merge origin/main before PR creation

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b1744ae3-8204-4901-8dc7-16368fd6d865

lib/entry-points.js

@@ -50678,11 +50678,11 @@ var require_tracingPolicy = __commonJS({
     var import_log = require_log3();
     var import_core_util = require_commonjs4();
     var import_restError = require_restError3();
-    var import_util59 = require_internal3();
+    var import_util60 = require_internal3();
     var tracingPolicyName2 = "tracingPolicy";
     function tracingPolicy2(options = {}) {
       const userAgentPromise = (0, import_userAgent.getUserAgentValue)(options.userAgentPrefix);
-      const sanitizer = new import_util59.Sanitizer({
+      const sanitizer = new import_util60.Sanitizer({
         additionalAllowedQueryParameters: options.additionalAllowedQueryParameters
       });
       const tracingClient = tryCreateTracingClient();
@@ -54308,11 +54308,11 @@ var require_response2 = __commonJS({
     });
     module2.exports = __toCommonJS2(response_exports);
     var import_core_rest_pipeline = require_commonjs6();
-    var import_util59 = require_util7();
+    var import_util60 = require_util7();
     var originalResponse = /* @__PURE__ */ Symbol("Original FullOperationResponse");
     function toCompatResponse2(response, options) {
-      let request3 = (0, import_util59.toWebResourceLike)(response.request);
-      let headers = (0, import_util59.toHttpHeadersLike)(response.headers);
+      let request3 = (0, import_util60.toWebResourceLike)(response.request);
+      let headers = (0, import_util60.toHttpHeadersLike)(response.headers);
       if (options?.createProxy) {
         return new Proxy(response, {
           get(target, prop, receiver) {
@@ -54353,7 +54353,7 @@ var require_response2 = __commonJS({
         return {
           ...compatResponse,
           headers,
-          request: (0, import_util59.toPipelineRequest)(compatResponse.request)
+          request: (0, import_util60.toPipelineRequest)(compatResponse.request)
         };
       }
     }
@@ -54460,7 +54460,7 @@ var require_requestPolicyFactoryPolicy = __commonJS({
       requestPolicyFactoryPolicyName: () => requestPolicyFactoryPolicyName2
     });
     module2.exports = __toCommonJS2(requestPolicyFactoryPolicy_exports);
-    var import_util59 = require_util7();
+    var import_util60 = require_util7();
     var import_response = require_response2();
     var HttpPipelineLogLevel2 = /* @__PURE__ */ ((HttpPipelineLogLevel22) => {
       HttpPipelineLogLevel22[HttpPipelineLogLevel22["ERROR"] = 1] = "ERROR";
@@ -54484,14 +54484,14 @@ var require_requestPolicyFactoryPolicy = __commonJS({
         async sendRequest(request3, next) {
           let httpPipeline = {
             async sendRequest(httpRequest) {
-              const response2 = await next((0, import_util59.toPipelineRequest)(httpRequest));
+              const response2 = await next((0, import_util60.toPipelineRequest)(httpRequest));
               return (0, import_response.toCompatResponse)(response2, { createProxy: true });
             }
           };
           for (const factory of orderedFactories) {
             httpPipeline = factory.create(httpPipeline, mockRequestPolicyOptions);
           }
-          const webResourceLike = (0, import_util59.toWebResourceLike)(request3, { createProxy: true });
+          const webResourceLike = (0, import_util60.toWebResourceLike)(request3, { createProxy: true });
           const response = await httpPipeline.sendRequest(webResourceLike);
           return (0, import_response.toPipelineResponse)(response);
         }
@@ -54526,12 +54526,12 @@ var require_httpClientAdapter = __commonJS({
     });
     module2.exports = __toCommonJS2(httpClientAdapter_exports);
     var import_response = require_response2();
-    var import_util59 = require_util7();
+    var import_util60 = require_util7();
     function convertHttpClient2(requestPolicyClient) {
       return {
         sendRequest: async (request3) => {
           const response = await requestPolicyClient.sendRequest(
-            (0, import_util59.toWebResourceLike)(request3, { createProxy: true })
+            (0, import_util60.toWebResourceLike)(request3, { createProxy: true })
           );
           return (0, import_response.toPipelineResponse)(response);
         }
@@ -54569,7 +54569,7 @@ var require_commonjs9 = __commonJS({
       disableKeepAlivePolicyName: () => import_disableKeepAlivePolicy.disableKeepAlivePolicyName,
       requestPolicyFactoryPolicyName: () => import_requestPolicyFactoryPolicy.requestPolicyFactoryPolicyName,
       toCompatResponse: () => import_response.toCompatResponse,
-      toHttpHeadersLike: () => import_util59.toHttpHeadersLike
+      toHttpHeadersLike: () => import_util60.toHttpHeadersLike
     });
     module2.exports = __toCommonJS2(src_exports);
     var import_extendedClient = require_extendedClient();
@@ -54577,7 +54577,7 @@ var require_commonjs9 = __commonJS({
     var import_requestPolicyFactoryPolicy = require_requestPolicyFactoryPolicy();
     var import_disableKeepAlivePolicy = require_disableKeepAlivePolicy();
     var import_httpClientAdapter = require_httpClientAdapter();
-    var import_util59 = require_util7();
+    var import_util60 = require_util7();
   }
 });
 
