OVERLAY_MINIMUM_VERSION))) {
-        logger.warning(`Cannot build an ${overlayDatabaseMode} database because ` +
-            `the CodeQL CLI is older than ${overlay_database_utils_1.CODEQL_OVERLAY_MINIMUM_VERSION}. ` +
-            "Falling back to creating a normal full database instead.");
-        return nonOverlayAnalysis;
-    }
-    if ((await (0, git_utils_1.getGitRoot)(sourceRoot)) === undefined) {
-        logger.warning(`Cannot build an ${overlayDatabaseMode} database because ` +
-            `the source root "${sourceRoot}" is not inside a git repository. ` +
-            "Falling back to creating a normal full database instead.");
-        return nonOverlayAnalysis;
-    }
-    return {
-        overlayDatabaseMode,
-        useOverlayDatabaseCaching,
-    };
-}
-/**
- * Pack names must be in the form of `scope/name`, with only alpha-numeric characters,
- * and `-` allowed as long as not the first or last char.
- **/
-const PACK_IDENTIFIER_PATTERN = (function () {
-    const alphaNumeric = "[a-z0-9]";
-    const alphaNumericDash = "[a-z0-9-]";
-    const component = `${alphaNumeric}(${alphaNumericDash}*${alphaNumeric})?`;
-    return new RegExp(`^${component}/${component}$`);
-})();
-// Exported for testing
-function parsePacksFromInput(rawPacksInput, languages, packsInputCombines) {
-    if (!rawPacksInput?.trim()) {
-        return undefined;
-    }
-    if (languages.length > 1) {
-        throw new util_1.ConfigurationError("Cannot specify a 'packs' input in a multi-language analysis. Use a codeql-config.yml file instead and specify packs by language.");
-    }
-    else if (languages.length === 0) {
-        throw new util_1.ConfigurationError("No languages specified. Cannot process the packs input.");
-    }
-    rawPacksInput = rawPacksInput.trim();
-    if (packsInputCombines) {
-        rawPacksInput = rawPacksInput.trim().substring(1).trim();
-        if (!rawPacksInput) {
-            throw new util_1.ConfigurationError(getConfigFilePropertyError(undefined, "packs", "A '+' was used in the 'packs' input to specify that you wished to add some packs to your CodeQL analysis. However, no packs were specified. Please either remove the '+' or specify some packs."));
-        }
-    }
-    return {
-        [languages[0]]: rawPacksInput.split(",").reduce((packs, pack) => {
-            packs.push(validatePackSpecification(pack));
-            return packs;
-        }, []),
-    };
-}
-/**
- * Validates that this package specification is syntactically correct.
- * It may not point to any real package, but after this function returns
- * without throwing, we are guaranteed that the package specification
- * is roughly correct.
- *
- * The CLI itself will do a more thorough validation of the package
- * specification.
- *
- * A package specification looks like this:
- *
- * `scope/name@version:path`
- *
- * Version and path are optional.
- *
- * @param packStr the package specification to verify.
- * @param configFile Config file to use for error reporting
- */
-function parsePacksSpecification(packStr) {
-    if (typeof packStr !== "string") {
-        throw new util_1.ConfigurationError(getPacksStrInvalid(packStr));
-    }
-    packStr = packStr.trim();
-    const atIndex = packStr.indexOf("@");
-    const colonIndex = packStr.indexOf(":", atIndex);
-    const packStart = 0;
-    const versionStart = atIndex + 1 || undefined;
-    const pathStart = colonIndex + 1 || undefined;
-    const packEnd = Math.min(atIndex > 0 ? atIndex : Infinity, colonIndex > 0 ? colonIndex : Infinity, packStr.length);
-    const versionEnd = versionStart
-        ? Math.min(colonIndex > 0 ? colonIndex : Infinity, packStr.length)
-        : undefined;
-    const pathEnd = pathStart ? packStr.length : undefined;
-    const packName = packStr.slice(packStart, packEnd).trim();
-    const version = versionStart
-        ? packStr.slice(versionStart, versionEnd).trim()
-        : undefined;
-    const packPath = pathStart
-        ? packStr.slice(pathStart, pathEnd).trim()
-        : undefined;
-    if (!PACK_IDENTIFIER_PATTERN.test(packName)) {
-        throw new util_1.ConfigurationError(getPacksStrInvalid(packStr));
-    }
-    if (version) {
-        try {
-            new semver.Range(version);
-        }
-        catch {
-            // The range string is invalid. OK to ignore the caught error
-            throw new util_1.ConfigurationError(getPacksStrInvalid(packStr));
-        }
-    }
-    if (packPath &&
-        (path.isAbsolute(packPath) ||
-            // Permit using "/" instead of "\" on Windows
-            // Use `x.split(y).join(z)` as a polyfill for `x.replaceAll(y, z)` since
-            // if we used a regex we'd need to escape the path separator on Windows
-            // which seems more awkward.
-            path.normalize(packPath).split(path.sep).join("/") !==
-                packPath.split(path.sep).join("/"))) {
-        throw new util_1.ConfigurationError(getPacksStrInvalid(packStr));
-    }
-    if (!packPath && pathStart) {
-        // 0 length path
-        throw new util_1.ConfigurationError(getPacksStrInvalid(packStr));
-    }
-    return {
-        name: packName,
-        version,
-        path: packPath,
-    };
-}
-function validatePackSpecification(pack) {
-    return (0, util_1.prettyPrintPack)(parsePacksSpecification(pack));
-}
-/**
- * The convention in this action is that an input value that is prefixed with a '+' will
- * be combined with the corresponding value in the config file.
- *
- * Without a '+', an input value will override the corresponding value in the config file.
- *
- * @param inputValue The input value to process.
- * @returns true if the input value should replace the corresponding value in the config file,
- *          false if it should be appended.
