Merge remote-tracking branch 'origin/main' into mbg/improve-checkout-path

2026-11-08 22:19:50 +00:00 · 2026-09-28 10:49:13 +01:00
parent 72509a81ba 7b6a151fb5
commit 5769ffc476
32 changed files with 392 additions and 316 deletions
--- a/lib/defaults.json
+++ b/lib/defaults.json
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.0",
-  "cliVersion": "2.27.0",
-  "priorBundleVersion": "codeql-bundle-v2.26.4",
-  "priorCliVersion": "2.26.4"
+  "bundleVersion": "codeql-bundle-v2.27.1",
+  "cliVersion": "2.27.1",
+  "priorBundleVersion": "codeql-bundle-v2.27.0",
+  "priorCliVersion": "2.27.0"
 }
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -144785,6 +144785,7 @@ function doubleQuoteWhitespaceOnly(layout) {
 function applyForceQuotesOption(layout) {
  if (!layout.presenterOptions.forceQuotes) return;
  if (layout.isKey || layout.style !== SCALAR_STYLE.PLAIN) return;
+  if (layout.node.tag !== layout.presenterOptions.schema.defaultScalarTag.tagName) return;
  layout.style = layout.node.value.includes("\n") ? SCALAR_STYLE.DOUBLE_QUOTED : _preferredQuotedStyle(layout);
 }
 function tryLongOrMultilineAsBlock(layout) {
@@ -146001,7 +146002,13 @@ function parseMatrixInput(matrixInput) {
  if (matrixInput === void 0 || matrixInput === "null") {
    return void 0;
  }
-  return JSON.parse(matrixInput);
+  try {
+    return JSON.parse(matrixInput);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse matrix input '${matrixInput}': ${getErrorMessage(err)}`
+    );
+  }
 }
 function wrapError(error3) {
  return error3 instanceof Error ? error3 : new Error(String(error3));
@@ -146069,7 +146076,11 @@ var BuildMode = /* @__PURE__ */ ((BuildMode3) => {
  return BuildMode3;
 })(BuildMode || {});
 function cloneObject(obj) {
-  return JSON.parse(JSON.stringify(obj));
+  try {
+    return JSON.parse(JSON.stringify(obj));
+  } catch (err) {
+    throw new Error(`Cloning object failed: ${getErrorMessage(err)}`);
+  }
 }
 async function cleanUpPath(file, name, logger) {
  logger.debug(`Cleaning up ${name}.`);
@@ -146173,7 +146184,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) {
  return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.38.2";
+  return "4.38.3";
 }
 function getWorkflowEventName(env = getEnv()) {
  return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */);
@@ -146394,14 +146405,22 @@ var persistInputs = function(env = getEnv()) {
  );
  core3.saveState(persistedInputsKey, JSON.stringify(inputEnvironmentVariables));
 };
-var restoreInputs = function() {
-  const persistedInputs = core3.getState(persistedInputsKey);
-  if (persistedInputs) {
-    for (const [name, value] of JSON.parse(persistedInputs)) {
-      process.env[name] = value;
+function restoreInputs(logger) {
+  try {
+    const persistedInputsValue = core3.getState(persistedInputsKey);
+    if (persistedInputsValue) {
+      const persistedInputs = JSON.parse(persistedInputsValue);
+      for (const [name, value] of persistedInputs) {
+        process.env[name] = value;
+      }
    }
+  } catch (err) {
+    logger.error(`Unable to restore inputs: ${getErrorMessage(err)}`);
+    throw new Error(
+      "Failed to restore inputs from the state set by this action's main execution."
+    );
  }
-};
+}
 function getPullRequestBranches(env = getEnv()) {
  const pullRequest = github.context.payload.pull_request;
  if (pullRequest) {
@@ -146755,9 +146774,10 @@ async function getGitHubVersionFromApi(apiClient, apiDetails) {
 }
 async function getGitHubVersion() {
  if (cachedGitHubVersion === void 0) {
+    const apiDetails = getApiDetails();
    cachedGitHubVersion = await getGitHubVersionFromApi(
-      getApiClient(),
-      getApiDetails()
+      createApiClientWithDetails(apiDetails),
+      apiDetails
    );
  }
  return cachedGitHubVersion;
@@ -147739,8 +147759,8 @@ var path6 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());