@@ -173835,6 +173835,17 @@ var ReadOnlyEnv = class {
   get() {
     return { ...this.vars };
   }
+  /** Gets a copy of the underlying environment, where the values are not `undefined`. */
+  getDefined() {
+    const result = {};
+    for (const [key, val] of Object.entries(this.vars)) {
+      if (val === void 0) {
+        continue;
+      }
+      result[key] = val;
+    }
+    return result;
+  }
   /** Tries to get the value for `name` and throws if there isn't one. */
   getRequired(name) {
     return getRequiredEnvVar(this.vars, name);
@@ -178117,7 +178128,7 @@ function ensureEndsInPeriod(text) {
   return text[text.length - 1] === "." ? text : `${text}.`;
 }
 var MAX_STDERR_BUFFER_SIZE = 2e4;
-async function runTool(cmd, args = [], opts = {}) {
+async function runTool(env, cmd, args = [], opts = {}) {
   let stdout = "";
   let stderr = "";
   if (!opts.noStreamStdout) {
@@ -178125,6 +178136,7 @@ async function runTool(cmd, args = [], opts = {}) {
 `);
   }
   const exitCode = await new toolrunner.ToolRunner(cmd, args, {
+    env: env.getDefined(),
     ignoreReturnCode: true,
     listeners: {
       stdout: (data) => {
@@ -184779,13 +184791,13 @@ async function getCodeQL(logger2, cmd) {
   }
   return cachedCodeQL;
 }
-async function getCodeQLForCmd(logger2, cmd, checkVersion) {
+async function getCodeQLForCmd(logger2, cmd, checkVersion, env = getEnv()) {
   const codeql = {
     getPath() {
       return cmd;
     },
     async getVersion() {
-      const cacheFilePath = getCommandCacheFilePath(getEnv());
+      const cacheFilePath = getCommandCacheFilePath(env);
       let result = getCachedCodeQlVersion(
         logger2,
         cacheFilePath,
@@ -184793,6 +184805,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
       );
       if (result === void 0) {
         result = await runCliJson(
+          env,
           cmd,
           ["version", "--format=json"],
           {
@@ -184863,6 +184876,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
         "--sublanguage-file-coverage"
       ] : ["--no-calculate-baseline"];
       await runCli(
+        env,
         cmd,
         [
           "database",
@@ -184895,19 +184909,22 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
       }
     },
     async runAutobuild(config, language) {
-      applyAutobuildAzurePipelinesTimeoutFix();
+      applyAutobuildAzurePipelinesTimeoutFix(env);
       const autobuildCmd = path15.join(
         await this.resolveExtractor(language),
         "tools",
         process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh"
       );
       if (config.debugMode) {
-        process.env["CODEQL_VERBOSITY" /* CLI_VERBOSITY */] = process.env["CODEQL_VERBOSITY" /* CLI_VERBOSITY */] || EXTRACTION_DEBUG_MODE_VERBOSITY;
+        env.set(
+          "CODEQL_VERBOSITY" /* CLI_VERBOSITY */,
+          env.getOptional("CODEQL_VERBOSITY" /* CLI_VERBOSITY */) ?? EXTRACTION_DEBUG_MODE_VERBOSITY
+        );
       }
-      await runCli(autobuildCmd);
+      await runCli(env, autobuildCmd);
     },
     async extractScannedLanguage(config, language) {
-      await runCli(cmd, [
+      await runCli(env, cmd, [
         "database",
         "trace-command",
         "--index-traceless-dbs",
@@ -184919,10 +184936,10 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
     },
     async extractUsingBuildMode(config, language) {
       if (config.buildMode === "autobuild" /* Autobuild */) {
-        applyAutobuildAzurePipelinesTimeoutFix();
+        applyAutobuildAzurePipelinesTimeoutFix(env);
       }
       try {
-        await runCli(cmd, [
+        await runCli(env, cmd, [
           "database",
           "trace-command",
           "--use-build-mode",
@@ -184953,12 +184970,12 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
         ...getExtraOptionsFromEnv(["database", "finalize"]),
         databasePath
       ];
-      await runCli(cmd, args);
+      await runCli(env, cmd, args);
     },
     async resolveLanguages({
       filterToLanguagesWithQueries
     } = { filterToLanguagesWithQueries: false }) {
-      return runCliJson(cmd, [
+      return runCliJson(env, cmd, [
         "resolve",
         "languages",
         "--format=betterjson",
@@ -184982,7 +184999,11 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
       if (workingDir !== void 0) {
         codeqlArgs.push("--working-dir", workingDir);
       }
-      return await runCliJson(cmd, codeqlArgs);
+      return await runCliJson(
+        env,
+        cmd,
+        codeqlArgs
+      );
     },
     async databaseRunQueries(databasePath, flags, queries = []) {
       const codeqlArgs = [
@@ -184998,7 +185019,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
           ignoringOptions: ["--expect-discarded-cache"]
         })
       ];
-      await runCli(cmd, codeqlArgs);
+      await runCli(env, cmd, codeqlArgs);
     },
     async databaseInterpretResults(databasePath, querySuitePaths, sarifFile, threadsFlag, verbosityFlag, sarifRunPropertyFlag, automationDetailsId, config, features) {
       const shouldExportDiagnostics = await features.getValue(
@@ -185021,7 +185042,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
         "--sarif-group-rules-by-pack",
         "--sarif-include-query-help=always",
         "--sublanguage-file-coverage",
-        ...await getJobRunUuidSarifOptions(),
+        ...await getJobRunUuidSarifOptions(env),
         ...getExtraOptionsFromEnv(["database", "interpret-results"])
       ];
       if (sarifRunPropertyFlag !== void 0) {
@@ -185039,7 +185060,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
       if (querySuitePaths) {
         codeqlArgs.push(...querySuitePaths);
       }
-      return await runCli(cmd, codeqlArgs, {
+      return await runCli(env, cmd, codeqlArgs, {
         noStreamStdout: true
       });
     },
@@ -185053,7 +185074,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
           `--cache-cleanup=${cleanupLevel}`,
           ...getExtraOptionsFromEnv(["database", "cleanup"])
         ];
-        await runCli(cmd, codeqlArgs);
+        await runCli(env, cmd, codeqlArgs);
       }
     },
     async databaseBundle(databasePath, outputFilePath, databaseName, includeDiagnostics, alsoIncludeRelativePaths) {
@@ -185077,7 +185098,9 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
           ])
         );
       }
-      await new toolrunner3.ToolRunner(cmd, args).exec();
+      await new toolrunner3.ToolRunner(cmd, args, {
+        env: env.getDefined()
+      }).exec();
     },
     async databaseExportDiagnostics(databasePath, sarifFile, automationDetailsId) {
       const args = [
@@ -185096,7 +185119,9 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
       if (automationDetailsId !== void 0) {
         args.push("--sarif-category", automationDetailsId);
       }
-      await new toolrunner3.ToolRunner(cmd, args).exec();
+      await new toolrunner3.ToolRunner(cmd, args, {
+        env: env.getDefined()
+      }).exec();
     },
     async diagnosticsExport(sarifFile, automationDetailsId, config, diagnosticDir) {
       let configPath = getGeneratedCodeScanningConfigPath(config);
@@ -185123,7 +185148,9 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
       if (automationDetailsId !== void 0) {
         args.push("--sarif-category", automationDetailsId);
       }
-      await new toolrunner3.ToolRunner(cmd, args).exec();
+      await new toolrunner3.ToolRunner(cmd, args, {
+        env: env.getDefined()
+      }).exec();
     },
     async resolveExtractor(language) {
       let extractorPath = "";
@@ -185139,6 +185166,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
           ...getExtraOptionsFromEnv(["resolve", "extractor"])
         ],
         {
+          env: env.getDefined(),
           silent: true,
           listeners: {
             stdout: (data) => {
@@ -185167,7 +185195,7 @@ Output was: ${extractorPath}`
         ...getExtraOptionsFromEnv(["resolve", "queries"]),
         ...queries
       ];
-      return await runCliJson(cmd, codeqlArgs, {
+      return await runCliJson(env, cmd, codeqlArgs, {
         noStreamStdout: true
       });
     },
@@ -185179,7 +185207,7 @@ Output was: ${extractorPath}`
         "--format=json",
         ...getExtraOptionsFromEnv(["resolve", "database"])
       ];
-      return await runCliJson(cmd, codeqlArgs, {
+      return await runCliJson(env, cmd, codeqlArgs, {
         noStreamStdout: true
       });
     },
@@ -185199,21 +185227,21 @@ Output was: ${extractorPath}`
       if (mergeRunsFromEqualCategory) {
         args.push("--sarif-merge-runs-from-equal-category");
       }
-      await runCli(cmd, args);
+      await runCli(env, cmd, args);
     }
   };
   if (checkVersion && !await codeQlVersionAtLeast(codeql, CODEQL_MINIMUM_VERSION)) {
     throw new ConfigurationError(
       `Expected a CodeQL CLI with version at least ${CODEQL_MINIMUM_VERSION} but got version ${(await codeql.getVersion()).version}`
     );
-  } else if (checkVersion && process.env["CODEQL_ACTION_SUPPRESS_DEPRECATED_SOON_WARNING" /* SUPPRESS_DEPRECATED_SOON_WARNING */] !== "true" && !await codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION)) {
+  } else if (checkVersion && env.getOptional("CODEQL_ACTION_SUPPRESS_DEPRECATED_SOON_WARNING" /* SUPPRESS_DEPRECATED_SOON_WARNING */) !== "true" && !await codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION)) {
     const result = await codeql.getVersion();
     core12.warning(
       `CodeQL CLI version ${result.version} was discontinued on ${GHES_MOST_RECENT_DEPRECATION_DATE} alongside GitHub Enterprise Server ${GHES_VERSION_MOST_RECENTLY_DEPRECATED} and will not be supported by the next minor release of the CodeQL Action. Please update to CodeQL CLI version ${CODEQL_NEXT_MINIMUM_VERSION} or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
 