- */
-function shouldCombine(inputValue) {
-    return !!inputValue?.trim().startsWith("+");
-}
-function dbLocationOrDefault(dbLocation, tempDir) {
-    return dbLocation || path.resolve(tempDir, "codeql_databases");
-}
-function userConfigFromActionPath(tempDir) {
-    return path.resolve(tempDir, "user-config-from-action.yml");
-}
-/**
- * Load and return the config.
- *
- * This will parse the config from the user input if present, or generate
- * a default config. The parsed config is then stored to a known location.
- */
-async function initConfig(inputs) {
-    const { logger, tempDir } = inputs;
-    // if configInput is set, it takes precedence over configFile
-    if (inputs.configInput) {
-        if (inputs.configFile) {
-            logger.warning(`Both a config file and config input were provided. Ignoring config file.`);
-        }
-        inputs.configFile = userConfigFromActionPath(tempDir);
-        fs.writeFileSync(inputs.configFile, inputs.configInput);
-        logger.debug(`Using config from action input: ${inputs.configFile}`);
-    }
-    let userConfig = {};
-    if (!inputs.configFile) {
-        logger.debug("No configuration file was provided");
-    }
-    else {
-        logger.debug(`Using configuration file: ${inputs.configFile}`);
-        userConfig = await loadUserConfig(inputs.configFile, inputs.workspacePath, inputs.apiDetails, tempDir);
-    }
-    const config = await getDefaultConfig(inputs);
-    const augmentationProperties = config.augmentationProperties;
-    config.originalUserInput = userConfig;
-    // The choice of overlay database mode depends on the selection of languages
-    // and queries, which in turn depends on the user config and the augmentation
-    // properties. So we need to calculate the overlay database mode after the
-    // rest of the config has been populated.
-    const { overlayDatabaseMode, useOverlayDatabaseCaching } = await getOverlayDatabaseMode(inputs.codeql, inputs.repository, inputs.features, config.languages, inputs.sourceRoot, config.buildMode, generateCodeScanningConfig(userConfig, augmentationProperties), logger);
-    logger.info(`Using overlay database mode: ${overlayDatabaseMode} ` +
-        `${useOverlayDatabaseCaching ? "with" : "without"} caching.`);
-    augmentationProperties.overlayDatabaseMode = overlayDatabaseMode;
-    augmentationProperties.useOverlayDatabaseCaching = useOverlayDatabaseCaching;
-    if (overlayDatabaseMode === overlay_database_utils_1.OverlayDatabaseMode.Overlay ||
-        (await (0, diff_informed_analysis_utils_1.shouldPerformDiffInformedAnalysis)(inputs.codeql, inputs.features, logger))) {
-        augmentationProperties.extraQueryExclusions.push({
-            exclude: { tags: "exclude-from-incremental" },
-        });
-    }
-    // Save the config so we can easily access it again in the future
-    await saveConfig(config, logger);
-    return config;
-}
-function parseRegistries(registriesInput) {
-    try {
-        return registriesInput
-            ? yaml.load(registriesInput)
-            : undefined;
-    }
-    catch {
-        throw new util_1.ConfigurationError("Invalid registries input. Must be a YAML string.");
-    }
-}
-function parseRegistriesWithoutCredentials(registriesInput) {
-    return parseRegistries(registriesInput)?.map((r) => {
-        const { url, packages, kind } = r;
-        return { url, packages, kind };
-    });
-}
-function isLocal(configPath) {
-    // If the path starts with ./, look locally
-    if (configPath.indexOf("./") === 0) {
-        return true;
-    }
-    return configPath.indexOf("@") === -1;
-}
-function getLocalConfig(configFile) {
-    // Error if the file does not exist
-    if (!fs.existsSync(configFile)) {
-        throw new util_1.ConfigurationError(getConfigFileDoesNotExistErrorMessage(configFile));
-    }
-    return yaml.load(fs.readFileSync(configFile, "utf8"));
-}
-async function getRemoteConfig(configFile, apiDetails) {
-    // retrieve the various parts of the config location, and ensure they're present
-    const format = new RegExp("(?<owner>[^/]+)/(?<repo>[^/]+)/(?<path>[^@]+)@(?<ref>.*)");
-    const pieces = format.exec(configFile);
-    // 5 = 4 groups + the whole expression
-    if (pieces === null || pieces.groups === undefined || pieces.length < 5) {
-        throw new util_1.ConfigurationError(getConfigFileRepoFormatInvalidMessage(configFile));
-    }
-    const response = await api
-        .getApiClientWithExternalAuth(apiDetails)
-        .rest.repos.getContent({
-        owner: pieces.groups.owner,
-        repo: pieces.groups.repo,
-        path: pieces.groups.path,
-        ref: pieces.groups.ref,
-    });
-    let fileContents;
-    if ("content" in response.data && response.data.content !== undefined) {
-        fileContents = response.data.content;
-    }
-    else if (Array.isArray(response.data)) {
-        throw new util_1.ConfigurationError(getConfigFileDirectoryGivenMessage(configFile));
-    }
-    else {
-        throw new util_1.ConfigurationError(getConfigFileFormatInvalidMessage(configFile));
-    }
-    return yaml.load(Buffer.from(fileContents, "base64").toString("binary"));
-}
-/**
- * Get the file path where the parsed config will be stored.
- */
-function getPathToParsedConfigFile(tempDir) {
-    return path.join(tempDir, "config");
-}
-/**
- * Store the given config to the path returned from getPathToParsedConfigFile.
- */
-async function saveConfig(config, logger) {
-    const configString = JSON.stringify(config);
-    const configFile = getPathToParsedConfigFile(config.tempDir);
-    fs.mkdirSync(path.dirname(configFile), { recursive: true });
-    fs.writeFileSync(configFile, configString, "utf8");
-    logger.debug("Saved config:");
-    logger.debug(configString);
-}
-/**
- * Get the config that has been saved to the given temp dir.