 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.27.0";
-var cliVersion = "2.27.0";
+var bundleVersion = "codeql-bundle-v2.27.1";
+var cliVersion = "2.27.1";

 // src/overlay/index.ts
 var fs5 = __toESM(require("fs"));
@@ -151074,7 +151094,12 @@ async function getConfig(tempDir, logger) {
  }
  if (config.version !== getActionVersion()) {
    throw new ConfigurationError(
-      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
+      [
+        `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'.`,
+        "All steps in a workflow that use `github/codeql-action` must use the same version to work correctly.",
+        "If you are using Dependabot to manage dependency updates, you can configure a dependency group to update all `github/codeql-action` steps at the same time.",
+        "For more information, see https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#groups--"
+      ].join(" ")
    );
  }
  return config;
@@ -151225,6 +151250,20 @@ var import_fast_deep_equal = __toESM(require_fast_deep_equal());
 var semver10 = __toESM(require_semver2());

 // src/codeql-bundle.ts
+function getCodeQLBundleName(compressionMethod, platform2, language) {
+  const extensions = {
+    gzip: ".tar.gz",
+    zstd: ".tar.zst"
+  };
+  const extension = extensions[compressionMethod];
+  if (platform2 === void 0) {
+    return `codeql-bundle${extension}`;
+  }
+  if (language !== void 0) {
+    return `codeql-bundle-${language}-${platform2}${extension}`;
+  }
+  return `codeql-bundle-${platform2}${extension}`;
+}
 var PER_LANGUAGE_BUNDLE_NAME = /^codeql-bundle-(.+)-(?:linux64|osx64|win64)\.tar\.(?:gz|zst)$/;
 function getCodeQLBundleFromUrl(url2) {
  let assetName;
@@ -151626,6 +151665,11 @@ async function getPerLanguageBundleLanguage({
  }
  return language;
 }
+function logPerLanguageBundleFallback({ logger }, language, location) {
+  logger.warning(
+    `No per-language CodeQL bundle for '${language}' was found at ${location}, so falling back to the bundle that contains all languages. This analysis will still produce correct results, but will take longer to set up.`
+  );
+}