 Alternatively, if you want to continue using CodeQL CLI version ${result.version}, you can replace 'github/codeql-action/*@v${getActionVersion().split(".")[0]}' by 'github/codeql-action/*@v${getActionVersion()}' in your code scanning workflow to continue using this version of the CodeQL Action.`
     );
-    exportEnvVar("CODEQL_ACTION_SUPPRESS_DEPRECATED_SOON_WARNING" /* SUPPRESS_DEPRECATED_SOON_WARNING */, "true");
+    env.export("CODEQL_ACTION_SUPPRESS_DEPRECATED_SOON_WARNING" /* SUPPRESS_DEPRECATED_SOON_WARNING */, "true");
   }
   return codeql;
 }
@@ -185253,9 +185281,9 @@ function getExtraOptions(options, paths, pathInfo) {
   );
   return all.concat(specific);
 }
-async function runCli(cmd, args = [], opts = {}) {
+async function runCli(env, cmd, args = [], opts = {}) {
   try {
-    return await runTool(cmd, args, opts);
+    return await runTool(env, cmd, args, opts);
   } catch (e) {
     if (e instanceof CommandInvocationError) {
       throw wrapCliConfigurationError(new CliError(e));
@@ -185263,8 +185291,8 @@ async function runCli(cmd, args = [], opts = {}) {
     throw e;
   }
 }
-async function runCliJson(cmd, args = [], opts = {}) {
-  const output = await runCli(cmd, args, opts);
+async function runCliJson(env, cmd, args = [], opts = {}) {
+  const output = await runCli(env, cmd, args, opts);
   try {
     return JSON.parse(output);
   } catch (e) {
@@ -185313,16 +185341,19 @@ function getGeneratedCodeScanningConfigPath(config) {
 function getExtractionVerbosityArguments(enableDebugLogging) {
   return enableDebugLogging ? [`--verbosity=${EXTRACTION_DEBUG_MODE_VERBOSITY}`] : [];
 }
-function applyAutobuildAzurePipelinesTimeoutFix() {
-  const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
-  process.env["JAVA_TOOL_OPTIONS"] = [
-    ...javaToolOptions.split(/\s+/),
-    "-Dhttp.keepAlive=false",
-    "-Dmaven.wagon.http.pool=false"
-  ].join(" ");
+function applyAutobuildAzurePipelinesTimeoutFix(env) {
+  const javaToolOptions = env.getOptional("JAVA_TOOL_OPTIONS") ?? "";
+  env.set(
+    "JAVA_TOOL_OPTIONS",
+    [
+      ...javaToolOptions.split(/\s+/),
+      "-Dhttp.keepAlive=false",
+      "-Dmaven.wagon.http.pool=false"
+    ].join(" ")
+  );
 }
-async function getJobRunUuidSarifOptions() {
-  const jobRunUuid = process.env["CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */];
+async function getJobRunUuidSarifOptions(env) {
+  const jobRunUuid = env.getOptional("CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */);
   return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
 }
 