- * If the config could not be found then returns undefined.
- */
-async function getConfig(tempDir, logger) {
-    const configFile = getPathToParsedConfigFile(tempDir);
-    if (!fs.existsSync(configFile)) {
-        return undefined;
-    }
-    const configString = fs.readFileSync(configFile, "utf8");
-    logger.debug("Loaded config:");
-    logger.debug(configString);
-    return JSON.parse(configString);
-}
-/**
- * Generate a `qlconfig.yml` file from the `registries` input.
- * This file is used by the CodeQL CLI to list the registries to use for each
- * pack.
- *
- * @param registriesInput The value of the `registries` input.
- * @param codeQL a codeQL object, used only for checking the version of CodeQL.
- * @param tempDir a temporary directory to store the generated qlconfig.yml file.
- * @param logger a logger object.
- * @returns The path to the generated `qlconfig.yml` file and the auth tokens to
- *        use for each registry.
- */
-async function generateRegistries(registriesInput, tempDir, logger) {
-    const registries = parseRegistries(registriesInput);
-    let registriesAuthTokens;
-    let qlconfigFile;
-    if (registries) {
-        // generate a qlconfig.yml file to hold the registry configs.
-        const qlconfig = createRegistriesBlock(registries);
-        qlconfigFile = path.join(tempDir, "qlconfig.yml");
-        const qlconfigContents = yaml.dump(qlconfig);
-        fs.writeFileSync(qlconfigFile, qlconfigContents, "utf8");
-        logger.debug("Generated qlconfig.yml:");
-        logger.debug(qlconfigContents);
-        registriesAuthTokens = registries
-            .map((registry) => `${registry.url}=${registry.token}`)
-            .join(",");
-    }
-    if (typeof process.env.CODEQL_REGISTRIES_AUTH === "string") {
-        logger.debug("Using CODEQL_REGISTRIES_AUTH environment variable to authenticate with registries.");
-    }
-    return {
-        registriesAuthTokens: 
-        // if the user has explicitly set the CODEQL_REGISTRIES_AUTH env var then use that
-        process.env.CODEQL_REGISTRIES_AUTH ?? registriesAuthTokens,
-        qlconfigFile,
-    };
-}
-function createRegistriesBlock(registries) {
-    if (!Array.isArray(registries) ||
-        registries.some((r) => !r.url || !r.packages)) {
-        throw new util_1.ConfigurationError("Invalid 'registries' input. Must be an array of objects with 'url' and 'packages' properties.");
-    }
-    // be sure to remove the `token` field from the registry before writing it to disk.
-    const safeRegistries = registries.map((registry) => ({
-        // ensure the url ends with a slash to avoid a bug in the CLI 2.10.4
-        url: !registry?.url.endsWith("/") ? `${registry.url}/` : registry.url,
-        packages: registry.packages,
-        kind: registry.kind,
-    }));
-    const qlconfig = {
-        registries: safeRegistries,
-    };
-    return qlconfig;
-}
-/**
- * Create a temporary environment based on the existing environment and overridden
- * by the given environment variables that are passed in as arguments.
- *
- * Use this new environment in the context of the given operation. After completing
- * the operation, restore the original environment.
- *
- * This function does not support un-setting environment variables.
- *
- * @param env
- * @param operation
- */
-async function wrapEnvironment(env, operation) {
-    // Remember the original env
-    const oldEnv = { ...process.env };
-    // Set the new env
-    for (const [key, value] of Object.entries(env)) {
-        // Ignore undefined keys
-        if (value !== undefined) {
-            process.env[key] = value;
-        }
-    }
-    try {
-        // Run the operation
-        await operation();
-    }
-    finally {
-        // Restore the old env
-        for (const [key, value] of Object.entries(oldEnv)) {
-            process.env[key] = value;
-        }
-    }
-}
-// Exported for testing
-async function parseBuildModeInput(input, languages, features, logger) {
-    if (input === undefined) {
-        return undefined;
-    }
-    if (!Object.values(util_1.BuildMode).includes(input)) {
-        throw new util_1.ConfigurationError(`Invalid build mode: '${input}'. Supported build modes are: ${Object.values(util_1.BuildMode).join(", ")}.`);
-    }
-    if (languages.includes(languages_1.KnownLanguage.csharp) &&
-        (await features.getValue(feature_flags_1.Feature.DisableCsharpBuildless))) {
-        logger.warning("Scanning C# code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.");
-        return util_1.BuildMode.Autobuild;
-    }
-    if (languages.includes(languages_1.KnownLanguage.java) &&
-        (await features.getValue(feature_flags_1.Feature.DisableJavaBuildlessEnabled))) {
-        logger.warning("Scanning Java code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.");
-        return util_1.BuildMode.Autobuild;
-    }
-    return input;
-}
-function generateCodeScanningConfig(originalUserInput, augmentationProperties) {
-    // make a copy so we can modify it
-    const augmentedConfig = (0, util_1.cloneObject)(originalUserInput);
-    // Inject the queries from the input
-    if (augmentationProperties.queriesInput) {
-        if (augmentationProperties.queriesInputCombines) {
-            augmentedConfig.queries = (augmentedConfig.queries || []).concat(augmentationProperties.queriesInput);
-        }
-        else {
-            augmentedConfig.queries = augmentationProperties.queriesInput;
-        }
-    }
-    if (augmentedConfig.queries?.length === 0) {
-        delete augmentedConfig.queries;
-    }
-    // Inject the packs from the input
-    if (augmentationProperties.packsInput) {
-        if (augmentationProperties.packsInputCombines) {
-            // At this point, we already know that this is a single-language analysis
-            if (Array.isArray(augmentedConfig.packs)) {
-                augmentedConfig.packs = (augmentedConfig.packs || []).concat(augmentationProperties.packsInput);
-            }
-            else if (!augmentedConfig.packs) {
-                augmentedConfig.packs = augmentationProperties.packsInput;
-            }
-            else {
-                // At this point, we know there is only one language.