 // src/tar.ts
 var import_child_process = require("child_process");
@@ -152024,27 +152068,6 @@ var CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";
 var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"];
 var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
 var CODEQL_TOOLCACHE_INPUT = "toolcache";
-function getCodeQLBundleExtension(compressionMethod) {
-  switch (compressionMethod) {
-    case "gzip":
-      return ".tar.gz";
-    case "zstd":
-      return ".tar.zst";
-    default:
-      assertNever(compressionMethod);
-  }
-}
-function getCodeQLBundleName(compressionMethod, language) {
-  const extension = getCodeQLBundleExtension(compressionMethod);
-  const platform2 = getBundlePlatform();
-  if (platform2 === void 0) {
-    return `codeql-bundle${extension}`;
-  }
-  if (language !== void 0) {
-    return `codeql-bundle-${language}-${platform2}${extension}`;
-  }
-  return `codeql-bundle-${platform2}${extension}`;
-}
 function getCodeQLActionRepository(logger) {
  if (isRunningLocalAction()) {
    logger.info(
@@ -152453,20 +152476,21 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO
      );
    }
    compressionMethod = cliVersion2 !== void 0 && await useZstdBundle(cliVersion2, tarSupportsZstd) ? "zstd" : "gzip";
+    const platform2 = getBundlePlatform();
    const perLanguageBundleLanguage = await getPerLanguageBundleLanguage(
      { env: getEnv(), features, logger },
      {
        rawLanguages,
        cliVersion: cliVersion2,
        compressionMethod,
-        platform: getBundlePlatform(),
+        platform: platform2,
        variant
      }
    );
    const resolveBundleURL = (language) => getCodeQLBundleDownloadURL(
      bundleTagName,
      apiDetails,
-      getCodeQLBundleName(compressionMethod, language),
+      getCodeQLBundleName(compressionMethod, platform2, language),
      logger
    );
    const combinedBundleURL = await resolveBundleURL();
@@ -152699,9 +152723,7 @@ async function downloadCodeQLBundle(action, source, apiDetails, tarVersion, temp
    if (bundle.kind !== "per-language" || bundle.combinedBundleURL === void 0 || asHTTPError(e)?.status !== 404) {
      throw e;
    }
-    logger.warning(
-      `No per-language CodeQL bundle for '${bundle.language}' was found at ${bundle.url}, so falling back to the bundle that contains all languages. This analysis will still produce correct results, but will take longer to set up.`
-    );
+    logPerLanguageBundleFallback(action, bundle.language, bundle.url);
    const result = await downloadCodeQL(
      {
        ...source,
@@ -152738,11 +152760,12 @@ async function getLatestNightlyBundle(action, rawLanguages, variant) {
    CODEQL_VERSION_ZSTD_BUNDLE,
    zstdAvailability.available
  ) ? "zstd" : "gzip";
+  const platform2 = getBundlePlatform();
  const language = await getPerLanguageBundleLanguage(action, {
    rawLanguages,
    cliVersion: void 0,
    compressionMethod,
-    platform: getBundlePlatform(),
+    platform: platform2,
    variant,
    isLatestNightly: true
  });
@@ -152759,12 +152782,16 @@ async function getLatestNightlyBundle(action, rawLanguages, variant) {
      throw new Error("Could not find the latest nightly release.");
    }
    const assetUrl = (name) => `https://github.com/${CODEQL_NIGHTLIES_REPOSITORY_OWNER}/${CODEQL_NIGHTLIES_REPOSITORY_NAME}/releases/download/${latestRelease.tag_name}/${name}`;
-    const url2 = assetUrl(getCodeQLBundleName(compressionMethod, language));
+    const url2 = assetUrl(
+      getCodeQLBundleName(compressionMethod, platform2, language)
+    );
    return language === void 0 ? { kind: "combined", url: url2 } : {
      kind: "per-language",
      url: url2,
      language,
-      combinedBundleURL: assetUrl(getCodeQLBundleName(compressionMethod))
+      combinedBundleURL: assetUrl(
+        getCodeQLBundleName(compressionMethod, platform2)
+      )
    };
  } catch (e) {
    throw new Error(
@@ -152835,25 +152862,28 @@ async function endTracingForCluster(codeql, config, logger) {
    );
  }
 }
-async function getTracerConfigForCluster(config) {
-  const tracingEnvVariables = JSON.parse(
-    fs15.readFileSync(
-      path14.resolve(
-        config.dbLocation,
-        "temp/tracingEnvironment/start-tracing.json"
-      ),
-      "utf8"
-    )
+async function getTracerConfigForCluster(logger, config) {
+  const filePath = path14.resolve(
+    config.dbLocation,
+    "temp/tracingEnvironment/start-tracing.json"
  );
-  return {
-    env: tracingEnvVariables
-  };
+  try {
+    const tracingEnvVariables = JSON.parse(fs15.readFileSync(filePath, "utf8"));
+    return {
+      env: tracingEnvVariables
+    };
+  } catch (err) {
+    logger.error(
+      `Failed to parse tracing environment from '${filePath}': ${getErrorMessage(err)}`
+    );
+    throw new Error(`Failed to parse tracing environment from '${filePath}'.`);
+  }
 }
-async function getCombinedTracerConfig(codeql, config) {
+async function getCombinedTracerConfig(logger, codeql, config) {
  if (!await shouldEnableIndirectTracing(codeql, config)) {
    return void 0;
  }
-  return await getTracerConfigForCluster(config);
+  return await getTracerConfigForCluster(logger, config);
 }

 // src/codeql.ts
@@ -153267,6 +153297,7 @@ async function getCodeQLForCmd(logger, cmd, checkVersion) {
          "--format=json",
          `--language=${language}`,
          "--extractor-include-aliases",
+          "-J-XX:-UsePerfData",
          ...getExtraOptionsFromEnv(["resolve", "extractor"])
        ],
        {
@@ -153281,7 +153312,14 @@ async function getCodeQLForCmd(logger, cmd, checkVersion) {
          }
        }
      ).exec();
-      return JSON.parse(extractorPath);
+      try {
+        return JSON.parse(extractorPath);
+      } catch (err) {
+        throw new Error(
+          `Failed to parse extractor path for '${language}' from CLI: ${getErrorMessage(err)}
+Output was: ${extractorPath}`
+        );
+      }
    },
    async resolveQueriesStartingPacks(queries) {
      const codeqlArgs = [
@@ -155786,7 +155824,13 @@ function getToolNames(sarifFile) {
  return Object.keys(toolNames);
 }
 function readSarifFile(sarifFilePath) {
-  return JSON.parse(fs21.readFileSync(sarifFilePath, "utf8"));
+  try {
+    return JSON.parse(fs21.readFileSync(sarifFilePath, "utf8"));
+  } catch (err) {
+    throw new Error(
+      `Parsing SARIF file at '${sarifFilePath}' failed: ${getErrorMessage(err)}`
+    );
+  }
 }
 function combineSarifFiles(sarifFiles, logger) {
  logger.info(`Loading SARIF file(s)`);
@@ -158930,7 +158974,7 @@ var import_async = __toESM(require_async(), 1);
 var import_path7 = require("path");