@@ -193814,6 +193845,15 @@ async function getToolsInput(action, repositoryProperties) {
   return void 0;
 }
 
+// src/languages/swift.ts
+function checkSwiftCompatibility(action, config) {
+  if (config.languages.includes("swift" /* swift */) && action.platform !== "darwin") {
+    throw new ConfigurationError(
+      `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`
+    );
+  }
+}
+
 // src/status-report/tools-download.ts
 function createInitToolsDownloadFields(report, toolsFeatureFlagsValid) {
   const fields = { ...report?.perLanguage };
@@ -194333,11 +194373,7 @@ async function run3(actionState) {
       enableFileCoverageInformation: fileCoverageResult.enabled,
       logger: logger2
     });
-    if (config.languages.includes("swift" /* swift */) && process.platform !== "darwin") {
-      throw new ConfigurationError(
-        `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`
-      );
-    }
+    checkSwiftCompatibility(actionState, config);
     if (repositoryPropertiesResult.isFailure()) {
       addNoLanguageDiagnostic(
         config,

package-lock.json

@@ -10505,6 +10505,7 @@
         "@octokit/core": "^7.0.8",
         "@octokit/plugin-paginate-rest": ">=16.0.0",
         "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
+        "glob": "^13.0.6",
         "lite-matter": "^0.1.2",
         "mdast-util-from-markdown": "^2.1.0",
         "semver": "^7.8.5",

pr-checks/check-diagnostics.ts

@@ -1,6 +1,8 @@
 import fs from "fs";
+import path from "path";
 
 import * as core from "@actions/core";
+import { globSync } from "glob";
 
 import * as sarif from "../src/sarif";
 
@@ -34,59 +36,83 @@ function checkStatusPageNotification(n: sarif.Notification) {
   }
 }
 
+function checkSarif(sarifFile: string) {
+  core.info(`Checking SARIF file at '${sarifFile}'`);
+
+  const log = JSON.parse(fs.readFileSync(sarifFile, "utf8")) as sarif.Log;
+  const run = log.runs[0];
+
+  if (run.invocations === undefined) {
+    throw new Error("run.invocations is undefined");
+  }
+
+  const toolExecutionNotifications =
+    run.invocations[0].toolExecutionNotifications;
+
+  if (toolExecutionNotifications === undefined) {
+    throw new Error("toolExecutionNotifications is undefined");
+  }
+
+  const statusPageNotifications = toolExecutionNotifications.filter(
+    (n) =>
+      n.descriptor?.id === DIAGNOSTIC_ID &&
+      n.properties?.visibility?.statusPage,
+  );
+  if (statusPageNotifications.length !== 1) {
+    core.setFailed(
+      "Expected exactly one status page reporting descriptor for this diagnostic in the " +
+        `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
+        `${statusPageNotifications.length}. All notification reporting descriptors: ` +
+        `${JSON.stringify(toolExecutionNotifications)}.`,
+    );
+  }
+  checkStatusPageNotification(statusPageNotifications[0]);
+
+  const notifications = run.tool.driver.notifications;
+
+  if (notifications === undefined) {
+    throw new Error("notifications is undefined");
+  }
+
+  const diagnosticNotification = notifications.filter(
+    (n) =>
+      n.id === DIAGNOSTIC_ID &&
+      n.name === DIAGNOSTIC_ID &&
+      n.fullDescription?.text === DIAGNOSTIC_NAME,
+  );
+  if (diagnosticNotification.length !== 1) {
+    core.setFailed(
+      "Expected exactly one notification for this diagnostic in the " +
+        `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
+        `${diagnosticNotification.length}. All notifications: ` +
+        `${JSON.stringify(notifications)}.`,
+    );
+  }
+}
+
 const sarifPath = process.env["SARIF_PATH"];
 
 if (sarifPath === undefined) {
-  throw new Error("The path to a SARIF file must be set in 'SARIF_PATH'.");
-}
-
-const log = JSON.parse(fs.readFileSync(sarifPath, "utf8")) as sarif.Log;
-const run = log.runs[0];
-
-if (run.invocations === undefined) {
-  throw new Error("run.invocations is undefined");
-}
-
-const toolExecutionNotifications =
-  run.invocations[0].toolExecutionNotifications;
-
-if (toolExecutionNotifications === undefined) {
-  throw new Error("toolExecutionNotifications is undefined");
-}
-
-const statusPageNotifications = toolExecutionNotifications.filter(
-  (n) =>
-    n.descriptor?.id === DIAGNOSTIC_ID && n.properties?.visibility?.statusPage,
-);
-if (statusPageNotifications.length !== 1) {
-  core.setFailed(
-    "Expected exactly one status page reporting descriptor for this diagnostic in the " +
-      `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-      `${statusPageNotifications.length}. All notification reporting descriptors: ` +
-      `${JSON.stringify(toolExecutionNotifications)}.`,
+  throw new Error(
+    "The path to a SARIF file or directory must be set in 'SARIF_PATH'.",
   );
 }
-checkStatusPageNotification(statusPageNotifications[0]);
 
-const notifications = run.tool.driver.notifications;
+if (fs.statSync(sarifPath).isDirectory()) {
+  const sarifFiles = globSync("**/*.sarif", {
+    cwd: path.resolve(sarifPath),
+    absolute: true,
+  });
 
-if (notifications === undefined) {
-  throw new Error("notifications is undefined");
-}
+  if (sarifFiles.length < 1) {
+    throw new Error(`Unable to find any .sarif files in '${sarifPath}'.`);
+  }
 