-                // If there were more than one language, an error would already have been thrown.
-                const language = Object.keys(augmentedConfig.packs)[0];
-                augmentedConfig.packs[language] = augmentedConfig.packs[language].concat(augmentationProperties.packsInput);
-            }
-        }
-        else {
-            augmentedConfig.packs = augmentationProperties.packsInput;
-        }
-    }
-    if (Array.isArray(augmentedConfig.packs) && !augmentedConfig.packs.length) {
-        delete augmentedConfig.packs;
-    }
-    augmentedConfig["query-filters"] = [
-        // Ordering matters. If the first filter is an inclusion, it implicitly
-        // excludes all queries that are not included. If it is an exclusion,
-        // it implicitly includes all queries that are not excluded. So user
-        // filters (if any) should always be first to preserve intent.
-        ...(augmentedConfig["query-filters"] || []),
-        ...augmentationProperties.extraQueryExclusions,
-    ];
-    if (augmentedConfig["query-filters"]?.length === 0) {
-        delete augmentedConfig["query-filters"];
-    }
-    return augmentedConfig;
-}
-//# sourceMappingURL=config-utils.js.map

lib/database-upload.js

@@ -1,115 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.uploadDatabases = uploadDatabases;
-const fs = __importStar(require("fs"));
-const actionsUtil = __importStar(require("./actions-util"));
-const api_client_1 = require("./api-client");
-const gitUtils = __importStar(require("./git-utils"));
-const logging_1 = require("./logging");
-const util = __importStar(require("./util"));
-const util_1 = require("./util");
-async function uploadDatabases(repositoryNwo, codeql, config, apiDetails, logger) {
-    if (actionsUtil.getRequiredInput("upload-database") !== "true") {
-        logger.debug("Database upload disabled in workflow. Skipping upload.");
-        return;
-    }
-    if (util.isInTestMode()) {
-        logger.debug("In test mode. Skipping database upload.");
-        return;
-    }
-    // Do nothing when not running against github.com
-    if (config.gitHubVersion.type !== util.GitHubVariant.DOTCOM &&
-        config.gitHubVersion.type !== util.GitHubVariant.GHE_DOTCOM) {
-        logger.debug("Not running against github.com or GHEC-DR. Skipping upload.");
-        return;
-    }
-    if (!(await gitUtils.isAnalyzingDefaultBranch())) {
-        // We only want to upload a database if we are analyzing the default branch.
-        logger.debug("Not analyzing default branch. Skipping upload.");
-        return;
-    }
-    // Clean up the database, since intermediate results may still be written to the
-    // database if there is high RAM pressure.
-    await (0, logging_1.withGroupAsync)("Cleaning up databases", async () => {
-        await codeql.databaseCleanupCluster(config, "clear");
-    });
-    const client = (0, api_client_1.getApiClient)();
-    const uploadsUrl = new URL((0, util_1.parseGitHubUrl)(apiDetails.url));
-    uploadsUrl.hostname = `uploads.${uploadsUrl.hostname}`;
-    // Octokit expects the baseUrl to not have a trailing slash,
-    // but it is included by default in a URL.
-    let uploadsBaseUrl = uploadsUrl.toString();
-    if (uploadsBaseUrl.endsWith("/")) {
-        uploadsBaseUrl = uploadsBaseUrl.slice(0, -1);
-    }
-    for (const language of config.languages) {
-        try {
-            // Upload the database bundle.
-            // Although we are uploading arbitrary file contents to the API, it's worth
-            // noting that it's the API's job to validate that the contents is acceptable.
-            // This API method is available to anyone with write access to the repo.
-            const bundledDb = await (0, util_1.bundleDb)(config, language, codeql, language);
-            const bundledDbSize = fs.statSync(bundledDb).size;
-            const bundledDbReadStream = fs.createReadStream(bundledDb);
-            const commitOid = await gitUtils.getCommitOid(actionsUtil.getRequiredInput("checkout_path"));
-            try {
-                await client.request(`POST /repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name&commit_oid=:commit_oid`, {
-                    baseUrl: uploadsBaseUrl,
-                    owner: repositoryNwo.owner,
-                    repo: repositoryNwo.repo,
-                    language,
-                    name: `${language}-database`,
-                    commit_oid: commitOid,
-                    data: bundledDbReadStream,
-                    headers: {
-                        authorization: `token ${apiDetails.auth}`,
-                        "Content-Type": "application/zip",
-                        "Content-Length": bundledDbSize,
-                    },
-                });
-                logger.debug(`Successfully uploaded database for ${language}`);
-            }
-            finally {
-                bundledDbReadStream.close();
-            }
-        }
-        catch (e) {
-            // Log a warning but don't fail the workflow
-            logger.warning(`Failed to upload database for ${language}: ${e}`);
-        }
-    }
-}
-//# sourceMappingURL=database-upload.js.map

lib/database-upload.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"database-upload.js","sourceRoot":"","sources":["../src/database-upload.