 // node_modules/archiver/lib/error.js
-var import_util35 = __toESM(require("util"), 1);
+var import_util36 = __toESM(require("util"), 1);
 var ERROR_CODES = {
  ABORTED: "archive was aborted",
  DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value",
@@ -158955,7 +158999,7 @@ function ArchiverError(code, data) {
  this.code = code;
  this.data = data;
 }
-import_util35.default.inherits(ArchiverError, Error);
+import_util36.default.inherits(ArchiverError, Error);

 // node_modules/archiver/lib/core.js
 var import_readable_stream2 = __toESM(require_ours(), 1);
@@ -161750,8 +161794,8 @@ async function createDatabaseBundleCli(codeql, config, language) {
 // src/analyze-action-post.ts
 async function runWrapper2() {
  try {
-    restoreInputs();
    const logger = getActionsLogger();
+    restoreInputs(logger);
    const gitHubVersion = await getGitHubVersion();
    checkGitHubVersionInRange(gitHubVersion, logger);
    if (process.env["CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */] === "true") {
@@ -162652,7 +162696,7 @@ exec ${goBinaryPath} "$@"`
        qlconfigFile
      );
    }
-    const tracerConfig = await getCombinedTracerConfig(codeql, config);
+    const tracerConfig = await getCombinedTracerConfig(logger, codeql, config);
    if (tracerConfig !== void 0) {
      for (const [key, value] of Object.entries(tracerConfig.env)) {
        core22.exportVariable(key, value);
@@ -163059,7 +163103,7 @@ async function run4(startedAt) {
  let dependencyCachingUsage;
  try {
    const jobStatus2 = getOptionalInput("job-status");
-    restoreInputs();
+    restoreInputs(logger);
    const gitHubVersion = await getGitHubVersion();
    checkGitHubVersionInRange(gitHubVersion, logger);
    const repositoryNwo = getRepositoryNwo();
@@ -164210,7 +164254,7 @@ var core29 = __toESM(require_core());
 async function runWrapper9() {
  const logger = getActionsLogger();
  try {
-    restoreInputs();
+    restoreInputs(logger);
    const pid = core29.getState("proxy-process-pid");
    if (pid) {
      process.kill(Number(pid));
@@ -164224,12 +164268,6 @@ async function runWrapper9() {
      logger.info(
        "Debug mode is on. Uploading proxy log as Actions debugging artifact..."
      );
-      if (config?.gitHubVersion.type === void 0) {
-        logger.warning(
-          `Did not upload debug artifacts because cannot determine the GitHub variant running.`
-        );
-        return;
-      }
      const gitHubVersion = await getGitHubVersion();
      checkGitHubVersionInRange(gitHubVersion, logger);
      await uploadArtifacts(
@@ -164361,8 +164399,8 @@ async function runWrapper10() {
 var core31 = __toESM(require_core());
 async function runWrapper11() {
  try {
-    restoreInputs();
    const logger = getActionsLogger();
+    restoreInputs(logger);
    const gitHubVersion = await getGitHubVersion();
    checkGitHubVersionInRange(gitHubVersion, logger);
    if (process.env["CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */] !== "true") {
@@ -164547,7 +164585,7 @@ tmp/lib/tmp.js:
   *)

 js-yaml/dist/js-yaml.mjs:
-  (*! js-yaml 5.4.1 https://github.com/nodeca/js-yaml @license MIT *)
+  (*! js-yaml 5.4.2 https://github.com/nodeca/js-yaml @license MIT *)

 long/index.js:
  (**