-const diagnosticNotification = notifications.filter(
-  (n) =>
-    n.id === DIAGNOSTIC_ID &&
-    n.name === DIAGNOSTIC_ID &&
-    n.fullDescription?.text === DIAGNOSTIC_NAME,
-);
-if (diagnosticNotification.length !== 1) {
-  core.setFailed(
-    "Expected exactly one notification for this diagnostic in the " +
-      `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
-      `${diagnosticNotification.length}. All notifications: ` +
-      `${JSON.stringify(notifications)}.`,
-  );
+  for (const sarifFile of sarifFiles) {
+    checkSarif(sarifFile);
+  }
+} else {
+  checkSarif(sarifPath);
 }
 
 core.info("Finished diagnostic export test");

pr-checks/package.json

@@ -9,6 +9,7 @@
     "@octokit/core": "^7.0.8",
     "@octokit/plugin-paginate-rest": ">=16.0.0",
     "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
+    "glob": "^13.0.6",
     "lite-matter": "^0.1.2",
     "mdast-util-from-markdown": "^2.1.0",
     "semver": "^7.8.5",

src/actions-util.ts

@@ -72,7 +72,7 @@ export const getOptionalInput = function (name: string): string | undefined {
  * directory that has been set in `CODEQL_ACTION_TEMP` by e.g. a previous step, or the
  * value of `RUNNER_TEMP` otherwise.
  */
-export function getTemporaryDirectory(env: Env = getEnv()): string {
+export function getTemporaryDirectory(env: ReadOnlyEnv = getEnv()): string {
   return (
     env.getOptional(EnvVar.TEMP) ?? env.getRequired(ActionsEnvVars.RUNNER_TEMP)
   );
@@ -361,9 +361,10 @@ const MAX_STDERR_BUFFER_SIZE = 20000;
  * Runs a CLI tool.
  *
  * @returns Standard output produced by the tool.
- * @throws A `CommandInvocationError` if the tool exits with a non-zero status code.
+ * @throws A {@link CommandInvocationError} if the tool exits with a non-zero status code.
  */
 export async function runTool(
+  env: Env,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},
@@ -374,6 +375,7 @@ export async function runTool(
     process.stdout.write(`[command]${cmd} ${args.join(" ")}\n`);
   }
   const exitCode = await new toolrunner.ToolRunner(cmd, args, {
+    env: env.getDefined(),
     ignoreReturnCode: true,
     listeners: {
       stdout: (data: Buffer) => {

src/cli/output-cache.ts

@@ -2,7 +2,7 @@ import * as fs from "fs";
 import path from "path";
 
 import { getTemporaryDirectory } from "../actions-util";
-import { Env } from "../environment";
+import { ReadOnlyEnv } from "../environment";
 import * as json from "../json";
 import { Logger } from "../logging";
 
@@ -51,7 +51,7 @@ export function resetCachedCodeQlVersion(): void {
  * Returns the path to the temporary file that backs the
  * on-disk cache of CLI responses between workflow steps.
  */
-export function getCommandCacheFilePath(env: Env): string {
+export function getCommandCacheFilePath(env: ReadOnlyEnv): string {
   return path.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME);
 }
 

src/codeql.ts

@@ -18,7 +18,7 @@ import { CliError, wrapCliConfigurationError } from "./cli-errors";
 import type { ActionConfig } from "./config/action-config";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv, exportEnvVar } from "./environment";
+import { EnvVar, getEnv, Env, ReadOnlyEnv } from "./environment";
 import {
   CodeQLDefaultVersionInfo,
   Feature,
@@ -499,13 +499,14 @@ export async function getCodeQLForCmd(
   logger: Logger,
   cmd: string,
   checkVersion: boolean,
+  env: Env = getEnv(),
 ): Promise<CodeQL> {
   const codeql: CodeQL = {
     getPath() {
       return cmd;
     },
     async getVersion() {
-      const cacheFilePath = outputCache.getCommandCacheFilePath(getEnv());
+      const cacheFilePath = outputCache.getCommandCacheFilePath(env);
       let result = outputCache.getCachedCodeQlVersion(
         logger,
         cacheFilePath,
@@ -513,6 +514,7 @@ export async function getCodeQLForCmd(
       );
       if (result === undefined) {
         result = await runCliJson<VersionInfo>(
+          env,
           cmd,
           ["version", "--format=json"],
           {
@@ -596,6 +598,7 @@ export async function getCodeQLForCmd(
         : ["--no-calculate-baseline"];
 
       await runCli(
+        env,
         cmd,
         [
           "database",
@@ -631,7 +634,7 @@ export async function getCodeQLForCmd(
       }
     },
     async runAutobuild(config: Config, language: Language) {
-      applyAutobuildAzurePipelinesTimeoutFix();
+      applyAutobuildAzurePipelinesTimeoutFix(env);
 
       const autobuildCmd = path.join(
         await this.resolveExtractor(language),
@@ -641,8 +644,11 @@ export async function getCodeQLForCmd(
 
       // Bump the verbosity of the autobuild command if we're in debug mode
       if (config.debugMode) {
-        process.env[EnvVar.CLI_VERBOSITY] =
-          process.env[EnvVar.CLI_VERBOSITY] || EXTRACTION_DEBUG_MODE_VERBOSITY;
+        env.set(
+          EnvVar.CLI_VERBOSITY,
+          env.getOptional(EnvVar.CLI_VERBOSITY) ??
+            EXTRACTION_DEBUG_MODE_VERBOSITY,
+        );
       }
 