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,0CAyFC;AArGD,uCAAyB;AAEzB,4DAA8C;AAC9C,6CAA8D;AAG9D,sDAAwC;AACxC,uCAAmD;AAEnD,6CAA+B;AAC/B,iCAAkD;AAE3C,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,MAAc,EACd,MAAc,EACd,UAA4B,EAC5B,MAAc;IAEd,IAAI,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,iDAAiD;IACjD,IACE,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM;QACvD,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,UAAU,EAC3D,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,wBAAwB,EAAE,CAAC,EAAE,CAAC;QACjD,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,gFAAgF;IAChF,0CAA0C;IAC1C,MAAM,IAAA,wBAAc,EAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,MAAM,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAA,yBAAY,GAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAA,qBAAc,EAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,UAAU,CAAC,QAAQ,GAAG,WAAW,UAAU,CAAC,QAAQ,EAAE,CAAC;IAEvD,4DAA4D;IAC5D,0CAA0C;IAC1C,IAAI,cAAc,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;IAC3C,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,8BAA8B;YAC9B,2EAA2E;YAC3E,8EAA8E;YAC9E,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,IAAA,eAAQ,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,MAAM,aAAa,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAClD,MAAM,mBAAmB,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,YAAY,CAC3C,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAC9C,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,qGAAqG,EACrG;oBACE,OAAO,EAAE,cAAc;oBACvB,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;oBACxB,QAAQ;oBACR,IAAI,EAAE,GAAG,QAAQ,WAAW;oBAC5B,UAAU,EAAE,SAAS;oBACrB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,UAAU,CAAC,IAAI,EAAE;wBACzC,cAAc,EAAE,iBAAiB;wBACjC,gBAAgB,EAAE,aAAa;qBAChC;iBACF,CACF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;oBAAS,CAAC;gBACT,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,4CAA4C;YAC5C,MAAM,CAAC,OAAO,CAAC,iCAAiC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC"}

lib/database-upload.test.js

@@ -1,189 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __importStar(require("fs"));
-const github = __importStar(require("@actions/github"));
-const ava_1 = __importDefault(require("ava"));
-const sinon = __importStar(require("sinon"));
-const actionsUtil = __importStar(require("./actions-util"));
-const apiClient = __importStar(require("./api-client"));
-const codeql_1 = require("./codeql");
-const database_upload_1 = require("./database-upload");
-const gitUtils = __importStar(require("./git-utils"));
-const languages_1 = require("./languages");
-const testing_utils_1 = require("./testing-utils");
-const util_1 = require("./util");
-(0, testing_utils_1.setupTests)(ava_1.default);
-ava_1.default.beforeEach(() => {
-    (0, util_1.initializeEnvironment)("1.2.3");
-});
-const testRepoName = { owner: "github", repo: "example" };
-const testApiDetails = {
-    auth: "1234",
-    url: "https://github.com",
-    apiURL: undefined,
-};
-function getTestConfig(tmpDir) {
-    return (0, testing_utils_1.createTestConfig)({
-        languages: [languages_1.KnownLanguage.javascript],
-        dbLocation: tmpDir,
-    });
-}
-async function mockHttpRequests(databaseUploadStatusCode) {
-    // Passing an auth token is required, so we just use a dummy value
-    const client = github.getOctokit("123");
-    const requestSpy = sinon.stub(client, "request");
-    const url = "POST /repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name&commit_oid=:commit_oid";
-    const databaseUploadSpy = requestSpy.withArgs(url);
-    if (databaseUploadStatusCode < 300) {
-        databaseUploadSpy.resolves(undefined);
-    }
-    else {
-        databaseUploadSpy.throws(new util_1.HTTPError("some error message", databaseUploadStatusCode));
-    }
-    sinon.stub(apiClient, "getApiClient").value(() => client);
-    return databaseUploadSpy;
-}
-function getCodeQL() {
-    return (0, codeql_1.createStubCodeQL)({
-        async databaseBundle(_, outputFilePath) {
-            fs.writeFileSync(outputFilePath, "");
-        },
-        async databaseCleanupCluster() {
-            // Do nothing, as we are not testing cleanup here.
-        },
-    });
-}
-(0, ava_1.default)("Abort database upload if 'upload-database' input set to false", async (t) => {
-    await (0, util_1.withTmpDir)(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        sinon
-            .stub(actionsUtil, "getRequiredInput")
-            .withArgs("upload-database")
-            .returns("false");
-        sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
-        const loggedMessages = [];
-        await (0, database_upload_1.uploadDatabases)(testRepoName, getCodeQL(), getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
-        t.assert(loggedMessages.find((v) => v.type === "debug" &&
-            v.message ===
-                "Database upload disabled in workflow. Skipping upload.") !== undefined);
-    });
-});
-(0, ava_1.default)("Abort database upload if running against GHES", async (t) => {
-    await (0, util_1.withTmpDir)(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        sinon
-            .stub(actionsUtil, "getRequiredInput")
-            .withArgs("upload-database")
-            .returns("true");
-        sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
-        const config = getTestConfig(tmpDir);
-        config.gitHubVersion = { type: util_1.GitHubVariant.GHES, version: "3.0" };
-        const loggedMessages = [];
-        await (0, database_upload_1.uploadDatabases)(testRepoName, getCodeQL(), config, testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
-        t.assert(loggedMessages.find((v) => v.type === "debug" &&
-            v.message ===
-                "Not running against github.com or GHEC-DR. Skipping upload.") !== undefined);
-    });
-});
-(0, ava_1.default)("Abort database upload if not analyzing default branch", async (t) => {
-    await (0, util_1.withTmpDir)(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        sinon
-            .stub(actionsUtil, "getRequiredInput")
-            .withArgs("upload-database")
-            .returns("true");
-        sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(false);
-        const loggedMessages = [];
-        await (0, database_upload_1.uploadDatabases)(testRepoName, getCodeQL(), getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
-        t.assert(loggedMessages.find((v) => v.type === "debug" &&
-            v.message === "Not analyzing default branch. Skipping upload.") !== undefined);
-    });
-});
-(0, ava_1.default)("Don't crash if uploading a database fails", async (t) => {
-    await (0, util_1.withTmpDir)(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        sinon
-            .stub(actionsUtil, "getRequiredInput")
-            .withArgs("upload-database")
-            .returns("true");
-        sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
-        await mockHttpRequests(500);
-        const loggedMessages = [];
-        await (0, database_upload_1.uploadDatabases)(testRepoName, getCodeQL(), getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
-        t.assert(loggedMessages.find((v) => v.type === "warning" &&
-            v.message ===
-                "Failed to upload database for javascript: Error: some error message") !== undefined);
-    });
-});
-(0, ava_1.default)("Successfully uploading a database to github.com", async (t) => {
-    await (0, util_1.withTmpDir)(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        sinon
-            .stub(actionsUtil, "getRequiredInput")
-            .withArgs("upload-database")
-            .returns("true");
-        sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
-        await mockHttpRequests(201);
-        const loggedMessages = [];
-        await (0, database_upload_1.uploadDatabases)(testRepoName, getCodeQL(), getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
-        t.assert(loggedMessages.find((v) => v.type === "debug" &&
-            v.message === "Successfully uploaded database for javascript") !== undefined);
-    });
-});
-(0, ava_1.default)("Successfully uploading a database to GHEC-DR", async (t) => {
-    await (0, util_1.withTmpDir)(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        sinon
-            .stub(actionsUtil, "getRequiredInput")
-            .withArgs("upload-database")
-            .returns("true");
-        sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
-        const databaseUploadSpy = await mockHttpRequests(201);
-        const loggedMessages = [];
-        await (0, database_upload_1.uploadDatabases)(testRepoName, getCodeQL(), getTestConfig(tmpDir), {
-            auth: "1234",
-            url: "https://tenant.ghe.com",
-            apiURL: undefined,
-        }, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
-        t.assert(loggedMessages.find((v) => v.type === "debug" &&
-            v.message === "Successfully uploaded database for javascript") !== undefined);
-        t.assert(databaseUploadSpy.calledOnceWith(sinon.match.string, sinon.match.has("baseUrl", "https://uploads.tenant.ghe.com")));
-    });
-});
-//# sourceMappingURL=database-upload.test.js.map

lib/debug-artifacts.js

@@ -1,275 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.sanitizeArtifactName = sanitizeArtifactName;
-exports.uploadCombinedSarifArtifacts = uploadCombinedSarifArtifacts;
-exports.tryUploadAllAvailableDebugArtifacts = tryUploadAllAvailableDebugArtifacts;
-exports.uploadDebugArtifacts = uploadDebugArtifacts;
-exports.getArtifactUploaderClient = getArtifactUploaderClient;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const artifact = __importStar(require("@actions/artifact"));
-const artifactLegacy = __importStar(require("@actions/artifact-legacy"));
-const core = __importStar(require("@actions/core"));
-const archiver_1 = __importDefault(require("archiver"));
-const del_1 = __importDefault(require("del"));
-const actions_util_1 = require("./actions-util");
-const analyze_1 = require("./analyze");
-const environment_1 = require("./environment");
-const logging_1 = require("./logging");
-const tools_features_1 = require("./tools-features");
-const util_1 = require("./util");
-function sanitizeArtifactName(name) {
-    return name.replace(/[^a-zA-Z0-9_-]+/g, "");
-}
-/**
- * Upload Actions SARIF artifacts for debugging when CODEQL_ACTION_DEBUG_COMBINED_SARIF
- * environment variable is set
- */
-async function uploadCombinedSarifArtifacts(logger, gitHubVariant, codeQlVersion) {
-    const tempDir = (0, actions_util_1.getTemporaryDirectory)();
-    // Upload Actions SARIF artifacts for debugging when environment variable is set
-    if (process.env["CODEQL_ACTION_DEBUG_COMBINED_SARIF"] === "true") {
-        await (0, logging_1.withGroup)("Uploading combined SARIF debug artifact", async () => {
-            logger.info("Uploading available combined SARIF files as Actions debugging artifact...");
-            const baseTempDir = path.resolve(tempDir, "combined-sarif");
-            const toUpload = [];
-            if (fs.existsSync(baseTempDir)) {
-                const outputDirs = fs.readdirSync(baseTempDir);
-                for (const outputDir of outputDirs) {
-                    const sarifFiles = fs
-                        .readdirSync(path.resolve(baseTempDir, outputDir))
-                        .filter((f) => f.endsWith(".sarif"));
-                    for (const sarifFile of sarifFiles) {
-                        toUpload.push(path.resolve(baseTempDir, outputDir, sarifFile));
-                    }
-                }
-            }
-            try {
-                await uploadDebugArtifacts(logger, toUpload, baseTempDir, "combined-sarif-artifacts", gitHubVariant, codeQlVersion);
-            }
-            catch (e) {
-                logger.warning(`Failed to upload combined SARIF files as Actions debugging artifact. Reason: ${(0, util_1.getErrorMessage)(e)}`);
-            }
-        });
-    }
-}
-/**
- * Try to prepare a SARIF result debug artifact for the given language.
- *
- * @return The path to that debug artifact, or undefined if an error occurs.
- */
-function tryPrepareSarifDebugArtifact(config, language, logger) {
-    try {
-        const analyzeActionOutputDir = process.env[environment_1.EnvVar.SARIF_RESULTS_OUTPUT_DIR];
-        if (analyzeActionOutputDir !== undefined &&
-            fs.existsSync(analyzeActionOutputDir) &&
-            fs.lstatSync(analyzeActionOutputDir).isDirectory()) {
-            const sarifFile = path.resolve(analyzeActionOutputDir, `${language}.sarif`);
-            // Move SARIF to DB location so that they can be uploaded with the same root directory as the other artifacts.
-            if (fs.existsSync(sarifFile)) {
-                const sarifInDbLocation = path.resolve(config.dbLocation, `${language}.sarif`);
-                fs.copyFileSync(sarifFile, sarifInDbLocation);
-                return sarifInDbLocation;
-            }
-        }
-    }
-    catch (e) {
-        logger.warning(`Failed to find SARIF results path for ${language}. Reason: ${(0, util_1.getErrorMessage)(e)}`);
-    }
-    return undefined;
-}
-/**
- * Try to bundle the database for the given language.