       // On macOS, System Integrity Protection (SIP) typically interferes with
@@ -659,10 +665,10 @@ export async function getCodeQLForCmd(
       // When `DYLD_INSERT_LIBRARIES` is set in the environment for a step,
       // the Actions runtime introduces its own workaround for SIP
       // (https://github.com/actions/runner/pull/416).
-      await runCli(autobuildCmd);
+      await runCli(env, autobuildCmd);
     },
     async extractScannedLanguage(config: Config, language: Language) {
-      await runCli(cmd, [
+      await runCli(env, cmd, [
         "database",
         "trace-command",
         "--index-traceless-dbs",
@@ -674,10 +680,10 @@ export async function getCodeQLForCmd(
     },
     async extractUsingBuildMode(config: Config, language: Language) {
       if (config.buildMode === BuildMode.Autobuild) {
-        applyAutobuildAzurePipelinesTimeoutFix();
+        applyAutobuildAzurePipelinesTimeoutFix(env);
       }
       try {
-        await runCli(cmd, [
+        await runCli(env, cmd, [
           "database",
           "trace-command",
           "--use-build-mode",
@@ -716,7 +722,7 @@ export async function getCodeQLForCmd(
         ...getExtraOptionsFromEnv(["database", "finalize"]),
         databasePath,
       ];
-      await runCli(cmd, args);
+      await runCli(env, cmd, args);
     },
     async resolveLanguages(
       {
@@ -725,7 +731,7 @@ export async function getCodeQLForCmd(
         filterToLanguagesWithQueries: boolean;
       } = { filterToLanguagesWithQueries: false },
     ) {
-      return runCliJson<ResolveLanguagesOutput>(cmd, [
+      return runCliJson<ResolveLanguagesOutput>(env, cmd, [
         "resolve",
         "languages",
         "--format=betterjson",
@@ -754,7 +760,11 @@ export async function getCodeQLForCmd(
       if (workingDir !== undefined) {
         codeqlArgs.push("--working-dir", workingDir);
       }
-      return await runCliJson<ResolveBuildEnvironmentOutput>(cmd, codeqlArgs);
+      return await runCliJson<ResolveBuildEnvironmentOutput>(
+        env,
+        cmd,
+        codeqlArgs,
+      );
     },
     async databaseRunQueries(
       databasePath: string,
@@ -773,7 +783,7 @@ export async function getCodeQLForCmd(
           ignoringOptions: ["--expect-discarded-cache"],
         }),
       ];
-      await runCli(cmd, codeqlArgs);
+      await runCli(env, cmd, codeqlArgs);
     },
     async databaseInterpretResults(
       databasePath: string,
@@ -806,7 +816,7 @@ export async function getCodeQLForCmd(
         "--sarif-group-rules-by-pack",
         "--sarif-include-query-help=always",
         "--sublanguage-file-coverage",
-        ...(await getJobRunUuidSarifOptions()),
+        ...(await getJobRunUuidSarifOptions(env)),
         ...getExtraOptionsFromEnv(["database", "interpret-results"]),
       ];
       if (sarifRunPropertyFlag !== undefined) {
@@ -826,7 +836,7 @@ export async function getCodeQLForCmd(
       }
       // Capture the stdout, which contains the analysis summary. Don't stream it to the Actions
       // logs to avoid printing it twice.
-      return await runCli(cmd, codeqlArgs, {
+      return await runCli(env, cmd, codeqlArgs, {
         noStreamStdout: true,
       });
     },
@@ -843,7 +853,7 @@ export async function getCodeQLForCmd(
           `--cache-cleanup=${cleanupLevel}`,
           ...getExtraOptionsFromEnv(["database", "cleanup"]),
         ];
-        await runCli(cmd, codeqlArgs);
+        await runCli(env, cmd, codeqlArgs);
       }
     },
     async databaseBundle(
@@ -877,7 +887,9 @@ export async function getCodeQLForCmd(
           ]),
         );
       }
-      await new toolrunner.ToolRunner(cmd, args).exec();
+      await new toolrunner.ToolRunner(cmd, args, {
+        env: env.getDefined(),
+      }).exec();
     },
     async databaseExportDiagnostics(
       databasePath: string,
@@ -898,7 +910,9 @@ export async function getCodeQLForCmd(
       if (automationDetailsId !== undefined) {
         args.push("--sarif-category", automationDetailsId);
       }
-      await new toolrunner.ToolRunner(cmd, args).exec();
+      await new toolrunner.ToolRunner(cmd, args, {
+        env: env.getDefined(),
+      }).exec();
     },
     async diagnosticsExport(
       sarifFile: string,
@@ -946,7 +960,9 @@ export async function getCodeQLForCmd(
       if (automationDetailsId !== undefined) {
         args.push("--sarif-category", automationDetailsId);
       }
-      await new toolrunner.ToolRunner(cmd, args).exec();
+      await new toolrunner.ToolRunner(cmd, args, {
+        env: env.getDefined(),
+      }).exec();
     },
     async resolveExtractor(language: Language): Promise<string> {
       // Request it using `format=json` so we don't need to strip the trailing new line generated by
@@ -964,6 +980,7 @@ export async function getCodeQLForCmd(
           ...getExtraOptionsFromEnv(["resolve", "extractor"]),
         ],
         {
+          env: env.getDefined(),
           silent: true,
           listeners: {
             stdout: (data) => {
@@ -991,7 +1008,7 @@ export async function getCodeQLForCmd(
         ...getExtraOptionsFromEnv(["resolve", "queries"]),
         ...queries,
       ];
-      return await runCliJson<string[]>(cmd, codeqlArgs, {
+      return await runCliJson<string[]>(env, cmd, codeqlArgs, {
         noStreamStdout: true,
       });
     },
@@ -1005,7 +1022,7 @@ export async function getCodeQLForCmd(
         "--format=json",
         ...getExtraOptionsFromEnv(["resolve", "database"]),
       ];
-      return await runCliJson<ResolveDatabaseOutput>(cmd, codeqlArgs, {
+      return await runCliJson<ResolveDatabaseOutput>(env, cmd, codeqlArgs, {
         noStreamStdout: true,
       });
     },
@@ -1032,7 +1049,7 @@ export async function getCodeQLForCmd(
         args.push("--sarif-merge-runs-from-equal-category");
       }
 
-      await runCli(cmd, args);
+      await runCli(env, cmd, args);
     },
   };
   // To ensure that status reports include the CodeQL CLI version wherever
@@ -1054,7 +1071,7 @@ export async function getCodeQLForCmd(
     );
   } else if (
     checkVersion &&
-    process.env[EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING] !== "true" &&
+    env.getOptional(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING) !== "true" &&
     !(await util.codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION))
   ) {
     const result = await codeql.getVersion();
@@ -1072,7 +1089,7 @@ export async function getCodeQLForCmd(
         }' by 'github/codeql-action/*@v${getActionVersion()}' in your code scanning workflow to ` +
         "continue using this version of the CodeQL Action.",
     );
-    exportEnvVar(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
+    env.export(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
   }
   return codeql;
 }
@@ -1149,12 +1166,13 @@ export function getExtraOptions(
 }
 
 async function runCli(
+  env: Env,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},
 ): Promise<string> {
   try {
-    return await runTool(cmd, args, opts);
+    return await runTool(env, cmd, args, opts);
   } catch (e) {
     if (e instanceof CommandInvocationError) {
       throw wrapCliConfigurationError(new CliError(e));
@@ -1165,6 +1183,8 @@ async function runCli(
 
 /**
  * Wraps the command executor {@link runCli} and tries to parse the output as JSON.
+ *
+ * @param env The environment variables.
  * @param cmd The command to run.
  * @param args The arguments to pass to the command.
  * @param opts The options for running the command.
@@ -1173,11 +1193,12 @@ async function runCli(
  * @returns The parsed JSON output from the command.
  */
 async function runCliJson<T>(
+  env: Env,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},
 ): Promise<T> {
-  const output = await runCli(cmd, args, opts);
+  const output = await runCli(env, cmd, args, opts);
   try {
     return JSON.parse(output) as T;
   } catch (e) {
@@ -1276,17 +1297,20 @@ function getExtractionVerbosityArguments(
  * Without the fix, long build processes will timeout when pulling down Java packages
  * https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html
  */
-function applyAutobuildAzurePipelinesTimeoutFix() {
-  const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
-  process.env["JAVA_TOOL_OPTIONS"] = [
-    ...javaToolOptions.split(/\s+/),
-    "-Dhttp.keepAlive=false",
-    "-Dmaven.wagon.http.pool=false",
-  ].join(" ");
+function applyAutobuildAzurePipelinesTimeoutFix(env: Env) {
+  const javaToolOptions = env.getOptional("JAVA_TOOL_OPTIONS") ?? "";
+  env.set(
+    "JAVA_TOOL_OPTIONS",
+    [
+      ...javaToolOptions.split(/\s+/),
+      "-Dhttp.keepAlive=false",
+      "-Dmaven.wagon.http.pool=false",
+    ].join(" "),
+  );
 }
 
-async function getJobRunUuidSarifOptions() {
-  const jobRunUuid = process.env[EnvVar.JOB_RUN_UUID];
+async function getJobRunUuidSarifOptions(env: ReadOnlyEnv) {
+  const jobRunUuid = env.getOptional(EnvVar.JOB_RUN_UUID);
 
   return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
 }

src/diagnostics.ts

@@ -3,7 +3,7 @@ import path from "path";
 
 import type { ActionState } from "./action-common";
 import { getTemporaryDirectory } from "./actions-util";
-import type { Config } from "./config-utils";
+import type { ActionConfig } from "./config/action-config";
 import { Language } from "./languages";
 import { getActionsLogger, type Logger } from "./logging";
 import {
@@ -177,7 +177,10 @@ export function getTempLanguageDiagnosticsPath(
 }
 
 /** Gets the path where diagnostics for {@link language} should be stored in the database. */
-export function getDatabaseDiagnosticsPath(config: Config, language: Language) {
+export function getDatabaseDiagnosticsPath(
+  config: ActionConfig<"dbLocation">,
+  language: Language,
+) {
   return getLanguageDiagnosticsPath(config.dbLocation, language);
 }
 
@@ -190,7 +193,7 @@ export function getDatabaseDiagnosticsPath(config: Config, language: Language) {
  * @param diagnostic The diagnostic message to add to the database.
  */
 export function addDiagnostic(
-  config: Config,
+  config: ActionConfig<"dbLocation" | "tempDir">,
   language: Language,
   diagnostic: DiagnosticMessage,
   logger: Logger = getActionsLogger(),
@@ -215,7 +218,7 @@ export function addDiagnostic(
 
 /** Adds a diagnostic that is not specific to any language. */
 export function addNoLanguageDiagnostic(
-  config: Config | undefined,
+  config: ActionConfig<"dbLocation" | "languages" | "tempDir"> | undefined,
   diagnostic: DiagnosticMessage,
   logger: Logger = getActionsLogger(),
 ) {
@@ -305,7 +308,7 @@ function writeDiagnosticFile(
  */
 function writeDiagnostic(
   action: ActionState<["Logger"]>,
-  config: Config,
+  config: ActionConfig<"dbLocation">,
   language: Language,
   diagnostic: DiagnosticMessage,
 ) {
@@ -348,7 +351,7 @@ export function logTemporaryDiagnostics(action: ActionState<["Logger"]>) {
 /** Relocates all temporary diagnostics to the respective databases. */
 export function flushDiagnostics(
   action: ActionState<["Logger"]>,
-  config: Config,
+  config: ActionConfig<"dbLocation" | "languages">,
 ) {
   const diagnosticsCount = temporaryDiagnostics.length;
   action.logger.debug(

src/environment.ts

@@ -293,8 +293,8 @@ export function getOptionalEnvVar(paramName: string): string | undefined {
  * in tests, while clearly signalling in regular code that the consumer of the `ReadOnlyEnv` instance
  * will only read from it.
  */
-export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
-  constructor(protected readonly vars: Record<string, T>) {}
+export class ReadOnlyEnv {
+  constructor(protected readonly vars: Record<string, string | undefined>) {}
 
   /** Clones the object while detaching the underlying environment from the original. */
   public clone(): this {
@@ -302,10 +302,24 @@ export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
   }
 
   /** Gets a copy of the underlying environment. */
-  public get(): Record<string, T> {
+  public get(): Record<string, string | undefined> {
     return { ...this.vars };
   }
 