- *
- * @return The path to the database bundle, or undefined if an error occurs.
- */
-async function tryBundleDatabase(codeql, config, language, logger) {
-    try {
-        if ((0, analyze_1.dbIsFinalized)(config, language, logger)) {
-            try {
-                return await createDatabaseBundleCli(codeql, config, language);
-            }
-            catch (e) {
-                logger.warning(`Failed to bundle database for ${language} using the CLI. ` +
-                    `Falling back to a partial bundle. Reason: ${(0, util_1.getErrorMessage)(e)}`);
-            }
-        }
-        return await createPartialDatabaseBundle(config, language);
-    }
-    catch (e) {
-        logger.warning(`Failed to bundle database for ${language}. Reason: ${(0, util_1.getErrorMessage)(e)}`);
-        return undefined;
-    }
-}
-/**
- * Attempt to upload all available debug artifacts.
- *
- * Logs and suppresses any errors that occur.
- */
-async function tryUploadAllAvailableDebugArtifacts(codeql, config, logger, codeQlVersion) {
-    const filesToUpload = [];
-    try {
-        for (const language of config.languages) {
-            await (0, logging_1.withGroup)(`Uploading debug artifacts for ${language}`, async () => {
-                logger.info("Preparing SARIF result debug artifact...");
-                const sarifResultDebugArtifact = tryPrepareSarifDebugArtifact(config, language, logger);
-                if (sarifResultDebugArtifact) {
-                    filesToUpload.push(sarifResultDebugArtifact);
-                    logger.info("SARIF result debug artifact ready for upload.");
-                }
-                logger.info("Preparing database logs debug artifact...");
-                const databaseDirectory = (0, util_1.getCodeQLDatabasePath)(config, language);
-                const logsDirectory = path.resolve(databaseDirectory, "log");
-                if ((0, util_1.doesDirectoryExist)(logsDirectory)) {
-                    filesToUpload.push(...(0, util_1.listFolder)(logsDirectory));
-                    logger.info("Database logs debug artifact ready for upload.");
-                }
-                // Multilanguage tracing: there are additional logs in the root of the cluster
-                logger.info("Preparing database cluster logs debug artifact...");
-                const multiLanguageTracingLogsDirectory = path.resolve(config.dbLocation, "log");
-                if ((0, util_1.doesDirectoryExist)(multiLanguageTracingLogsDirectory)) {
-                    filesToUpload.push(...(0, util_1.listFolder)(multiLanguageTracingLogsDirectory));
-                    logger.info("Database cluster logs debug artifact ready for upload.");
-                }
-                // Add database bundle
-                logger.info("Preparing database bundle debug artifact...");
-                const databaseBundle = await tryBundleDatabase(codeql, config, language, logger);
-                if (databaseBundle) {
-                    filesToUpload.push(databaseBundle);
-                    logger.info("Database bundle debug artifact ready for upload.");
-                }
-            });
-        }
-    }
-    catch (e) {
-        logger.warning(`Failed to prepare debug artifacts. Reason: ${(0, util_1.getErrorMessage)(e)}`);
-        return;
-    }
-    try {
-        await (0, logging_1.withGroup)("Uploading debug artifacts", async () => uploadDebugArtifacts(logger, filesToUpload, config.dbLocation, config.debugArtifactName, config.gitHubVersion.type, codeQlVersion));
-    }
-    catch (e) {
-        logger.warning(`Failed to upload debug artifacts. Reason: ${(0, util_1.getErrorMessage)(e)}`);
-    }
-}
-async function uploadDebugArtifacts(logger, toUpload, rootDir, artifactName, ghVariant, codeQlVersion) {
-    if (toUpload.length === 0) {
-        return "no-artifacts-to-upload";
-    }
-    const uploadSupported = (0, tools_features_1.isSafeArtifactUpload)(codeQlVersion);
-    if (!uploadSupported) {
-        core.info(`Skipping debug artifact upload because the current CLI does not support safe upload. Please upgrade to CLI v${tools_features_1.SafeArtifactUploadVersion} or later.`);
-        return "upload-not-supported";
-    }
-    let suffix = "";
-    const matrix = (0, actions_util_1.getOptionalInput)("matrix");
-    if (matrix) {
-        try {
-            for (const [, matrixVal] of Object.entries(JSON.parse(matrix)).sort())
-                suffix += `-${matrixVal}`;
-        }
-        catch {
-            core.info("Could not parse user-specified `matrix` input into JSON. The debug artifact will not be named with the user's `matrix` input.");
-        }
-    }
-    const artifactUploader = await getArtifactUploaderClient(logger, ghVariant);
-    try {
-        await artifactUploader.uploadArtifact(sanitizeArtifactName(`${artifactName}${suffix}`), toUpload.map((file) => path.normalize(file)), path.normalize(rootDir), {
-            // ensure we don't keep the debug artifacts around for too long since they can be large.
-            retentionDays: 7,
-        });
-        return "upload-successful";
-    }
-    catch (e) {
-        // A failure to upload debug artifacts should not fail the entire action.
-        core.warning(`Failed to upload debug artifacts: ${e}`);
-        return "upload-failed";
-    }
-}
-// `@actions/artifact@v2` is not yet supported on GHES so the legacy version of the client will be used on GHES
-// until it is supported. We also use the legacy version of the client if the feature flag is disabled.
-// The feature flag is named `ArtifactV4Upgrade` to reduce customer confusion; customers are primarily affected by
-// `actions/download-artifact`, whose upgrade to v4 must be accompanied by the `@actions/artifact@v2` upgrade.