+  /** Gets a copy of the underlying environment, where the values are not `undefined`. */
+  public getDefined(): Record<string, string> {
+    const result: Record<string, string> = {};
+
+    for (const [key, val] of Object.entries(this.vars)) {
+      if (val === undefined) {
+        continue;
+      }
+      result[key] = val;
+    }
+
+    return result;
+  }
+
   /** Tries to get the value for `name` and throws if there isn't one. */
   public getRequired(name: string): string {
     return getRequiredEnvVar(this.vars, name);
@@ -317,7 +331,7 @@ export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
   }
 
   /** Gets the entries of the underlying `ProcessEnv`. */
-  public entries(): Array<[string, T]> {
+  public entries(): Array<[string, string | undefined]> {
     return Object.entries(this.vars);
   }
 
@@ -347,19 +361,17 @@ export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
  * Use `ReadOnlyEnv` instead if you only plan to read from the environment.
  * This type allows writing to the environment.
  */
-export class Env<
-  T extends string | undefined = string | undefined,
-> extends ReadOnlyEnv<T> {
+export class Env extends ReadOnlyEnv {
   private changed: boolean = false;
 
   /** Sets an environment variable. */
-  public set(name: string, value: T): void {
+  public set(name: string, value: string | undefined): void {
     this.vars[name] = value;
     this.changed = true;
   }
 
   /** Sets all environment variables given by `vars`. */
-  public setAll(vars: Record<string, T>): void {
+  public setAll(vars: Record<string, string | undefined>): void {
     for (const [key, val] of Object.entries(vars)) {
       this.set(key, val);
     }
@@ -373,7 +385,7 @@ export class Env<
    * @param name The name of the environment variable to set and export.
    * @param val The value to set and export for the environment variable.
    */
-  public export(name: string, val: T): void {
+  public export(name: string, val: string): void {
     // Setting the environment variable for this instance is always OK, including
     // in tests, since we use fresh `Env` instances whenever needed. This allows
     // tests to pass that rely on that part of the `core.exportVariable` behaviour.

src/init-action.ts

@@ -62,6 +62,7 @@ import {
   runDatabaseInitCluster,
 } from "./init";
 import { JavaEnvVars, BuiltInLanguage } from "./languages";
+import { checkSwiftCompatibility } from "./languages/swift";
 import { Logger, withGroupAsync } from "./logging";
 import {
   downloadOverlayBaseDatabaseFromCache,
@@ -418,14 +419,7 @@ async function run(
       logger,
     });
 
-    if (
-      config.languages.includes(BuiltInLanguage.swift) &&
-      process.platform !== "darwin"
-    ) {
-      throw new ConfigurationError(
-        `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
-      );
-    }
+    checkSwiftCompatibility(actionState, config);
 
     if (repositoryPropertiesResult.isFailure()) {
       addNoLanguageDiagnostic(

src/languages/swift.test.ts

@@ -0,0 +1,70 @@
+import test from "ava";
+import sinon from "sinon";
+
+import { ActionsEnvVars } from "../environment";
+import {
+  createTestConfig,
+  getCodeQLForTesting,
+  getTestEnv,
+  initAllState,
+  makeVersionInfo,
+  RecordingLogger,
+} from "../testing-utils";
+import { ConfigurationError, withTmpDir } from "../util";
+
+import { checkSwiftCompatibility } from "./swift";
+
+import { BuiltInLanguage } from ".";
+
+test("checkSwiftCompatibility doesn't throw for non-Swift languages", (t) => {
+  for (const language of Object.values(BuiltInLanguage)) {
+    if (language === BuiltInLanguage.swift) {
+      continue;
+    }
+
+    t.notThrows(() =>
+      checkSwiftCompatibility(
+        initAllState(),
+        createTestConfig({ languages: [language] }),
+      ),
+    );
+  }
+});
+
+test("checkSwiftCompatibility doesn't throw for Swift on darwin", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLForTesting("codeql-for-testing", logger, env);
+    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+    t.notThrows(() =>
+      checkSwiftCompatibility(
+        initAllState({ platform: "darwin", env, logger }),
+        createTestConfig({
+          tempDir: tmpDir,
+          languages: [BuiltInLanguage.swift],
+        }),
+      ),
+    );
+  }));
+
+const nonDarwinPlatforms: NodeJS.Platform[] = ["linux", "win32"];
+for (const nonDarwinPlatform of nonDarwinPlatforms) {
+  test(`checkSwiftCompatibility throws for Swift on ${nonDarwinPlatform}`, (t) => {
+    t.throws(
+      () => {
+        checkSwiftCompatibility(
+          initAllState({ platform: nonDarwinPlatform }),
+          createTestConfig({ languages: [BuiltInLanguage.swift] }),
+        );
+      },
+      {
+        instanceOf: ConfigurationError,
+        message: /^Swift analysis is only supported on macOS runner images/,
+      },
+    );
+  });
+}

src/languages/swift.ts

@@ -0,0 +1,27 @@
+import { ActionState } from "../action-common";
+import { Config } from "../config-utils";
+import { ConfigurationError } from "../util";
+
+import { BuiltInLanguage } from ".";
+
+/**
+ * Determines whether we can run a Swift analysis on the current runner.
+ *
+ * @param action The Action state.
+ * @param config The Action configuration.
+ *
+ * @throws {ConfigurationError} If Swift analysis is not possible on the current runner.
+ */
+export function checkSwiftCompatibility(
+  action: ActionState<["Base"]>,
+  config: Config,
+) {
+  if (
+    config.languages.includes(BuiltInLanguage.swift) &&
+    action.platform !== "darwin"
+  ) {
+    throw new ConfigurationError(
+      `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
+    );
+  }
+}

src/testing-utils.ts

@@ -1052,6 +1052,7 @@ export function makeTestToken(length: number = 36) {
 export async function getCodeQLForTesting(
   cmd = "codeql-for-testing",
   logger: Logger = new RecordingLogger(),
+  env: Env = getEnv(),
 ): Promise<codeql.CodeQL> {
-  return codeql.getCodeQLForCmd(logger, cmd, false);
+  return codeql.getCodeQLForCmd(logger, cmd, false, env);
 }