-async function getArtifactUploaderClient(logger, ghVariant) {
-    if (ghVariant === util_1.GitHubVariant.GHES) {
-        logger.info("Debug artifacts can be consumed with `actions/download-artifact@v3` because the `v4` version is not yet compatible on GHES.");
-        return artifactLegacy.create();
-    }
-    else {
-        logger.info("Debug artifacts can be consumed with `actions/download-artifact@v4`.");
-        return new artifact.DefaultArtifactClient();
-    }
-}
-/**
- * If a database has not been finalized, we cannot run the `codeql database bundle`
- * command in the CLI because it will return an error. Instead we directly zip
- * all files in the database folder and return the path.
- */
-async function createPartialDatabaseBundle(config, language) {
-    const databasePath = (0, util_1.getCodeQLDatabasePath)(config, language);
-    const databaseBundlePath = path.resolve(config.dbLocation, `${config.debugDatabaseName}-${language}-partial.zip`);
-    core.info(`${config.debugDatabaseName}-${language} is not finalized. Uploading partial database bundle at ${databaseBundlePath}...`);
-    // See `bundleDb` for explanation behind deleting existing db bundle.
-    if (fs.existsSync(databaseBundlePath)) {
-        await (0, del_1.default)(databaseBundlePath, { force: true });
-    }
-    const output = fs.createWriteStream(databaseBundlePath);
-    const zip = (0, archiver_1.default)("zip");
-    zip.on("error", (err) => {
-        throw err;
-    });
-    zip.on("warning", (err) => {
-        // Ignore ENOENT warnings. There's nothing anyone can do about it.
-        if (err.code !== "ENOENT") {
-            throw err;
-        }
-    });
-    zip.pipe(output);
-    zip.directory(databasePath, false);
-    await zip.finalize();
-    return databaseBundlePath;
-}
-/**
- * Runs `codeql database bundle` command and returns the path.
- */
-async function createDatabaseBundleCli(codeql, config, language) {
-    const databaseBundlePath = await (0, util_1.bundleDb)(config, language, codeql, `${config.debugDatabaseName}-${language}`);
-    return databaseBundlePath;
-}
-//# sourceMappingURL=debug-artifacts.js.map

lib/debug-artifacts.test.js

@@ -1,93 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const ava_1 = __importDefault(require("ava"));
-const debugArtifacts = __importStar(require("./debug-artifacts"));
-const logging_1 = require("./logging");
-const util_1 = require("./util");
-(0, ava_1.default)("sanitizeArtifactName", (t) => {
-    t.deepEqual(debugArtifacts.sanitizeArtifactName("hello-world_"), "hello-world_");
-    t.deepEqual(debugArtifacts.sanitizeArtifactName("hello`world`"), "helloworld");
-    t.deepEqual(debugArtifacts.sanitizeArtifactName("hello===123"), "hello123");
-    t.deepEqual(debugArtifacts.sanitizeArtifactName("*m)a&n^y%i££n+v!a:l[i]d"), "manyinvalid");
-    t.deepEqual(debugArtifacts.sanitizeArtifactName("\\foo\\bar//baz"), "foobarbaz");
-});
-// These next tests check the correctness of the logic to determine whether or not
-// artifacts are uploaded in debug mode. Since it's not easy to mock the actual
-// call to upload an artifact, we just check that we get an "upload-failed" result,
-// instead of actually uploading the artifact.
-//
-// For tests where we expect artifact upload to be blocked, we check for a different
-// response from the function.
-(0, ava_1.default)("uploadDebugArtifacts when artifacts empty should emit 'no-artifacts-to-upload'", async (t) => {
-    // Test that no error is thrown if artifacts list is empty.
-    const logger = (0, logging_1.getActionsLogger)();
-    await t.notThrowsAsync(async () => {
-        const uploaded = await debugArtifacts.uploadDebugArtifacts(logger, [], "i-dont-exist", "artifactName", util_1.GitHubVariant.DOTCOM, undefined);
-        t.is(uploaded, "no-artifacts-to-upload", "Should not have uploaded any artifacts");
-    });
-});
-(0, ava_1.default)("uploadDebugArtifacts when no codeql version is used should invoke artifact upload", async (t) => {
-    // Test that the artifact is uploaded.
-    const logger = (0, logging_1.getActionsLogger)();
-    await t.notThrowsAsync(async () => {
-        const uploaded = await debugArtifacts.uploadDebugArtifacts(logger, ["hucairz"], "i-dont-exist", "artifactName", util_1.GitHubVariant.DOTCOM, undefined);
-        t.is(uploaded, 
-        // The failure is expected since we don't want to actually upload any artifacts in unit tests.
-        "upload-failed", "Expect failure to upload artifacts since root dir does not exist");
-    });
-});
-(0, ava_1.default)("uploadDebugArtifacts when new codeql version is used should invoke artifact upload", async (t) => {
-    // Test that the artifact is uploaded.
-    const logger = (0, logging_1.getActionsLogger)();
-    await t.notThrowsAsync(async () => {
-        const uploaded = await debugArtifacts.uploadDebugArtifacts(logger, ["hucairz"], "i-dont-exist", "artifactName", util_1.GitHubVariant.DOTCOM, "2.20.3");
-        t.is(uploaded, 
-        // The failure is expected since we don't want to actually upload any artifacts in unit tests.
-        "upload-failed", "Expect failure to upload artifacts since root dir does not exist");
-    });
-});
-(0, ava_1.default)("uploadDebugArtifacts when old codeql is used should avoid trying to upload artifacts", async (t) => {
-    // Test that the artifact is not uploaded.
-    const logger = (0, logging_1.getActionsLogger)();
-    await t.notThrowsAsync(async () => {
-        const uploaded = await debugArtifacts.uploadDebugArtifacts(logger, ["hucairz"], "i-dont-exist", "artifactName", util_1.GitHubVariant.DOTCOM, "2.20.2");
-        t.is(uploaded, "upload-not-supported", "Expected artifact upload to be blocked because of old CodeQL version");
-    });
-});
-//# sourceMappingURL=debug-artifacts.test.js.map